Privacy Policy

1. Definitions

For the purposes of this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Data Subject" means the individual to whom the Personal Data relates (e.g., a property owner, staff member, or guest).
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data - in this case, rapidbounce.
• "Data Processor" means an entity that processes Personal Data on behalf of the Data Controller.
• "Sub-Processor" means a third-party service provider engaged by us to assist in processing Personal Data.
• "Property" means a hotel, accommodation, or hospitality business managed through the Platform.
• "Guest" means an individual who makes a reservation or communicates with a Property through the Platform.

2. Data Controller

The Data Controller responsible for processing your Personal Data is:

As a company with fewer than 250 employees, we are not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR. However, all data protection inquiries may be directed to the email address above, and we will respond within the timeframes prescribed by applicable law.

3. Personal Data We Collect

We collect and process different categories of Personal Data depending on your role and interaction with the Platform:

3.1 Property Owner and Staff Data

3.2 Guest Data

3.3 AI-Generated Data

When guest communications are processed through our AI pipeline, the following derived data may be generated:

• Sentiment analysis scores (numeric values reflecting perceived tone)
• Suggested replies for Property staff review
• Language detection results
• Topic classification labels
• Knowledge base matches

This data is generated to assist Property staff and is always subject to human review before any outbound communication is sent to guests. See Section 6 for more details on AI processing.

3.4 Usage and Technical Data

• IP address, browser type, operating system, device type
• Pages visited, features used, timestamps of interactions
• Referral sources and session duration
• Error logs and performance data

4. Legal Bases for Processing

Under the GDPR, we process Personal Data only when we have a valid legal basis. The following table outlines the legal bases we rely upon:

Where we rely on legitimate interests, we have conducted balancing tests to ensure our interests do not override the fundamental rights and freedoms of Data Subjects. You may request details of these assessments by contacting us.

5. How We Use Your Data

We use the Personal Data we collect for the following purposes:

• Service delivery: Creating and managing Property accounts, processing reservations, synchronizing availability and rates, generating invoices, and facilitating guest communication across email, WhatsApp, and web chat channels.
• AI-powered assistance: Analyzing guest messages to generate suggested replies, performing sentiment analysis, detecting languages, and matching incoming queries against the Property's knowledge base. All AI outputs are reviewed by staff before being sent to guests.
• Revenue management: Providing rate recommendations, competitor analysis, occupancy forecasting, and performance analytics to help Properties optimize their pricing strategy.
• Payment processing: Facilitating payments between guests and Properties through our integration with Stripe. We do not store credit card numbers, CVVs, or other sensitive payment credentials on our servers.
• Customer support: Responding to your inquiries, troubleshooting issues, and providing technical assistance.
• Platform improvement: Analyzing usage patterns, identifying bugs, and developing new features to enhance the Platform.
• Legal compliance: Maintaining records as required by Greek tax law, responding to lawful requests from regulatory authorities, and enforcing our Terms of Service.
• Security: Detecting and preventing unauthorized access, fraud, and other malicious activities through rate limiting, web application firewall rules, and monitoring.

We do not sell, rent, or trade your Personal Data to any third party for marketing or advertising purposes.

6. AI and Automated Processing

Steganomos incorporates artificial intelligence to help Property staff respond to guest communications more efficiently. We are committed to transparent and responsible use of AI. This section explains how AI processes your data.

6.1 What the AI Does

• Analyzes incoming guest messages (email, WhatsApp, web chat) to understand intent, detect language, and assess sentiment.
• Generates suggested reply drafts for Property staff to review, edit, and approve before sending.
• Matches guest inquiries against the Property's knowledge base to provide accurate, context-aware responses.
• Classifies conversations by topic and urgency to help staff prioritize their workload.

6.2 Privacy Safeguards in AI Processing

• PII masking: Before any guest message is sent to an AI model, personally identifiable information (such as names, email addresses, phone numbers, and payment references) is detected and masked using Microsoft Presidio, an open-source PII detection library. The AI model receives only the masked version of the message.
• Safety screening: All AI-generated outputs are screened through Google Cloud Model Armor before being presented to staff. This safety layer filters for harmful, inappropriate, or policy-violating content.
• Human-in-the-loop: AI-generated replies are always presented as drafts. No message is sent to a guest without explicit action by an authorized staff member. High-confidence replies may be sent automatically only when the Property has explicitly enabled this feature in their AI settings.
• Semantic caching: To reduce redundant AI calls and improve response times, we maintain a semantic cache of anonymized query-response pairs. This cache is automatically invalidated when the Property's knowledge base changes.
• No model training: Your data is not used to train or fine-tune the underlying AI models. We use commercially licensed AI services (Google Gemini and Anthropic Claude) under terms that prohibit the use of customer data for model training.

6.3 Automated Decision-Making

The Platform does not make any decisions with legal or similarly significant effects on individuals based solely on automated processing. AI outputs serve as recommendations for human staff. Guests have the right to contest any communication they receive and to request human review by contacting the Property directly or by reaching out to us at the contact details provided in Section 16.

