Privacy Policy

Effective November 9, 2026

1. Introduction

withQ ("we," "our," or "us") provides artificial intelligence voice and text solutions for the hospitality industry. We value your privacy and are committed to protecting your personal data. This Privacy Notice explains how we process information when you visit our website or interact with our AI services at our partner hotels.

2. Our Role: Controller vs. Processor

It is important to understand our distinct roles:

  • For Website Visitors & Business Leads: We act as a Data Controller. If you request a demo on withq.ai, we determine how your data is used.
  • For Hotel Guests: We act as a Data Processor. When you speak to our AI agent at a hotel, we process your data solely on behalf of the hotel (the Data Controller) to fulfill your service requests. The hotel's privacy policy governs that data.

Note on Family Usage

We understand that our services may be used by minor guests staying in a room registered to an adult (e.g., a child requesting housekeeping services). In such instances, we process the data as incidental to the performance of the contract with the registered adult guest. We do not knowingly build user profiles or behavioral models on individuals under the age of 18. All voice data from the room is treated under the same strict retention and security policies, regardless of the speaker's age.

3. Data We Collect & Why

We collect and process specific types of data depending on whether you are visiting our website or using our services as a guest at a partner hotel.

Website Cookies

We use cookies, browser storage and analytics tools to run our website, measure how it is used and measure our advertising. Visitors in the EU/EEA, the UK and Switzerland are asked first: until they choose, we set only strictly necessary cookies, and only measurement that stores nothing on their device runs (apart from content some pages embed from other companies, which the Cookie Policy describes). Elsewhere these tools are on by default, and visitors can turn most of them off from "Cookie preferences" in the site footer. Our Cookie Policy describes the cookies, browser storage and providers we use.

Legal Basis: For visitors in the EU/EEA, the UK and Switzerland, your consent for the analytics and marketing tools our cookie preferences control. Our legitimate interest in running, measuring and promoting our website for strictly necessary cookies, for the measurement that stores nothing on your device, for the booking calendar and videos some pages embed from Calendly and YouTube, and for visitors elsewhere. Retention: Our Cookie Policy lists each lifetime we know: strictly necessary cookies up to 182 days, apart from a staff-only preview cookie whose lifetime our website framework sets; analytics and marketing cookies up to 2 years, or as their provider sets; browser storage entries until you close the tab or clear them.

Business Inquiries

If you request a demo or contact our sales team, we collect your name, email, and company information. If you contact us through a form on our website, the form also sends us the campaign details described in our Cookie Policy.

Legal Basis: Consent. Retention: See section 4, How long we keep information.

Guest Voice Data

When you speak to our AI concierge, we process your voice audio to transcribe your requests (e.g., ordering towels) and route them to the appropriate hotel staff.

Legal Basis: Performance of a Contract (via the Hotel). Retention: See section 4, How long we keep information.

Guest Transcripts

We retain text-based transcripts of interactions to create service summaries, update guest preferences, and ensure system quality.

Legal Basis: Performance of a Contract (via the Hotel). Retention: See section 4, How long we keep information.

4. How long we keep information

Information we handle for hotels

Hotels use withQ to answer guests' calls and messages. This information, and the accounts of the hotel's staff who use withQ, is the hotel's: the hotel decides what is collected and how long it is kept. We process it on the hotel's behalf as its service provider. The hotel's own privacy notice explains its practices. Please send requests about this information to the hotel, and we help the hotel answer them. The security and audit records of those staff accounts are covered under Information we control, below.

Our default periods. Unless a hotel sets other periods, our retention schedule sets these periods:

  • Call recordings for 1 year after the call, or after the end of any booking or stay the call relates to, whichever is later. A cancelled booking counts.
  • Call transcripts for 3 years, counted the same way.
  • Chat messages for 3 years after each message.
  • Summaries of a guest's requests, with notes and special requests, for 3 years after the guest's last call, message, booking or stay with that hotel or with any other hotel covered by the same agreement with withQ.
  • Guest contact details and preferences, including details the hotel adds from its own systems, for 3 years after the guest's last call, message, booking or stay with that hotel or with any other hotel covered by the same agreement with withQ. After that we delete the guest's name and contact details. We keep only booking reference numbers, which identify a guest only together with the hotel's own reservation system.
  • Booking and stay details received from the hotel's systems for as long as the hotel uses withQ. The guest's name and contact details on them follow the period above.
  • Payment card tokens and masked card details for 90 days after check-out or cancellation.

Hotels subject to European data protection law. For hotels whose processing is subject to the EU or UK General Data Protection Regulation, the defaults are shorter: call recordings for 90 days after the call or the end of the related booking or stay, whichever is later; transcripts and summaries for 6 months, counted the same way; and chat messages for 6 months after each message. The other periods are the same.

A hotel's own settings. A hotel may set different periods, up to limits published in our Data Processing Agreement. If one of these limits comes before a period, the limit applies. Whatever a hotel sets, we do not keep:

  • a call recording more than 2 years after the call;
  • a call transcript more than 4 years after the call;
  • a chat message more than 3 years after it was sent;
  • a summary more than 5 years after it was created;
  • a guest's contact detail more than 5 years after we last received it;
  • booking and stay details more than 5 years after check-out;
  • a payment card token more than 13 months after check-out or cancellation.

