Data processing
annex

1. The parties and their roles

• Data controller: the company that hires Livyo to manage its properties (hereinafter, “the Client”). It decides for what purposes and how its guests' data is processed.
• Data processor: HIBCN APARTMENTS SL, tax ID (NIF) B56824360, with registered address at calle Bailén 50, entresuelo 1.ª, 08009 Barcelona (hereinafter, “Livyo”). It processes that data solely on behalf of the Client.

This annex applies from the moment the Client starts using the service and forms part of the contract. Livyo's contact for data protection matters: hola@livyo.ai.

2. Subject matter and purpose of the processing

Livyo processes personal data of the Client's guests for a single purpose: to provide the contracted messaging assistant service. Specifically:

• reading the messages that guests send through the channels connected to the Client's PMS;
• generating a reply with the artificial intelligence model, based on the message and the Client's knowledge base;
• sending that reply through the same channel, on behalf of the Client;
• escalating to a person at the Client the cases that require it, with the necessary context;
• keeping in Livyo's database the history of those conversations (the guest's message, the reply sent and the associated booking data) and the escalated cases, so that the Client can supervise the service, review what has been replied and follow up on incidents;
• showing the Client, on the portal, the information needed to supervise and correct the service.

Livyo is not a mere pass-through channel. The guests' messages and the assistant's replies are stored in Livyo's database (Supabase, in Paris, France, EU), in addition to existing in the Client's PMS.

Nature of the processing: collection, consultation, use, disclosure by transmission, storage and deletion, by automated means.

Livyo does not use this data for any purpose of its own: not for advertising, nor for profiling, nor for training models, nor for creating marketable products or statistics.

3. Duration

The processing lasts for as long as the service contract between the Client and Livyo is in force.

Within that period, guest messages, the assistant's replies and conversation data are stored in Livyo's database and kept for a maximum of 24 months from when they are generated. When the contract ends, section 12 applies.

The Client may at any time request in writing the early deletion of specific conversations or cases.

4. Categories of data and data subjects

4.1 Data subjects

The Client's guests: people who have booked a property of the Client or who ask about one, and those accompanying them if they appear in the conversation.

4.2 Categories of data

• Identification: the guest's first and last name as they appear in the booking or in the messaging channel.
• Content of the messages: what the guest writes and what is replied to them, including anything the guest decides to include on their own.
• Booking data: check-in and check-out dates, assigned property, number of guests, booking channel and booking identifier.
• Contact metadata: channel used, conversation identifier, language, dates and times of the messages; and the email or phone number when the Client's channel provides them.

What is stored in Livyo's database. All these categories, except those the Client's channel does not provide, are kept in our database, not just in transit: the guest's name, the text of their message, the reply the assistant sent, the conversation identifier, the property, the check-in and check-out dates, the channel and the date of each message. Escalated cases also store the reason for escalation, the number of guests and the status of the incident. The context of each property that the Client configures is also stored.

4.3 Data that should not be entered

The service is not designed to process special categories of data (health, ethnic origin, beliefs, sexual orientation, biometrics) or data of minors collected deliberately. If a guest mentions them on their own in a message, they will form part of the content; the Client must not configure the service to request them or to process them systematically.

The Client must also not enter into the knowledge base personal data that is not necessary to reply to guests.

5. Controller's instructions

Livyo processes the data only on the Client's documented instructions. The following are documented instructions: this annex, the Terms of use, the configuration the Client makes on the portal (active properties, channels, escalation rules, knowledge base) and any additional instructions the Client gives us in writing.

If Livyo considers that an instruction infringes data protection regulations, it will tell the Client before carrying it out.

If an EU or Member State rule requires Livyo to process the data in another way, it will tell the Client before doing so, unless that same rule prohibits it.

