1. Introduction and Consent to Terms

Welcome to the vGuest website (the "Site"). The Site is operated and managed by Okami DevOps Ltd., an Israeli company, company no. 516663770 (the "Company" or "vGuest"). The Site's purpose is to provide information and content regarding the Company's AI-powered guest-communication platform for hotels and hospitality businesses, and to enable users to contact the Company and receive information about its services.

The Company respects the privacy of the Site's users and operates in accordance with the provisions of the Israeli Protection of Privacy Law, 5741-1981 (including Amendment 13), the EU General Data Protection Regulation (GDPR) where applicable, and any other applicable law. This Privacy Policy is intended to explain, among other things, what information may be collected in the course of using the Site and the Company's services, the ways in which such information will be used, and the user's rights in connection with such information.

Use of the Site — including browsing, contacting the Company, submitting details in online forms, interacting with the Company's chat assistant, registering for any service, or providing information in any other manner through the Site — constitutes the user's confirmation that they have read this Privacy Policy, understood its contents, and agreed to it.

It is hereby clarified that the user is under no legal obligation to provide the Company with personal information, and any such information is provided of the user's own free will and with their consent. However, without the provision of certain details, the Company may be unable to respond to an inquiry, schedule a demonstration, provide services, or enable the use of certain services or content offered on the Site.

The Company's role. Where personal data of hotel guests is processed through the Company's platform, the hotel is the data controller and the Company acts as a data processor on the hotel's behalf, pursuant to a Data Processing Agreement. With respect to data of Site visitors and prospective customers who contact the Company directly, the Company is the controller. For details on our GDPR practices, EU data residency and sub-processors, see our GDPR page.

For inquiries, questions, requests, or complaints regarding privacy, review of information, or the manner in which personal information is handled, the Company's officer responsible for privacy protection may be contacted at: info@vguest.ai.

2. Types of Information Collected and Methods of Collection

2.1 Information Provided Actively; Contact Details

In the course of activity on the Site, the Company collects personal information that directly identifies the user, provided by the user of their own free will and with their knowledge — among other things, when filling in contact forms, registering to receive content, requesting a demonstration, or contacting the Company through its chat assistant. Information collected in this manner includes:

Full name (first and last);
Telephone number;
Email address;
Name of the hotel or business the user represents, where relevant;
The content of the user's inquiry as set out in the free-text fields of the online forms or in chat, including any additional information the user chooses to include in their inquiry.

2.2 Guest Data Processed on Behalf of Hotels; Sensitive Data

Given the nature of the services provided by the Company — an AI-based guest-communication platform operated for hotels — the Company processes, as a processor on behalf of the hotel, personal data of hotel guests, which may include the guest's name, contact details, reservation and stay details, preferences, and the content of the guest's messages.

Guests may, at their own initiative, volunteer information of a sensitive nature in their messages — for example, health-related needs such as allergies, accessibility requirements, or dietary or medical restrictions. Under the GDPR and the Protection of Privacy Law (including Amendment 13), such information constitutes special-category (sensitive) data. Where such information is provided, the Company processes it solely in order to act on the guest's request, applies heightened safeguards to it, and does not use it for any other purpose. Guests are asked not to share more health-related or otherwise sensitive information than is necessary.

2.3 Technical and Statistical Information Collected Automatically

In addition to information provided actively, certain technical information is collected automatically while browsing and using the Site, by means of standard monitoring and logging technologies. In most cases this information does not directly identify the user by name, and it is intended for operational, security, and user-experience purposes. Such technical information includes:

The IP (Internet Protocol) address of the computer or device from which access is made;
Browser type and version, and the operating system installed on the user's device;
Browsing and usage data, including time spent on the Site, pages visited, links clicked, chat prompts submitted, and additional traffic data.

2.4 Third-Party Systems and Tracking Technologies

The Company makes use of the services and systems of third-party providers for the purpose of operating the Site and the services, analysing Site activity, and managing its relationship with users. In this framework, the Site and the services make use of the following:

Google Analytics — a system used to collect statistical data regarding the manner of use of the Site, in order to understand users' needs and improve the Site's structure and content;
Google Cloud — the cloud infrastructure on which the Company's production systems, databases, and queues are hosted, in the europe-west3 region (Frankfurt, Germany);
Meta (WhatsApp Business Platform) — for the delivery of messages between hotels and their guests over WhatsApp, where this channel is used;
AI model providers (OpenAI, Anthropic, Google, xAI) — whose models are used to generate the assistant's responses. These providers operate under enterprise API terms which prohibit training their models on the data and which apply short retention windows.