A deleted copy can stay in our backups for up to 30 days after its limit. The only exceptions to these limits are information under a legal hold, information the law requires us to keep longer, and the text of test cases (below). Where a hotel has signed its own data processing agreement with us that sets retention periods, those periods apply instead.

Test cases. A hotel may keep selected conversations as test cases for its own AI assistant. A test case can keep a conversation's transcript or messages past the limits above, until the hotel removes it or stops using withQ. A call recording in a test case keeps its own limit. For hotels subject to European data protection law, guest identifiers are removed from test cases. We use test cases only to test and improve that hotel's assistant. We never use them to train a model or for another hotel.

Derived data. Some features compute data from conversations, such as the indexes that make them searchable. This data is deleted with the conversation it came from, unless it has been de-identified. When a hotel stops using withQ, only aggregated, permanently de-identified usage data may remain.

Service logs. Our logs of the service are kept for 1 year, with names, addresses, email addresses and phone numbers masked.

Hotel staff accounts. We keep a staff account while it is active. We keep a deactivated account for the audit trail while the hotel uses withQ, and then delete it with the hotel's other information.

How deletion works. Our schedule is that information is removed from view in the service shortly before its period ends, is deleted from our active systems by the end of its period, and leaves our backups within 30 days after that. Our voice, AI and messaging providers process conversations to provide the service. How long each one keeps a copy depends on its own settings and terms.

When a hotel stops using withQ. The hotel can export its information for 30 days after it stops using withQ. We delete the information from our active systems by day 60 after that date, and from our backups by day 90 after it. We delete it sooner if the hotel asks.

Information we control

For some information, withQ decides how it is used. This covers visitors to our website, people who contact us about our services, and the security and audit records of hotel staff who use withQ. We keep:

  • Security logs for 1 year. Records of staff sign-ins and of deletions, for 3 years.
  • Enquiries and sales contacts for 3 years after our last contact with you.
  • Newsletter addresses while you are subscribed.
  • Records of privacy requests and complaints for 3 years after they are closed. These records do not hold the content of guests' conversations.
  • Records of consent while we rely on the consent, and for 3 years after.
  • Billing records as long as tax and accounting law requires.
  • Cookies for the periods set out in our Cookie Policy.

5. How We Share Data

We do not sell your personal data. We share data with:

  • The Hotel: We send your requests (e.g., "Room Service needed") directly to the hotel property where you are staying.
  • Service Providers: We use trusted cloud infrastructure (such as AWS, Microsoft Azure and Google Cloud), and voice platforms, as our subprocessor list names them, to run the AI models we use. We also use AI models from Anthropic and OpenAI to build, operate and support the service, and that work can include guest information. These providers are contractually bound to protect your data
  • Website Providers: When you visit withq.ai, information about your visit (such as the pages you view, your device and browser, and your IP address) goes, depending on your region and cookie choices, to Vercel (our website host), Google (Analytics, Ads and Tag Manager), PostHog, LinkedIn and Snitcher, as our Cookie Policy describes. Our demo booking page uses Calendly, and some blog posts embed YouTube videos. Messages and job applications you send through the website are delivered by email through Resend. If you try to sign in at withq.ai/login, send us a message through our contact form or apply for a job through our website, Upstash counts your attempts under a keyed hash of your IP address (for IPv6, of its network prefix), never the address itself, to limit how many attempts can be made. It keeps the count for up to 15 minutes for sign-in and messages, and for up to an hour for job applications. We do this in our legitimate interest in preventing abuse of our website.
  • Legal Obligations: We may disclose data if required by law, subpoena, or court order.

6. International Transfers

Our primary servers are located in the United States. If you are interacting with us from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) and strict data processing agreements to ensure your rights are protected under GDPR.

7. Your Rights

Depending on your location (GDPR, CCPA), you have rights regarding your data:

  • Access: Request a copy of your data.
  • Deletion: Request that we erase your data ("Right to be Forgotten").
  • Correction: Fix inaccurate information.

To exercise these rights regarding Guest Data: Please contact the Hotel where you stayed directly. As the Data Controller, they authorize all guest data requests.

8. Security Measures

We employ enterprise-grade security, including AES-256 encryption for data at rest; web, app and API traffic encrypted with TLS 1.2 or higher, and traffic between our services with mutual TLS. We utilize Role-Based Access Control (RBAC) to ensure only authorized personnel can access system data.

9. Contact Us

withQ Privacy Team Email: support@withq.ai Address: 1140 Harrison, Suite 434, San Francisco CA 94103, USA

Privacy Info for Young Guests (Under 18)

Can I use the digital concierge?

Yes, you can use the room phone to ask for things like towels, snacks, or information, but please ask your parent or guardian for permission first.

How we handle your voice

When you speak to our digital assistant, a computer listens to understand what you need (like "more toothpaste").

  • We do not create a personal file about you.
  • We only link your request to your Room Number, not to you as a child.
  • We delete the recording of your voice after a set time. Unless the law or the hotel's own agreement with us says otherwise, we never keep it more than 2 years after your call, and a deleted copy is gone from our backups within 30 days after that.

Important Rule

Because the hotel room is booked by an adult, our system assumes it is speaking to an adult or someone helping them. If you are unsure about using the service, please let your parent make the call.