Legal · Draft
Privacy Policy
Contents
1. Who we are
This policy covers personal data ELVRIQ LTD ("ELVRIQ", "we") processes as a business — as the operator of this website, and as a data controller for the account and billing information of the hotel and property businesses that subscribe to InnRelay ("Customers"). It does not cover guest data submitted through a property's InnRelay QR surfaces, where the property itself is the data controller and ELVRIQ acts as a processor under our Data Processing Agreement — see our DPA page and the in-app guest privacy notice.
2. What we collect
Depending on how you interact with us, we may collect: contact and company details you provide (name, email, phone, company name, address); account and billing information (subscription plan, payment status — card details are handled directly by our payment processor, Stripe, and never stored by us); staff account information for people your organisation adds to InnRelay; standard technical data from using this website and the InnRelay application (IP address, browser type, pages visited); and questions you choose to submit to the public InnRelay Guide.
3. AI-assisted public guide
Questions submitted to the public InnRelay Guide may be sent to Cloudflare services, including Turnstile for abuse prevention and Workers AI for generating a response from ELVRIQ-approved public product information. The Guide is for product information only: do not include sensitive information, guest personal data or details of an active hotel-service request. The public Guide is separate from the property's InnRelay guest-request channel and has no access to hotel tenant data, staff accounts or guest request records.
4. Why we process it
To provide and operate InnRelay under your subscription; to manage billing and payment; to respond to support and sales enquiries; to provide the public product-information Guide and protect it from abuse; to send service communications (including about outages, security or changes to these terms); and, where you've agreed, to send product or marketing updates.
5. Legal basis
We rely on: performance of a contract (providing the service you've subscribed to); legitimate interests (operating and improving our business, responding to enquiries, preventing misuse, and providing product information); legal obligation (tax and accounting records); and consent, where we ask for it specifically (such as marketing emails).
6. Who we share it with
We share personal data with service providers who process it on our behalf under contract — currently including Stripe (payments), Supabase (application hosting and database), Resend (transactional email delivery), and Cloudflare (website security, Turnstile, Worker infrastructure and AI-assisted public Guide processing) — and, where required, with regulators, auditors or law enforcement. We do not sell personal data.
7. How long we keep it
We keep account and billing data for as long as your subscription is active and for a period afterwards to meet our legal and accounting obligations. Support correspondence is retained for as long as reasonably needed to resolve related issues and for our records. The public Guide is designed not to store visitor question text in application logs. For the limited Insights pilot, raw OTA review bodies should not be entered. The retention policy targets 90 days for free-text evidence and incident notes, and 24 months for structured aggregate metrics and approved monthly management reports; baselines are kept while needed for comparison, normally within that 24-month horizon. Automated Insights deletion is not active yet, so these are policy targets rather than automatic deletion guarantees. An authorized InnRelay privacy or retention process may delete an approved report when retention expires or erasure is required, without allowing hotel users to silently edit it. Contact us with privacy requests.
8. Security
We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including encryption in transit, access controls, rate limiting, abuse-prevention controls, and the security practices described in our Data Processing Agreement.
9. International transfers
Where a service provider processes data outside the UK or EEA, we require appropriate safeguards (such as Standard Contractual Clauses) to be in place.
10. Your rights
Under UK GDPR, you have the right to access, correct, delete, restrict or object to our processing of your personal data, and to data portability where applicable. To exercise any of these rights, contact us as described below.
11. Cookies
This website avoids non-essential tracking cookies. Security services such as Turnstile may use technical browser signals required to prevent abuse. Any cookies or local storage the InnRelay application itself uses to operate (such as keeping you signed in) are described in the relevant in-app notices.
Choosing a display language. If you have not picked a language yourself, the first time you open our homepage your browser sends a request to our Cloudflare Worker. Cloudflare, as our infrastructure provider, processes that connection, including your IP address, to determine the country it appears to come from, and attaches that country to the request. Like any web request, it also carries standard request metadata such as the page origin. Our Worker handler reads the country code, uses it only to choose a display language, sends that code back to your browser and does not store your IP address or the country code. Cloudflare's own handling of connection data is governed by its terms as our processor. Your browser then saves the chosen language in its local storage so the request is not repeated; any language you pick yourself is saved the same way. Our lawful basis is our legitimate interest in showing the site in a language you are likely to read. You can change the language at any time with the language menu, which overrides the automatic choice. Only the homepage and the guest chat are translated; other pages, including this policy, are in English.
Embedded video. The homepage shows our video as a local preview that makes no request to YouTube. Only if you press play does your browser load YouTube's privacy-enhanced (youtube-nocookie.com) player, at which point Google/YouTube receives your connection details, including your IP address, under its own privacy policy. You can instead follow the "Watch on YouTube" link.
12. Children
This website and InnRelay are intended for business use by adults acting on behalf of a property or organisation, not for use by children.
13. Changes to this policy
We may update this policy from time to time. We will post the revised version here with an updated edit date.
14. Contact & complaints
For privacy questions or to exercise your rights, contact us via our contact page. If you're unhappy with our response, you have the right to complain to the UK Information Commissioner's Office (ICO).