6. Livyo's obligations

Livyo undertakes to:

• process the data only for the purposes in section 2 and according to the Client's instructions;
• not disclose it to third parties except to the sub-processors in section 9 or where legally required;
• apply the security measures in section 8;
• ensure that anyone who accesses the data is bound by confidentiality;
• assist the Client in responding to guests' rights (section 10);
• assist the Client, as far as is reasonable and with the information available, in its impact assessments and prior consultations;
• notify security breaches without undue delay (section 11);
• delete or return the data when the contract ends (section 12);
• make available to the Client the information necessary to demonstrate compliance with these obligations;
• keep the record of processing activities carried out on behalf of the Client required by Article 30.2 of the GDPR.

7. Confidentiality

Livyo keeps all of the Client's data confidential, during the contract and after it ends, with no time limit.

Only Livyo's founding partners access the production environment and clients' data, each with a named, individual administration account (there are no shared accounts), and only when necessary to operate the service, deal with an incident or carry out an instruction from the Client. The Client may at any time ask for the list of people with access. If anyone else gains access in the future, they will be bound by contract to an equivalent duty of confidentiality.

8. Security measures

These are the measures implemented today:

• Encryption in transit: all traffic goes over TLS (HTTPS), both the portal and the calls to providers.
• Encryption of PMS credentials: the access keys to the Client's PMS are stored encrypted with 256-bit AES-GCM (authenticated encryption: any tampering with the encrypted data is detected on decryption). The encryption key is kept outside the database, is not cached in memory and the system fails safely if it is not correctly configured. Once stored, the credentials are never shown in full again on the portal.
• Secrets stored only as a fingerprint: session identifiers and invitation and password reset tokens are never stored in clear; only their SHA-256 is recorded in the database.
• Passwords only as an irreversible fingerprint: they are handled by the authentication provider (Supabase), which only stores their bcrypt hash, never the password in readable form. Nobody at Livyo can see them and they are not recorded in any log.
• Pseudonymised IP addresses: access attempt logs do not store the IP address, but its cryptographic fingerprint.
• Isolation per client: all data hangs off a client identifier; the tables have row-level access control enabled and there is no policy allowing them to be read from outside. The only access is the portal's backend, which checks on every request which client the user belongs to.
• Portal access control: sessions with an HttpOnly, Secure and SameSite=Strict cookie, expiry on inactivity and absolute expiry (7 days from sign-in; 8 hours for Livyo administration sessions), CSRF protection, a limit on access attempts and error messages that do not reveal whether an account exists.
• Audit log: sensitive actions on the portal are recorded with user, action, client and date.
• Minimisation in logs: the system logs do not include the body of requests or responses, so that they do not end up containing personal data.
• Data hosted in the EU: the database where conversations with guests are stored is in Paris, France (EU). The exception is the AI model (section 14).
• Separation between storage and model: only the message and the context needed to reply are sent to the AI model; the storage of the history stays in Livyo's European database.

Livyo may replace these measures with equivalent or better ones, without reducing the level of security.

9. Sub-processors

The Client gives general authorisation for Livyo to use the sub-processors in the table below. With each of them their standard data processing agreement (DPA) applies, incorporated into their terms of service, which sets out the obligations of Article 28 of the GDPR. Livyo is liable to the Client for the conduct of its sub-processors, in accordance with Article 28.4 of the GDPR.

9.1 What is not a sub-processor

• The Client's PMS is a provider of the Client itself, not of Livyo. Livyo merely connects to it with the credentials the Client provides.
• The email providers of the Client's team, which receive the notifications of escalated cases at the addresses the Client configures, are likewise providers of the Client.

9.2 Changes of sub-processor

If Livyo wants to add or replace a sub-processor, it will notify the Client at least 30 days in advance by email. The Client may object on reasonable data protection grounds within that period; if no alternative is found, either party may terminate the contract without penalty.

10. Assistance with guests' rights

Guests exercise their rights before the Client, who is the controller.

Livyo will assist the Client with appropriate technical and organisational measures so that it can handle requests for access, rectification, erasure, restriction, portability and objection. Because the conversation history is in Livyo's database, that assistance includes searching it for all the messages and cases associated with a guest (by name, by conversation identifier or by booking), exporting them in a structured, commonly used format, rectifying or deleting them at the Client's request, and confirming to the Client in writing what has been done.