An up-to-date list of the Company's sub-processors is published on our GDPR page.

3. Purposes of Use of the Information

Use of the information collected by the Company, as detailed above, shall be made solely for the purposes set out below, in accordance with applicable law and subject to the user's consent as given at the time of use of the Site:

Contact and response to inquiries. Personal information and contact details are used by the Company to respond to users who have submitted their details in the online forms, to answer their questions, to provide initial information regarding the Company's services, and to schedule demonstrations and meetings.
Management of the customer relationship and provision of the services. The information is used for the ongoing management of the professional relationship between the Company and its customers, and to enable the Company to provide its guest-communication services in a professional and personally tailored manner. Where guest data is concerned, processing is carried out on the hotel's behalf and under its instructions, pursuant to a Data Processing Agreement.
Improvement of user experience and operation of the Site. Technical and statistical information collected automatically is used to analyse usage patterns, improve the Site's structure, adapt its content to users' needs, and improve the quality of the assistant's responses.
Information security and prevention of misuse. The Company uses information to protect its systems, and to detect and prevent unauthorised activity, fraud, or misuse of the Site and its resources. These actions are essential to preserving the integrity of the information, securing the digital infrastructure, and protecting the privacy of all users and customers.
Compliance with legal requirements. Processing of information may be required for compliance with legal obligations applying to the Company, including the provisions of the Protection of Privacy Law, 5741-1981 and its regulations, and the GDPR where applicable; for compliance with judicial orders or demands of competent authorities; or for the protection of the Company's legal rights in legal proceedings, to the extent required.

4. Sharing of Information and Transfer to Third Parties

The Company does not sell, trade, or rent personal information identifying users to any third parties. However, information may be transferred to or shared with third parties in the cases set out below, only to the extent required and in accordance with applicable law:

Hotels and properties. Where a guest interacts with a hotel that uses the Company's platform, the Company processes the guest's data on that hotel's behalf and makes it available to that hotel's authorised staff.
External service providers (sub-processors). The Company may transfer information to external service providers and subcontractors acting on its behalf, to the extent required for the provision of the services, the operation of the Site, the management of information systems, or the performance of ancillary operations required for the management of the business — including the providers listed in Section 2.4 above. Such providers are bound by confidentiality obligations and are not permitted to use the information for any purpose other than the provision of the service for the Company. It is clarified that the AI model providers used by the Company do not train their models on the data.
Legal obligation and judicial orders. Disclosure of information to third parties will be made where there is a legal obligation or lawful authority to do so — including compliance with a judicial order directing the delivery of information, response to an official demand of a competent authority acting by law, or delivery of information in the framework of a legal proceeding.
Protection of the Company's rights. The Company shall be entitled to share information to the extent required for the protection of its legal rights, its property, or the safety of the Company, its employees, its customers, or any third parties, including for the prevention of fraud, information security, or the handling of unauthorised use of the Site.
Business transfers. In connection with a merger, acquisition, or sale of assets of the Company, subject to the transferee assuming the obligations of this Policy.

The Company does not store payment-card or credit-card numbers on its systems; card payments, where offered, are handled by PCI-compliant payment providers.

5. Cookies and External Links

5.1 Cookie Technology and Purposes of Use

The Site uses cookies and similar monitoring technologies for its regular and proper operation, including the collection of statistical data regarding use of the Site, verification of details, adaptation of browsing to the user's personal preferences, and securing the information transmitted through it. Cookies are small text files stored on the hard drive of the user's computer or mobile device by means of the browser, which enable the Company, among other things:

to improve the user experience by recognising previous browsing preferences;
to monitor visitor traffic on the Site for the purpose of producing statistical data and improving the services offered;
to assist the Site's information-security mechanisms and the prevention of unauthorised activity.

