Privacy notice
Last updated: 14 November 2026
Summary
- We are Vibesapps. We make hanas.ai, an AI voice receptionist for hotels.
- This notice covers our website (gethanas.com), the live demo call with our fictional Hotel Hanas, the early-access form, the business emails we send to hotels, the hotel information we collect from public sources, and our relationship with hotels that use hanas.ai.
- If you called a hotel that uses hanas.ai, that hotel is responsible for your information and we act on its behalf. See section 8.
- You have rights over your information, including the right to object. Contact us at support@vibesapps.co.
1. Who we are
Vibesapps ("Vibesapps", "we", "us") is the controller of the personal information described in this notice.
- Email: support@vibesapps.co
2. The demo call with Hotel Hanas
What we collect. If you start a demo call, your voice is sent to our AI receptionist and the call is recorded. We keep the recording, a transcript, the call length, the language, and any booking or callback details you give during the call (for example a name and phone number).
Please do not share real personal details. Hotel Hanas is fictional, so a made-up name and number work just as well. Please do not mention health, disability or other sensitive information about yourself or anyone else.
Why we use it. To run the demo, to show how the product works, to find and fix problems, and to improve how our AI receptionist answers calls.
Our legal basis. Our legitimate interests in demonstrating and improving our product (Article 6(1)(f) UK GDPR). You choose whether to start a call, you are told before and at the start of the call that it is recorded and handled by AI, and you can ask us to delete your call at any time. Your browser will also ask you to allow microphone access. That is a technical permission, separate from this notice.
Do you have to give it? No. The demo is optional. If you do not want to be recorded, please do not start a call.
3. The sign-up form and your account
What we collect. Your name, hotel website, email address, and, if you give them, the number of rooms and the booking system (PMS) your hotel uses, plus the date and time you agreed. To protect the form from abuse we also keep a salted one-way hash of your IP address and your browser's user-agent text (see section 4).
Why we use it. To confirm your email address, set up an account for your hotel and contact you about it. We email you a link to confirm your address; nothing else happens until you open it.
Setting up your hotel. When you confirm your email, Apify reads your hotel's public website, Anthropic's Claude turns it into a hotel profile (see section 6), and ElevenLabs runs an AI receptionist that only your team can call from your dashboard. Calls your team makes to try it are recorded and kept like demo calls (section 11). If nobody uses the account for 30 days and it has not been switched on for guests, we delete it, with the hotel profile, rates, test calls and the receptionist; we email the account owners a week before.
Earlier demos. If you received a demo link before we introduced accounts, we delete that demo receptionist, its hotel profile and its call records in our database 14 days after it was created, unless you turn it into an account.
Our legal basis. Your consent (Article 6(1)(a) UK GDPR). You can withdraw it at any time by replying to any of our emails or writing to support@vibesapps.co. Withdrawing does not affect what we did before.
Do you have to give it? No, but without your email address we cannot set up your account.
4. Security and abuse protection
What we collect. To stop automated misuse we run Cloudflare Turnstile and count requests per network address. We do not store your IP address in plain form. We keep a salted one-way hash of it, and for the form also your browser's user-agent text. A hash like this can still relate to you, so we treat it as personal information.
Why and legal basis. To keep our website and demo secure and available: our legitimate interests (Article 6(1)(f) UK GDPR).
Cookies and similar technology. We do not use advertising or analytics cookies. Cloudflare Turnstile may use your browser's storage to run its security check. This is strictly necessary to protect the service, so it does not need your consent under the Privacy and Electronic Communications Regulations. Hotel staff who sign in to their dashboard get a strictly necessary sign-in cookie.
5. Business contacts we email
What we collect. If you work at or run a hotel, we may collect your name, job title, business email address, hotel name, website and business telephone number.
Where it comes from. Your hotel's website, public business directories, Companies House and similar public sources.
Why we use it. To contact hotels by email about hanas.ai, and to keep a record of who we have contacted and who has asked not to be contacted.
Our legal basis. Our legitimate interests in telling hotel businesses about our product (Article 6(1)(f) UK GDPR). We only send unsolicited emails to company addresses where the law allows it. We do not email sole traders or partnerships unless they have agreed to it.
Your choice. Every email tells you how to opt out. If you opt out or object, we stop at once and add your email address to our suppression list so we do not contact you again.
6. Hotel information from public sources
What we collect. To prepare a hotel's AI receptionist, we collect information about the hotel (for example rooms, facilities, policies, location and opening hours) from the hotel's own website.
Personal information. We try not to collect personal information here. We skip pages about staff and guest reviews, our hotel profiles do not include names of individuals, and we do not keep the pages we read, only their addresses. A hotel's public pages may still name its owner or manager, and this text can be processed briefly while the profile is made.
Why and legal basis. To build and offer a hotel profile for our service: our legitimate interests (Article 6(1)(f) UK GDPR).
