ChatGuru handles two very different kinds of data: information about the businesses that use it, and messages from the guests who chat with it. This policy explains what we do with each, who we share it with, and how to get it back or have it deleted.
This summary is for readability only. The numbered sections below are the terms that actually apply.
ChatGuru is an AI guest-messaging service operated by Tiny Schedule Ltd, a company registered in England and Wales under company number 15219869, with its registered office at 20 Wenlock Road, London, N1 7GU, United Kingdom. In this policy, “ChatGuru”, “we”, “us” and “our” mean that company.
This policy explains what personal data we handle, why, who we share it with and what rights you have. It covers our website at chatguru.co, the ChatGuru web dashboard, the ChatGuru mobile apps for staff, the guest chat widget and QR chat links, and the emails we send in connection with the service (together, the Service).
For any privacy question or request, write to hello@chatguru.co. We aim to reply within a few working days, and in any case within one month, as required by law.
ChatGuru sits between two groups, and data protection law treats them differently. Reading this section first will make the rest of the policy make sense.
Hotels, guesthouses, short-stay hosts and property managers who sign up for an account, and the staff they invite. For their account data, billing data and use of our website, we are the data controller — we decide why and how it is processed, and this policy applies directly.
The travellers and visitors who scan a QR code or open a chat widget and send messages. For that conversation data, the customer is the data controller and we are their data processor. We handle guest messages on the customer’s behalf, under their instructions and under our Terms of Service, which include our data processing terms.
If you are a guest and you want your conversation deleted or a copy of it, contact the property you were chatting with — they control that data. You can also write to us at hello@chatguru.co and we will pass your request to them and help them action it.
Your name, email address, and a securely hashed password — or, if you sign in with Google, the name, email address and profile picture Google returns to us. We never receive your Google password. We also store your organisation name, your role, team invitations you send, your notification preferences and your chosen language.
Everything you enter so the AI can answer guests: house rules, WiFi details, check-in and checkout instructions, local recommendations, uploaded or pasted documents, and any edits or approvals your team makes. Please do not put special category data (for example health information) or payment card numbers into your knowledge base — see section 12.
Your plan, subscription status, billing country and currency, invoice history and the last four digits and brand of your card. Payments are processed by Stripe. Full card numbers never reach our servers or our database.
Pages visited, referring site, approximate location derived from IP address at country level, and interactions with our advertising — see section 8. If you fill in a demo or contact form, we collect what you put in it.
Emails and messages you send us, and our replies, so we have a record of the issue and how it was resolved.
Under UK and EU data protection law we must have a lawful basis for each use of personal data. Ours are set out below.
| What we do | Lawful basis |
|---|---|
| Create and run your account, deliver the dashboard, widget, mobile apps and email notifications | Performance of our contract with you |
| Generate AI answers, detect languages and translate messages between guests and staff | Performance of our contract with the customer; for guest data, the customer’s own lawful basis as controller |
| Take payment, issue invoices, chase failed payments | Performance of our contract; legal obligation (tax and accounting) |
| Keep the Service secure — rate limiting, abuse detection, fraud prevention, audit logs | Our legitimate interest in protecting the Service and its users |
| Provide support and respond to your messages | Performance of our contract; our legitimate interest in good service |
| Improve ChatGuru, fix failures, measure quality, and develop new features — see section 6 | Our legitimate interest in improving and developing our product |
| Send marketing emails and run advertising | Consent, or our legitimate interest where the law allows it |
| Comply with legal obligations and defend legal claims | Legal obligation; our legitimate interest in establishing claims |
Where we rely on legitimate interests, we have considered the impact on you and concluded that our interests do not override your rights. You can object — see section 13.
ChatGuru is built on large language models supplied by third parties. To answer a guest, we send the relevant part of the conversation, together with the matching extracts from the customer’s knowledge base, to an AI provider, which returns a suggested answer. The same happens for translation, for converting uploaded property documents into knowledge entries, and for generating the numerical representations (embeddings) that let us find the right knowledge entry for a question.
Our AI providers are:
Both act as our sub-processors under written terms. Under those terms they may not use content submitted through their APIs to train their own models, and they retain it only briefly for abuse monitoring before deleting it.