7. Data Sharing and Sub-Processors

We share Personal Data only with third-party service providers ("Sub-Processors") who are necessary for the operation of the Platform. Each Sub-Processor is bound by a Data Processing Agreement (DPA) and is required to process data only as instructed by us.

7.1 List of Sub-Processors

7.2 When We May Disclose Data

Beyond our Sub-Processors, we may disclose Personal Data in the following limited circumstances:

• Legal obligations: When required by Greek or EU law, court order, or governmental regulation.
• Protection of rights: When necessary to protect the rights, property, or safety of rapidbounce, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, in which case the acquiring entity will be bound by the terms of this Privacy Policy.
• With your consent: In any other circumstance where we have obtained your explicit prior consent.

8. Data Residency and International Transfers

All primary data processing and storage occurs within the European Union, specifically in the europe-west1 (Belgium) region of Google Cloud Platform. This includes our databases, application servers, AI processing infrastructure, task queues, and analytics pipelines.

In limited cases, data may be processed by Sub-Processors with infrastructure outside the EU (e.g., Anthropic Claude for AI text analysis). Where such transfers occur, we ensure that appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) as approved by the European Commission.
• Adequacy decisions by the European Commission, where applicable (e.g., the EU-US Data Privacy Framework).
• Data Processing Agreements that contractually bind the Sub-Processor to GDPR-equivalent protections.

Additionally, before any guest message content is sent to AI models that may be processed outside the EU, personally identifiable information is masked (see Section 6.2), reducing the sensitivity of any data that crosses jurisdictional boundaries.

9. Data Retention

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The following retention periods apply:

Message deletion is automated via a scheduled task that runs weekly and removes messages older than the 90-day retention period. Anonymized or aggregated data that cannot be used to identify individuals may be retained indefinitely for analytical purposes.

10. Data Security

We implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include:

10.1 Technical Measures

• Encryption in transit: All data transmitted between users and the Platform is encrypted using TLS 1.2 or higher.
• Encryption at rest: All data stored in Google Cloud databases is encrypted at rest using AES-256 encryption managed by Google Cloud.
• Web Application Firewall (WAF): Google Cloud Armor protects the Platform against common web threats, including SQL injection, cross-site scripting (XSS), remote code execution, and protocol attacks.
• Rate limiting: API endpoints are protected by rate limiting (300 requests per minute per IP address) to prevent abuse.
• Access control: Role-based access controls ensure that users can only access data relevant to their Properties and assigned permissions.
• Secret management: API keys, tokens, and credentials are stored in Google Cloud Secret Manager and are never hardcoded or exposed in application code.
• Ingress restrictions: Production services accept traffic only through the load balancer; direct access to backend services is blocked.

10.2 Organizational Measures

• Access to production data is limited to authorized personnel on a need-to-know basis.
• We maintain audit logs of administrative actions and data access events.
• We conduct periodic reviews of our security practices and Sub-Processor compliance.

10.3 Breach Notification

In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority (the Hellenic Data Protection Authority - HDPA) within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk, we will also notify the affected Data Subjects without undue delay, in accordance with Article 34 of the GDPR.

11. Your Rights Under GDPR

As a Data Subject, you have the following rights under the GDPR. You may exercise any of these rights by contacting us at achilleas@karydis.com.

We will respond to all valid requests within 30 days of receipt. In complex cases, or where we receive a high volume of requests, this period may be extended by a further 60 days, in which case we will inform you of the extension and the reasons for it.

If you believe that our processing of your Personal Data infringes the GDPR, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):

12. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies to ensure proper functionality, enhance user experience, and collect analytics data. A cookie consent banner is displayed on your first visit, and you may manage your preferences at any time.

12.1 Types of Cookies

12.2 Managing Cookies

You may disable or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies may impair the functionality of the Platform. Most browsers allow you to:

• View and delete existing cookies
• Block all or specific cookies
• Set preferences for individual websites

For more information on managing cookies, visit www.aboutcookies.org.

13. Children's Privacy

Steganomos is a business-to-business platform designed for hospitality professionals. The Platform is not directed at individuals under the age of 16. We do not knowingly collect Personal Data from children. If we become aware that we have inadvertently collected data from a child under 16, we will take prompt steps to delete such data. If you believe we may have collected data from a minor, please contact us immediately.

14. Third-Party Links

The Platform may contain links to third-party websites or services (for example, booking engines, payment portals, or social media platforms). We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policy of any third-party service before providing your Personal Data.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify registered users via email or through an in-platform notification where the change materially affects how their data is processed.
• Where required by law, obtain fresh consent before implementing changes to data processing activities that rely on consent as a legal basis.

We encourage you to review this page periodically to stay informed about how we protect your data.

16. Contact Information

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your Personal Data, please contact us:

We aim to respond to all inquiries within 5 business days and to all formal data protection requests within 30 days, as required by the GDPR.