If a guest contacts Livyo directly, Livyo will not reply on its own initiative: it will pass the request on to the Client without undue delay and let the guest know.

11. Security breaches

If Livyo becomes aware of a security breach affecting personal data processed on behalf of the Client, it will notify the Client without undue delay and, in any case, within a maximum of 72 hours of becoming aware of it, at the account's contact email.

The notification will include, with the information available at that time: what has happened, which categories and approximate volume of data and data subjects are affected, the likely consequences, the measures taken and a point of contact. Livyo will provide further information in phases if it is not all available immediately.

It is the Client, as controller, who decides whether to notify the supervisory authority and the data subjects.

Livyo has an internal procedure for handling these incidents (containment, assessment, notification and remediation) and documents all breaches, whether or not they are notified.

12. Deletion or return at the end

When the contract ends, and at the Client's choice, Livyo will delete or return all personal data processed on behalf of the Client, and will delete existing copies.

• The Client has 30 days from the end of the contract to request the return in a structured, commonly used format.
• If no request is made after that period, Livyo will delete the data, including the conversation history stored in its database and the PMS credentials.
• Livyo will keep only what an EU or Member State rule requires it to keep, and only for as long as that obligation lasts and with the same security measures.
• In the automatic backups of the database, the data disappears when those backups expire through the provider's normal rotation, without being restored in the meantime except to recover the service.

Livyo will confirm the deletion in writing when the Client asks.

13. Audit

Livyo will make available to the Client the information necessary to demonstrate compliance with this annex and will allow audits, including inspections, carried out by the Client or by an auditor the Client appoints.

Reasonable conditions: 30 days' notice, a maximum of one audit per year unless there has been a breach or an authority requires it, during working hours, without interrupting the service, without access to other clients' data and with a prior confidentiality agreement. The auditor's costs are borne by the Client, unless the audit reveals a significant breach by Livyo.

14. Use of artificial intelligence

The replies are generated by the Claude model, from Anthropic, through its commercial API. This is what happens to the data sent to it, according to Anthropic's commercial terms and privacy documentation:

• Models are not trained on content sent through the commercial API. Its terms expressly provide for this and its privacy documentation confirms that it does not use API data for training.
• Inputs and outputs are automatically deleted within 30 days of their receipt or generation.
• Exception: if content is flagged for breaching its usage policy, inputs and outputs may be retained for up to 2 years and trust and safety classification scores for up to 7 years. In that case, Anthropic staff may review that content to verify the breach.
• The Client keeps its rights over what is sent and owns what the model generates from it.
• The processing takes place in the United States. It is an international transfer, covered by Anthropic's data processing agreement and by the European Commission's standard contractual clauses.

To be precise: the model does not keep the data beyond that period or learn from it, but the data does leave the European Union during the generation of each reply. Any statement that “the data never leaves the EU” would be false.

14.1 No automated decisions

The assistant does not make automated decisions that produce legal effects on guests or that similarly significantly affect them (Article 22 of the GDPR): it does not approve or deny bookings, does not apply charges, does not assess profiles or classify people.

14.2 Transparency towards the guest

Article 50 of the European Artificial Intelligence Regulation requires that people be able to know that they are interacting with an AI system. For now the assistant does not include any notice to guests by itself. The Client undertakes not to present it as if it were a person and decides how to show the notice; Livyo provides a recommended text, which appears in section 5 of the Terms of use, and may add an automatic notice in the future. The assistant escalates to a person when it is not sure, and a person can take control of the conversation at any time.

15. Changes and governing law

Livyo may update this annex to adapt it to regulatory changes, changes in the service or changes of sub-processor. Significant changes will be communicated to the Client by email at least 30 days in advance.

This annex is governed by Spanish law and by Regulation (EU) 2016/679. In the event of a conflict with the Terms of use on data protection matters, this annex prevails.

For any question: hola@livyo.ai.

Last updated: 11 November 2026