Privacy Policy

Step 1 — Real-Time Transcription (Deepgram)

Raw voice audio is streamed to Deepgram for real-time speech-to-text conversion. Deepgram processes the audio stream and returns a text transcript. Raw audio is not stored in Dimora's databases. Deepgram's retention of audio in its own systems is governed by Deepgram's DPA and privacy policy. Per Deepgram's standard terms, audio is not retained beyond the transcription session buffer.

Step 2 — LLM Inference (OpenAI)

The live transcript text is passed to OpenAI's API (GPT models) for AI response generation. OpenAI processes transcripts under its API Data Processing Addendum. Per OpenAI's standard API terms (zero data retention agreement in effect), content submitted via the API is not used to train OpenAI models and is retained for a maximum of 30 days for abuse monitoring purposes.

Step 3 — Transcript Storage (Dimora / Supabase)

The completed call transcript, duration, caller phone number, and call outcome are stored in Dimora's Supabase database (AWS us-east-1). Transcripts are retained for 90 days post-call, then permanently deleted. Post-termination of a Customer account, all transcripts are deleted within 90 days.

Voice AI — Fully Automated Call Handling

Our Voice AI (Maggie) handles inbound guest calls fully automatically, without a human operator on the line. The AI makes real-time decisions about how to respond to guest inquiries, including: providing property information, discussing reservation changes, routing emergencies, and generating upsell offers.

Nature of effects: In most cases, the AI's responses are informational or facilitative. We do not believe standard call-handling constitutes "legal or similarly significant effects" within the meaning of Art. 22(1). However, in an abundance of caution, we provide the following human review mechanisms.

Inbox AI — Draft Generation (Not Fully Automated)

Inbox AI drafts are generated automatically but reviewed and approved by a human property manager before being sent to the guest. This "human-in-the-loop" design means Inbox AI does not constitute solely automated decision-making under Art. 22.

Revenue Engine — Upsell Offer Generation

Revenue Engine automatically identifies upsell opportunities (late checkout, early check-in, gap night extensions) and sends offers to guests. Guest acceptance is required — no charges are made automatically. Guests may decline any offer without consequence.

Payment Audit — Balance Flagging

Payment Audit automatically flags outstanding reservation balances. This is a notification to the property manager only — no automated action is taken against the guest. The property manager decides whether and how to follow up.

What We Do — Dimora's Own AI Improvement

We use anonymized and pseudonymized call transcript excerpts and inbox drafts to identify patterns, improve response quality, and retrain our internal AI learning systems. Before use for this purpose, personal identifiers (names, phone numbers, email addresses, specific property details) are removed or replaced with generalized equivalents.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in improving service quality. We do not use identifiable personal data for AI model training. EU data subjects have the right to object to this processing by emailing privacy@dimora.ai.

Sub-Processor AI Training Policies

• OpenAI: We operate under OpenAI's API Data Processing Addendum with zero data retention settings enabled. Content submitted via the API is not used to train OpenAI models. OpenAI retains API inputs/outputs for up to 30 days solely for abuse monitoring, then deletes them.
• Anthropic (Claude / via OpenRouter): Per Anthropic's published API policy, content submitted via the API is not used to train Anthropic models. No retention beyond inference.
• Google (Gemini API): Content submitted via the Gemini API is not used to train Google's models, per Google's Cloud Data Processing Addendum. Google Workspace (Gmail for post-call summaries) is governed by the Google Workspace DPA.
• Deepgram: Voice audio submitted for transcription is not used to train Deepgram models under our enterprise agreement. Audio data is not retained beyond the transcription buffer.
• xAI (Grok) / OpenRouter: No retention beyond inference per OpenRouter's and xAI's published policies.

Right of Access (Art. 15)

Obtain a copy of the personal data we hold about you, and information about how it is used.

Right to Rectification (Art. 16)

Have inaccurate personal data corrected without undue delay.

Right to Erasure / Right to be Forgotten (Art. 17)

Have personal data deleted where it is no longer necessary, or where consent is withdrawn and no other basis applies.

Right to Restriction of Processing (Art. 18)

Have processing restricted while accuracy is contested, or where processing is unlawful but you prefer restriction over erasure.

Right to Data Portability (Art. 20)

Receive personal data you provided to us in a structured, machine-readable format, and have it transmitted to another controller.

Right to Object (Art. 21)

Object to processing based on legitimate interests (Art. 6(1)(f)). We must cease processing unless we demonstrate compelling legitimate grounds that override your interests, or for the establishment, exercise, or defence of legal claims.

Right to Withdraw Consent (Art. 7(3))

Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

Rights Related to Automated Decision-Making (Art. 22)

Not be subject to solely automated decisions producing significant effects. Request human review, express your viewpoint, and contest automated decisions.

