1. Who we are
Inxeption is provided by TECH IN WISE IT SOLUTIONS L.L.C (Limited Liability Company – Single Owner (LLC-SO), Dubai, licence no. 1336659, Dubai Department of Economy and Tourism), Office 06-047, Khalid Abdulghaffar Ghuloom Hussain Abdulla Building, 5th Floor, Dubai, UAE ("Inxeption", "we").
For data about hoteliers using our service (account, billing, support) we are the controller. For data about a hotel’s guests (bookings, guest messages, QR welcome sign-ups) the hotel is the controller and we process it on the hotel’s behalf and instructions.
Contact for privacy questions and requests: support@inxeption.com.
2. Data we collect
- Account data: name, e-mail address, password (stored only as a hash), role, language and sign-in times of hotel users.
- Hotel data: the hotel’s name, address, contact details, website content, photos, room types and settings, including content imported from the hotel’s previous website at the hotel’s request.
- Billing data: plan, subscription status, invoices and credit usage. Card payments are handled by Stripe; we never see or store full card numbers.
- Guest data (on behalf of hotels): name, e-mail, phone, stay dates, party size and booking messages; for QR welcome sign-ups also the consent given, its time stamp, IP address and the version of the consent text.
- Communications: e-mails and chat messages exchanged with our team and our AI agents.
- Website visitors: technical data needed to deliver the pages (IP address, browser, pages requested) and essential cookies such as the chosen language. We do not use advertising or cross-site tracking cookies.
- Google user data: only if a hotel user connects a Google account, as described in section 3.
3. Google user data
A hotel user can choose to connect Google Search Console and/or Google Business Profile in the panel. Connecting is optional and can be undone at any time.
- What we access. Google Search Console (scope webmasters.readonly, read-only): the list of the user’s Search Console properties and, for the hotel’s own website, search performance data (search queries, clicks, impressions, average position, pages and dates). Google Business Profile (scope business.manage): the business account and location of the hotel, its name, and the reviews of that location.
- How we use it. Only to provide features the hotel user sees in the panel: search performance reports, monthly reports, and SEO and content suggestions for the hotel’s own website; showing the hotel’s reviews and helping the hotel answer them. We do not post, reply, edit or delete anything on the hotel’s Business Profile unless the hotel user explicitly approves that specific action in the panel.
- How we store and protect it. OAuth access and refresh tokens are stored encrypted. Data is stored in the European Union on our hosting provider’s servers and transmitted only over encrypted connections. Access by our team is limited and every access to a hotel’s data is logged and visible to that hotel.
- Sharing. We do not sell Google user data and do not share it with third parties, except with the service providers that run our infrastructure and AI features on our behalf (section 5), under contracts that oblige them to use it only to provide our service. We do not use Google user data for advertising, and we do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models. Google data may be passed to our AI provider only to produce that hotel’s own report or suggestion.
- Retention and deletion. Google data is kept while the connection is active. When the hotel user disconnects Google in the panel or deletes the account, we delete the tokens immediately and the Google data within 30 days. Access can also be revoked at any time at https://myaccount.google.com/permissions.
- Limited Use. Inxeption’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Why we use data (purposes and legal bases)
- To provide the service under our contract with the hotel: the hotel website, booking engine, panel, AI agents, reports and support.
- To bill and keep records required by law (legal obligation).
- To keep the service secure, prevent abuse and fix problems (legitimate interest).
- Guest e-mails such as review requests or offers are sent only with the guest’s consent, recorded at the time it is given; consent can be withdrawn at any time.
- To send service notices to hotel users (for example DNS instructions, payment receipts, approvals waiting).
5. Who we share data with
We use service providers (sub-processors) that process data on our behalf and only for our service:
- Railway — application hosting and databases (European Union).
- Vercel — delivery of inxeption.com and the hotel websites.
- Stripe — subscription payments.
- Resend — sending and receiving e-mail.
- Anthropic — AI models that run our agents. Data sent to the model is not used to train Anthropic’s models.
- Firecrawl — reading a hotel’s previous public website when the hotel asks us to migrate it.
- DataForSEO — public search ranking data for the hotel’s website.
- Our booking inventory provider — rooms, rates and availability, and the guest details needed to make a booking the guest requested.
- Google — only if a hotel user connects Google (section 3).
6. International transfers
Our databases and files are hosted in the European Union. The contracting entity is in the United Arab Emirates, and some providers listed above may process data outside the EU or Turkey. Such transfers rely on standard contractual clauses or, where Turkish law (KVKK) requires it, explicit consent.
7. How long we keep data
- Account and hotel data: for the duration of the subscription and 30 days after it ends, during which the hotel can export everything; then it is deleted.
- Invoices and accounting records: as long as the law requires.
- Guest data: as instructed by the hotel; it is deleted together with the hotel’s data, and earlier on a guest’s erasure request.
- Consent records: as long as needed to prove the consent.
- Google data: see section 3.
8. Your rights
Depending on where you live (for example under the GDPR or KVKK) you can ask for access to, correction, export or deletion of your data, object to or restrict processing and withdraw consent at any time. Hotel users can export all their data from the panel. Guests should contact the hotel first; we help the hotel answer. Write to support@inxeption.com. You can also complain to your data protection authority.
9. Security
Encrypted connections everywhere, encrypted storage of tokens and secrets, role-based access, two-factor authentication for our administration panel, and an audit log of every access to a hotel’s data by our team.
10. Children
Our service is meant for businesses and is not directed to children under 16.
11. Changes
If we change this policy materially we will tell hotel users by e-mail or in the panel before the change takes effect. The date at the top shows the latest version.