Privacy policy

1. Who we are and when this notice applies

Odwelo is operated by AccessTrail Ltd. This notice covers visitors to our website, businesses enquiring about or using Odwelo, their authorised staff, and guests who interact with an Odwelo-powered channel. For privacy enquiries, email contact@accesstrail.org or write to AccessTrail Ltd, 167–169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom.

The business that receives a guest enquiry usually decides why and how to use that guest's information and is the data controller. Odwelo processes it on the business's instructions. Odwelo is the controller for its own website enquiries, customer relationship, staff sign-in, service security and billing administration. Each business should also give guests its own privacy notice.

2. Information we handle

For website visitors and prospective customers: contact details and enquiry content you provide, plus ordinary technical request information such as IP address, browser, page requested and time of access.

For business owners and staff: name, work email, sign-in and invitation records, role, permissions, verified work or WhatsApp number where supplied, property knowledge, prices and offers entered into the service, support communications and audit activity.

For guests: the identifier supplied by the channel, messages and replies, booking enquiry and stay details, booking contact details, payment and booking status, and handoff records. If the business enables conversation summaries, we keep short summaries so the guest can continue a conversation. Odwelo does not record calls or retain a verbatim call transcript, but may retain a short call summary. Please do not put card numbers, identity documents or sensitive information into a chat.

We may receive information directly from you, from the business you contact and its staff, or from a connected channel, property-management or payment provider.

3. Purposes and legal bases

For our own activities, we use personal information to reply to enquiries and take steps towards a contract; to provide, administer and support accounts under our contract with a business; to secure the service, prevent misuse and improve reliability in our legitimate interests; and to meet accounting, tax and other legal obligations. Where we rely on legitimate interests, we consider the impact on individuals. We send marketing only where permitted by law and provide any required consent choice or opt-out.

For guest messages, quotes and bookings, the business determines the lawful basis and Odwelo processes information to provide the requested assistant, inbox, booking and handoff functions on its instructions. The business remains responsible for its own privacy notice, booking terms and marketing choices.

The assistant uses AI to interpret questions and generate replies using the conversation and business-provided knowledge. AI can make mistakes. A chat answer or indicative quote alone is not a booking confirmation; the business's configured booking process determines when a reservation is confirmed. Guests can ask the business for a human response.

4. Channels, bookings and payments

A business may enable WhatsApp, telephone, website chat or supported social messaging channels, including Instagram and TikTok. We receive the information needed to route the conversation and respond through the channel the guest chose. The channel operator also processes communications under its own privacy terms. Available channels vary by business and by platform permissions.

When an online booking flow is enabled, we may process booking details and send transactional status emails. If card payment is enabled, the business is the merchant of record and Stripe hosts the payment form. Odwelo receives payment references and status, not the card number. Without a supported booking connection, the assistant may give an estimate from business-supplied information and direct a guest to the business's booking link; it cannot confirm availability through an unsupported system.

5. Sharing and international processing

Information is available to the customer business and its authorised staff, and to providers needed to run the enabled features: cloud hosting and sign-in, AI models, communications and email (including Twilio where enabled), connected property-management systems such as Beds24, and Stripe for connected card payments. Staff handoff alerts may be delivered to a staff member's WhatsApp, where the message also becomes subject to that service and the business's handling practices. We may disclose information when required by law. We do not sell guest conversations or customer account information.

Some providers may process information outside the UK or EEA, including in the United States. Where a transfer is restricted under UK data-protection law, we use a recognised route such as UK adequacy regulations or appropriate contractual safeguards, including the UK International Data Transfer Agreement or UK Addendum where applicable. You can request information about the safeguards relevant to your information using the contact details above. A business's enabled channels and providers determine which transfers apply.

6. Security and browser storage

We use role-based access, authentication, audit records and provider security features to protect information, and limit staff and operator access to what is needed to operate and support the service. No internet service is risk-free.

The website and dashboard use browser storage needed for sign-in, invitations, booking flows and website-chat continuity. Clearing it may end a session. We do not use advertising or analytics cookies on this website. If we add non-essential cookies or similar tracking, we will explain them and seek consent where required before using them.

7. Retention

We keep website enquiries for the time needed to respond and handle reasonable follow-up. We keep business account and staff information while the account is active and afterwards only as needed for billing, disputes, security or legal duties. Guest messages, summaries and booking records are held for the business's service and according to its instructions, then deleted or returned when the service ends unless law requires longer storage. Security and audit records are held for the time reasonably needed to investigate incidents and demonstrate compliance. Backups are removed on their normal rotation, subject to any legal hold. A website-chat access token expires after seven days; this does not by itself erase the conversation. You can ask us or the business concerned about the criteria applied to a particular record.

8. Your rights and complaints

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your information. You may object to processing based on legitimate interests; where consent is the basis, you may withdraw it without affecting earlier lawful processing. For our own processing, email contact@accesstrail.org. For a guest conversation or booking, contact the business first; we will help it respond when acting as its processor. We may need to verify identity and legal exceptions may apply.

You may complain to the UK Information Commissioner's Office at ico.org.uk. We would welcome the opportunity to address your concern first.

9. Changes

We will update the date on this page when this notice changes. Where a new use of information materially affects people, we will give additional notice before it begins where required.