Trust & Responsible AI
Hospitality is built on trust. InRoom designs conversational AI that respects guest privacy (GDPR) and complies with European AI transparency regulations (Article 50 of the EU AI Act).
Trust is not declared, it is shown through concrete product decisions. This page explains what InRoom does with data, how the AI behaves in every conversation and what a hotel or a guest can demand at any time.
EU AI Act Article 50(1) Transparency by Design
Human-in-the-Loop Supervision & Escalation
Grounded Property Knowledge (Anti-Hallucination)
European Data Governance & GDPR Alignment
Guests always know they are talking to an AI
Article 50 of the European AI Act requires informing people when they interact with an artificial intelligence system. In InRoom that notice is not buried in a link: it is part of the first message of the conversation and is visible in the panel next to every thread.
- Explicit virtual assistant notice on first contact
- Visible label in app.inroom.io on every conversation
- The hotel can edit the notice text, never remove it
Human-in-the-loop by design
The AI proposes; the team decides. Any conversation can switch to manual mode in one click with the full history available, and the guest does not have to restart the conversation.
- Automatic escalation on complaints, incidents or sensitive requests
- Manual takeover with full context
- Record of who intervened and when, available in the audit log
Answers anchored to verified hotel data
The assistant does not improvise menus or opening hours. It answers from the information the hotel has loaded and validated in knowledge tables, and when it does not have the data it does not invent it: it escalates or asks for confirmation.
- Knowledge base editable by the hotel itself
- No promises about services, prices or policies that are not configured
- Regular conversation reviews to close information gaps
Minimisation and limited purpose
We only process what is needed to handle the conversation: stay data, messages and the operational tag that helps the team. Guest data is never used for advertising or to train third-party models.
- Legal basis: performance of the service contracted by the hotel
- The hotel is the controller; InRoom acts as processor
- Encryption in transit and at rest; role-based access and audit trail
Identified processors, not an opaque chain
InRoom relies on Meta's WhatsApp Business Platform for messaging and on AI providers for transcription and translation. All of them operate under data processing agreements and with infrastructure in the European Union.
- Meta · WhatsApp Business Cloud API (messaging channel)
- OpenAI · voice-note transcription and automatic translation
- Application and database infrastructure hosted in the EU
Guest rights and a direct channel
Guests can exercise their rights of access, rectification, erasure or objection by writing to the hotel or directly to our data protection officer. We answer within one month, as the GDPR requires.
- DPO contact: rai@inroom.io
- General contact: inroom@inroom.io
- Default retention of 24 months and deletion on request
What InRoom does not do
What we keep out of the system's scope matters as much as what we build into it.
- It does not decide prices, availability or booking conditions.
- It does not replace reception judgement on a complaint or an emergency.
- It does not answer with information the hotel has not validated.
- It does not share guest data with parties outside the service.
- It never hides from the guest that they are talking to an AI.
Frequently asked questions on responsible AI
Is my guests' data used to train models?+
No. The AI providers we work with operate under data processing agreements and do not train models on hotel or guest data.
What happens if the AI answers something wrong?+
The hotel can correct the data in the knowledge base and the correction applies to the next answers. The team can also take over the conversation at any time and log it in the panel.
Where is the information hosted?+
The application and database live in the European Union. Messaging runs through Meta's WhatsApp Business Platform, and transcription and translation are handled by providers under contract with the same guarantees.
Does this comply with Article 50 of the AI Act?+
Yes: the guest receives a clear notice that they are interacting with an AI assistant from the first message, and that notice cannot be switched off from the hotel panel.
Who is the data controller?+
The hotel or property is the controller of its guests' data. InRoom Hospitality SL acts as processor on behalf of the hotel.
Legal documentation
The formal details of each processing activity are in our policies. We recommend reading them alongside this page.
Privacy Policy
This policy explains what personal data we process when you visit our website, request a demo or use the During Stay platform, for what purpose, for how long and which rights you can exercise.
Cookie Policy
This policy describes the cookies and local storage used by inroom.io, what they are for and how you can manage them.
Legal Notice
This legal notice governs access to and use of the inroom.io website, owned by InRoom Hospitality SL, in compliance with Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).
Data Protection & Legal Inquiries
InRoom Hospitality SL · NIF B27610112 · Contact: rai@inroom.io / inroom@inroom.io
Last updated: November 2026
Ready to See InRoom Working for Your Hotel?
In a 30-minute session, we will show you tailored WhatsApp flows for your property, the live supervisory dashboard, and our 48-hour onboarding plan.