Privacy Policy

1. Introduction

Concierly ("we," "our," or "us") operates a hotel operations platform designed to streamline housekeeping, maintenance, food & beverage, inventory, procurement, complaints, and security patrol workflows. This Privacy Policy explains how we collect, use, and protect your personal information when you use Concierly. Concierly is operated by Concierly LLC, a Wyoming limited liability company, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA.

2. Information We Collect

We collect information to provide and improve Concierly. The categories of data we collect include:

• Account information — your name, email address, phone number, profile photo, job title, department, and hotel affiliation.
• Hotel operational data — room status, task assignments, work orders, complaints, inventory records, procurement orders, messages between staff, and other data entered into the platform.
• Photos and signatures — photos taken or chosen in the app (for example of a repair or a found item) and signatures drawn in the app.
• Staff rosters — a schedule file (a spreadsheet, a PDF or a photo) that a manager uploads so the app can turn it into shifts. It holds staff names, job titles and shift times.
• Files read by AI — a file or photo you choose to fill in part of the setup (for example a room list, a menu or a linen list). The app asks your permission before the first file is sent, and you can turn this off in Settings › Privacy.
• Voice — if your hotel uses Milo, the voice assistant, what you say to it, and the hotel data Milo looks up to answer you: names of colleagues, work orders (which can include a guest's name) and rooms. The app asks your permission before Milo starts. Milo is off unless we switch it on for your hotel.
• Guest information — details a hotel records about its guests, such as names, room numbers, requests, and the registration card a guest signs at check-in, which may include an identity document number and a signature. The hotel decides what it records.
• Location — your device's location at the moment you start or end a shift, used only to check that you are at the hotel. The app does not track your location at any other time.
• Device and notification data — your device model, operating system, app version, and a notification token so we can send you alerts.
• Crash reports — technical details of an app error (the device, the app version, and what the app was doing), without your name or email address.
• Usage data on our website — browser, IP address, and pages visited.
• Cookies — essential cookies for authentication and preferences, and analytics cookies for understanding usage patterns.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide, maintain, and improve the Concierly platform.
• Process tasks, assignments, and operational workflows.
• Read an uploaded roster, or a file you choose during setup, into a draft you check before anything is saved, using an AI model (see Data Sharing).
• Answer you through Milo, the voice assistant, where your hotel uses it (see Data Sharing).
• Check that a shift is started and ended at the hotel.
• Send notifications related to your account and hotel operations.
• Find and fix app errors, and analyze usage to improve platform performance and features.
• Provide customer support and respond to inquiries.

4. Data Sharing

We do not sell your personal data. We may share information in the following circumstances:

• Service providers — trusted third parties that process data on our behalf: Supabase (database, file storage, and sign-in), Vercel (website and web app hosting), Expo (delivery of notifications to your device), Sentry (crash reports), Resend and Google Workspace (sending emails), Anthropic (an AI model that reads a roster or setup file you choose, with your team's names and job titles so it can match each person, and answers Milo's typed questions with the hotel data they need), and OpenAI (Milo's voice: it turns your voice into words, speaks the answer, and receives the hotel data Milo looks up to answer, such as colleagues' names, work orders and rooms). A file goes to Anthropic only when you choose it and only after you allow it; Concierly does not keep a copy of the file. Neither Anthropic nor OpenAI uses this data to train its models.
• Legal requirements — when required by law, regulation, or legal process.
• Business transfers — in connection with a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption of data in transit (TLS) and at rest.
• Role-based access controls limiting data visibility, enforced by the database for every request.
• Sign-in tokens and data saved on your phone are stored encrypted on the device.
• SOC 2 compliant infrastructure through our hosting providers.

While we implement these measures to protect your information, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security and shall not be held liable for unauthorized access resulting from sophisticated cyberattacks, zero-day vulnerabilities, or compromises of third-party infrastructure beyond our reasonable control.

6. Data Breach Notification

In the event of a data breach affecting your personal information, we will:

• Notify affected hotel administrators without undue delay and, where required by applicable law (including GDPR), within 72 hours of becoming aware of the breach.
• Notify relevant supervisory authorities as required by law.
• Provide details of the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach.
• Take immediate steps to contain and remediate the incident.

Concierly acts as a data processor on behalf of subscribing hotels (data controllers). Hotel administrators are responsible for notifying their own staff and guests as required by applicable data protection regulations.

7. Data Retention

• Active accounts — your data is retained for as long as your account remains active.
• Hotel and guest data — kept for as long as the hotel keeps its Concierly account. The hotel decides what it records about its guests and can ask us at any time to delete it.
• Deleted accounts — when you delete your account we remove your name, email address, phone number and photo, your alerts, your AI choices, and the locations recorded when you started or ended a shift or scanned a patrol checkpoint. Records you made as part of your work for the hotel stay with the hotel and are shown as "Removed user": chat messages and files you sent, shift times and whether you were at the hotel, signatures, and survey scores, which no longer link to you. Counts of your Milo use stay for the hotel's costs; they hold no words.
• Backups — residual data in automated database backups is purged during routine backup rotation.

8. Cookies & Tracking

Concierly uses cookies to provide core functionality and understand usage:

• Essential cookies — required for authentication, session management, and user preferences.
• Analytics cookies — used to understand usage patterns and improve the platform.

We do not use third-party advertising cookies.

9. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated personal data, in the app or by email (see Delete Account).
• Turn off AI reading, and Milo, at any time in Settings › Privacy. Nothing is then sent to an AI company until you allow it again.
• Request a copy of your hotel's data — available to the person who manages the hotel's Concierly subscription.
• Opt out of non-essential communications.

10. International Transfers

Your data may be processed in regions where our servers and service providers are located. We ensure adequate protections are in place through standard contractual clauses and compliance with applicable data protection regulations.

11. Children's Privacy

Concierly is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and through an in-app notice. Your continued use of Concierly after such changes constitutes acceptance of the updated policy.

13. Data Processing Agreements

Concierly acts as a data processor on behalf of subscribing hotels, which act as data controllers for their staff and guest data. Hotel administrators are responsible for ensuring lawful grounds for data processing and obtaining necessary consents under applicable data protection laws.

• For hotels that require a Data Processing Agreement (DPA) under GDPR or other regulations, contact us at hello@concierly.io.
• We will notify hotel administrators of any changes to our sub-processors (e.g., hosting, analytics, or notification providers) with reasonable advance notice, allowing them to object if the change affects their data protection obligations.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at hello@concierly.io.