5.2 Management of Cookie Settings by the User

It is clarified that the user may control the use of cookies through the settings of the internet browser they use. Most browsers allow the user to block the receipt of new cookies, delete existing cookies, or receive a warning before a cookie is stored on the device. However, the user should take into account that blocking or deleting cookies may impair the browsing experience, prevent access to certain features and services on the Site, and require the re-entry of details that would otherwise have been stored automatically.

5.3 Links to Third-Party Websites and Services

The Site may include links leading to websites, applications, or services operated by third parties not under the Company's control. It is hereby clarified that: (a) this Privacy Policy applies solely to activity on the Company's Site and to information collected on it; (b) use of third-party websites or services is subject exclusively to the privacy policies and terms of use of those third parties, and the user is advised to review them before providing any personal information; (c) the Company bears no responsibility for content appearing on third-party websites, the accuracy of information presented on them, or the manner in which such third parties collect, process, and use the user's personal information. The mere placement of a link on the Site does not constitute a recommendation or approval by the Company of the content or policies of the linked website.

6. Information Security, Retention, and User Rights

6.1 Information-Security Measures

The Company attaches the highest importance to the protection of users' personal information and takes reasonable and accepted security measures, consistent with professional standards customary in the field, in order to protect the information in its possession against loss, unauthorised use, alteration, disclosure, or unauthorised access. All production infrastructure — application servers, databases, and queues — is hosted in the Google Cloud region europe-west3 (Frankfurt, Germany). The Company's measures include encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access control with strict per-hotel tenant isolation, multi-factor authentication, least-privilege access, and audit logging of administrative changes.

However, it is clarified to the user that notwithstanding the Company's efforts, it cannot guarantee absolute immunity against unauthorised intrusion into its systems, cyber-attacks, or unforeseen information-security incidents arising from activity on the internet, and that use of the Site and the services inherently involves such risks.

6.2 Data-Retention Policy

Personal information collected by the Company will be retained for the period reasonably required to fulfil the purposes for which it was collected, as detailed in this Policy. Without derogating from the foregoing:

Account data is retained for the duration of the customer relationship plus 3 years after its termination;
Transaction records are retained for 7 years for tax and statutory bookkeeping purposes;
Chat logs are retained for 2 years for service improvement and dispute resolution;
Aggregated and anonymised analytics data may be retained without limitation.

Beyond the period required for the provision of the service, the Company will retain information for such additional periods as required for compliance with its legal obligations — including document-retention obligations under tax and bookkeeping law — or for the protection of its legal rights and the management of potential legal proceedings, all in accordance with the limitation periods prescribed by law.

6.3 International Data Transfers

Guest data is stored in the European Union (Frankfurt, Germany). Certain processing may occur outside the EEA — in particular, API calls to AI model providers, used solely to generate a response, under commercial terms that exclude training on the data and apply short retention windows. Where a transfer outside the EEA occurs, it is covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

6.4 The User's Rights of Access and Rectification

In accordance with the provisions of the Protection of Privacy Law, 5741-1981, every user is entitled to review the personal information relating to them held in the Company's database. Users located in the EEA additionally have, under the GDPR, rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing. Should the user find that the information held about them is incorrect, incomplete, unclear, or not up to date, they have the right to request that the Company rectify or update the information. Where the Company processes guest data on a hotel's behalf, the Company will support or forward the request together with that hotel as controller.

Requests to review or rectify information should be addressed in writing to the officer responsible for privacy protection at the Company, at info@vguest.ai, and the Company will handle the request within the timeframes prescribed by law and in any event within 30 days.

6.5 Children's Privacy

The Site and the services are not intended for children under the age of 16, and the Company does not knowingly collect personal information from children.

7. Changes to the Policy and Contact Details

The Company reserves the right to update, change, amend, or add terms to this Privacy Policy from time to time, in accordance with changes in the Site's activity, in the services offered by the Company, or in applicable law and case law. It is clarified that the binding and valid version of the Privacy Policy is the most up-to-date version published on the Site at any time, and it replaces any previous version of the Policy. Continued use of the Site following the publication of the updated Policy constitutes the user's consent to the changes made, and users are therefore advised to review this Policy from time to time.

For any question, request to review information, privacy-related inquiry, or need for further clarification regarding the manner in which personal information is processed by the Company, the Company may be contacted using the following details:

Business name: Okami DevOps Ltd. (vGuest)
Company no.: 516663770, Israel
Email: info@vguest.ai