Service providers. We use Apify to collect public web pages and Anthropic's Claude to turn them into a structured hotel profile (see section 9).
7. Hotels that use hanas.ai
If your hotel uses hanas.ai, we use the names and business contact details of your staff to set up and run the service, send request notifications, dashboard sign-in codes and invitations, provide support, manage our contract and send invoices. Each person who uses the dashboard has their own account: we keep their email address, their role, when they signed in and what they changed (for security and to resolve disputes), and, when an owner signs our agreements, their name and job title. Our legal basis is the performance of our contract with your hotel and our legitimate interests in managing our business relationship (Article 6(1)(b) and (f) UK GDPR).
8. If you called a hotel that uses hanas.ai
When a hotel uses hanas.ai to answer its phone, the hotel is the controller of your information, and Vibesapps processes it on the hotel's behalf and only on its instructions. Please see the hotel's own privacy notice, and contact the hotel to exercise your rights. If you contact us, we will pass your request to the hotel and help it respond. We do not use hotel callers' information for our own purposes.
9. Who we share information with
We use these service providers. They act on our instructions under contracts that require them to protect your information.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Hosts our database (call transcripts, booking and callback details, form submissions) | Ireland (EU) |
| ElevenLabs | Voice and speech service for calls; stores call recordings and transcripts | United States |
| Google (Gemini), through ElevenLabs | Generates the AI receptionist's replies during a call | Outside the UK, which may include the United States |
| Cloudflare | Serves our website, runs our application code and runs Turnstile | Global network |
| Resend | Sends emails to hotel staff (request notifications and sign-in codes) and demo links to people who use our early-access form | United States company; our sending domain uses its EU region (Ireland) |
| Apify | Collects public web pages about hotels (section 6) | Outside the UK (EU and United States) |
| Anthropic | Turns public hotel information into a structured hotel profile (section 6) | United States |
We may also share information if the law requires it, or to protect our rights, for example in a legal dispute. If our business is sold or restructured, information may pass to the new owner under the same protections.
We do not sell personal information.
10. International transfers
Some providers process information outside the UK. Where this happens, we rely on:
- UK adequacy regulations, for example for the European Economic Area (including Ireland) and, for US companies certified under it, the UK Extension to the EU-US Data Privacy Framework; or
- the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with an assessment of the risks of the transfer.
You can ask us for a copy of the relevant safeguards at support@vibesapps.co.
11. How long we keep information
| Information | How long |
|---|---|
| Demo call recordings and transcripts at ElevenLabs | 30 days |
| Demo call transcripts and booking or callback details in our database | 30 days. After that the transcript is deleted and personal details are removed |
| Demo call statistics (length, language, outcome) | Kept as anonymous totals that cannot identify you |
| Your automatic demo (AI receptionist, hotel profile and its call records in our database) | 14 days after it is created |
| A hotel account that was never switched on for guests (profile, rates, test calls, the receptionist and its users) | Deleted after 30 days without use |
| Dashboard sign-in codes and invitations | Codes: 1 day. Unused invitations: 30 days after they expire |
| Sign-up form details | Up to 12 months after you send the form, or until you withdraw consent |
| Business contacts we email | Up to 12 months from our last contact if you do not reply, or until you object |
| Suppression list (email address, date, reason) | For as long as we send business emails, so that we never contact you again after you opt out |
| Abuse-protection counters (hashed network address) | 7 days |
| Application logs (no IP addresses or personal details) | 7 days |
| Hotel staff contact details | For the duration of our relationship with the hotel, and up to 6 years afterwards for contract and accounting records |
12. Your rights
Under the UK GDPR and the Data Protection Act 2018 you can ask us to:
- give you a copy of your information (access);
- correct it if it is wrong;
- delete it;
- restrict how we use it;
- give it to you, or to another organisation, in a portable format (this applies to information you gave us on the basis of consent or a contract); and
- withdraw your consent, where we rely on consent. Withdrawing does not affect what we did before.
Write to support@vibesapps.co. We will reply within one month. Because we keep only a hash of your network address, we may ask for details such as the approximate date and time of your demo call to find it.
Your right to object. You can object at any time to our use of your information based on our legitimate interests (sections 2, 4, 5, 6 and 7). We will stop unless we have compelling legitimate grounds that override your interests, or we need the information for legal claims.
You can object at any time to direct marketing, including our emails to hotels. If you do, we will stop. You do not have to give a reason.
13. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. A member of the hotel's staff decides on every booking or callback request.
14. Complaints
If you are unhappy with how we handle your information, please tell us first at support@vibesapps.co with "Data protection complaint" in the subject line. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.
15. Children
Our website and demo are for hotel professionals and are not meant for children.
16. Changes to this notice
We may update this notice. The date at the top shows the latest version. If we make important changes that affect how we use information we already hold, we will tell the people affected by email where we can.