The AI answers only from the information the customer has provided. It is still a probabilistic system and can be wrong or incomplete — that is addressed in our Terms of Service. Guests are told they are chatting with an AI assistant, and can ask to be passed to a human at any time.
We want to be straightforward about this rather than bury it, because it matters to our business and to yours.
We analyse how ChatGuru is used — which questions guests ask, where the AI fails to find an answer, which conversations get escalated to a human, how long replies take, which languages appear, and so on. We use this to fix problems, tune the system, measure quality and build new features.
We also create aggregated and de-identified data from conversations and usage: statistics, benchmarks, trends, and datasets in which direct identifiers have been removed and which are combined across many customers. We may retain, publish, license, sell and otherwise commercialise that aggregated and de-identified data, and it belongs to us. This includes using it to develop, evaluate and improve our own models and products, and to produce industry research and reports.
What we do not do. We do not sell personal data. We do not license or sell anything from which you, your business or an individual guest could reasonably be identified. We do not disclose one customer’s knowledge base, guest list or conversation content to another customer. Nothing in this section allows us to publish a conversation that still contains personal data.
De-identification is applied so that the data can no longer reasonably be attributed to an identified or identifiable person, and we do not attempt to re-identify it. Once data has been aggregated or de-identified in this way it is no longer personal data, so it survives the deletion of an account — there is nothing left in it to delete.
If you are a customer and you would prefer your conversations to be excluded even from this aggregated and de-identified use, email us at hello@chatguru.co and we will exclude your organisation.
We are based in the United Kingdom, and some of our providers are based in, or store data in, the United States and other countries outside the UK and the European Economic Area.
Where personal data leaves the UK or the EEA, we rely on an appropriate safeguard recognised under UK and EU law — normally the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, or an adequacy decision covering the recipient country or certification scheme. We assess each provider before we use it, and we can provide details of the safeguard used on request.
Guest conversations and knowledge base content are kept for as long as the customer’s account exists, and after that until deletion is requested. We do not automatically delete conversation history, because customers rely on it as a record of what a guest was told. Customers can delete conversations at any time from the dashboard, and can ask us to delete all of their data at any time.
Account and profile data is kept while your account is open. If you close your account or ask us to delete it, we delete or irreversibly anonymise your data within 30 days.
Billing records are kept for seven years after the transaction, because UK tax law requires it.
Backups are held on a rolling basis and expire within 90 days, so deleted data can persist in backups for that short window before being overwritten.
Aggregated and de-identified data created under section 6 is retained indefinitely. It is no longer personal data, so deleting your account does not remove it.
We may keep specific records longer where we need them to comply with the law or to establish, exercise or defend a legal claim, and only for as long as that purpose lasts.
We take technical and organisational measures appropriate to the risk:
No online service can be completely secure. If a personal data breach occurs, we will notify the Information Commissioner’s Office within 72 hours where required, and inform affected customers without undue delay so that they can meet their own obligations to their guests.
Because you are the controller of your guests’ data, some obligations sit with you rather than with us:
Our full processor commitments — the instructions we act on, our confidentiality and security obligations, our use of sub-processors, and what happens to data on termination — form part of our Terms of Service. If your organisation needs a signed standalone data processing agreement, email hello@chatguru.co and we will provide one.
If you are in the UK or the EEA, you have the right to ask us to:
To exercise any of these, email hello@chatguru.co. These rights are free to use, and we will respond within one month. We may need to verify your identity first.
If you are a guest, address your request to the property you chatted with, since they control that data. Write to us as well if you cannot reach them and we will help.
If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. If you are in the EEA, you can complain to your national data protection authority. We would appreciate the chance to resolve it with you first.
ChatGuru is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16, and customers must not use the Service to collect data from children knowingly. If you believe a child has provided personal data through a ChatGuru chat, contact us at hello@chatguru.co and we will delete it promptly.
We may update this policy as the Service changes or the law does. The “last updated” date at the top always reflects the current version.
If a change materially affects how we use personal data, we will tell customers by email or through the dashboard at least 30 days before it takes effect, so that you have time to review it and, if you disagree, to close your account.
For any question about this policy, a data request, or a complaint, email hello@chatguru.co. Our registered company details and postal address are in section 1 and at the foot of this page.
See also our Terms of Service, which govern your use of ChatGuru.