GDPR Article 8 — Conditions Applicable to Children's Consent

Under GDPR Article 8, consent for information society services offered to children requires parental or guardian authorisation for children below the age of digital consent. The EU member state thresholds vary: 16 years by default (GDPR), 13 years in Spain under LOPDGDD (Organic Law 3/2018 on Data Protection and Digital Rights Guarantee), 13 years in the UK, and 13 years in the US under COPPA.

Dimora's services are not directed to minors. If a guest call is made by a minor, the property manager (as data controller) is responsible for ensuring appropriate parental consent where required by applicable law. We do not knowingly collect personal data from children under 13 without verifiable parental consent.

If We Discover Child Data Has Been Collected

If we become aware that we have inadvertently collected personal data from an individual under the applicable age of consent without proper parental authorisation, we will: (1) notify the relevant Customer within 24 hours; (2) delete the personal data from our systems within 5 business days; and (3) notify the relevant supervisory authority if required by law. Parents or guardians who believe their child's data has been processed may contact us at privacy@dimora.ai.

Required for the website to function. No consent required under GDPR Recital 25 and ePrivacy Directive Art. 5(3). These include session management, security (CSRF protection), and load balancing cookies set by our hosting infrastructure. They expire at session end or within 24 hours.

Loaded only after you accept the Statistics category in the consent banner. These trackers help us understand how visitors use the site:

• Google Analytics 4 (property G-1845HX1SQM) — page views, session duration, traffic sources, user behaviour flows. Data stored in the US (Google LLC, DPF certified). Retention: 14 months (configurable). Google Privacy Policy.
• Microsoft Clarity (ID: vdj4sps9l2) — session recordings, heatmaps, scroll depth. Data stored in the US (Microsoft Corporation, DPF certified). Retention: 13 months. Microsoft Privacy Statement.
• Ahrefs Analytics — traffic and referral analysis. Data stored in the US (Ahrefs Pte Ltd). Retention: per Ahrefs policy. Ahrefs Privacy Policy.

Loaded only after you accept the Marketing category. Used to measure advertising effectiveness:

• Meta Pixel (Pixel ID: 835470646175496) — tracks conversions from Meta (Facebook/Instagram) ad campaigns. We also implement Meta's Conversions API (CAPI) server-side to complement browser Pixel events. Data stored in the US (Meta Platforms Inc., DPF certified). Retention: up to 180 days for custom audiences. We do not sell this data. Meta Privacy Policy.

Opt-In Basis (EU / UK)

For contacts in the EU and UK, marketing emails are sent only where we have obtained prior explicit consent (GDPR Art. 6(1)(a)) or where the soft opt-in applies (an existing customer relationship with a relevant product or service, under ePrivacy Directive Art. 13(2)). You may withdraw consent at any time via the unsubscribe link in every marketing email, or by emailing privacy@dimora.ai.

CAN-SPAM / CASL Compliance

All commercial emails include: a physical mailing address, a clear identification of the sender, a functional one-click unsubscribe mechanism, and are processed within 10 business days. We comply with CAN-SPAM Act (US) and CASL (Canada) requirements.

Non-Marketing (Service) Communications — Not Opt-Out-Able

Transactional and service-related communications — including billing receipts, subscription renewal notices, security alerts, and legally required disclosures — are sent based on contractual necessity (Art. 6(1)(b)) and are not subject to unsubscribe, as they are integral to the service relationship.

Step 1 — Submit Your Request

Email privacy@dimora.ai with:

• • Subject line: "[GDPR/CCPA] [Right Type] Request — [Your Name]"
• • Your full name and the email address / phone number associated with your data
• • Whether you are submitting as a data subject or as an authorized agent
• • A description of the specific right you are exercising

Step 2 — Identity Verification

For requests involving access to specific personal data, we verify your identity by asking you to confirm information we already hold on file (e.g., email address, last 4 digits of a phone number). We do not require government-issued ID unless strictly necessary to prevent fraud. Verification protects you against unauthorized third-party access to your data.

Step 3 — Response

We acknowledge receipt within 5 business days. We fulfill the request within 30 days (GDPR) or 45 days (CCPA), with one possible extension (plus written notice). All responses are free of charge. If we are unable to fulfill a request (e.g., due to a legal exception), we explain why in writing and inform you of your right to complain to a supervisory authority.

Spain (including Canary Islands)

Agencia Española de Protección de Datos (AEPD)

United Kingdom

Information Commissioner's Office (ICO)

Other EU / EEA Member States

European Data Protection Board (EDPB) — Members Directory

California, United States

California Privacy Protection Agency (CPPA)

Federal Trade Commission (FTC) — United States

For complaints about privacy and data security practices under US federal law