Privacy policy

Last updated: 16 September 2026

1. Who we are. Dooria is an AI-powered digital concierge service for hotels, allowing hotel guests to communicate with their hotel via WhatsApp. Publisher: Laurent Salama, sole proprietor trading as Dooria, 8 rue du Général Camou, 75007 Paris, France. Contact: contact@dooria.fr

2. Our role. For website visitors and prospects, Dooria is the data controller. For hotel guests, the hotel is the data controller and Dooria acts as a data processor on the hotel's behalf, under a data processing agreement compliant with Article 28 GDPR.

3. Data we collect.

(a) Website: name, email, phone, hotel name, number of rooms, category, message.

(b) WhatsApp concierge service (on behalf of hotels): phone number, WhatsApp profile name, message content and timestamps; guest data provided by the hotel from its PMS/CRM (name, title, language, nationality, email, VIP status, stay preferences, household composition, room number, stay dates and type); guest requests and their follow-up. Dooria never shares stay-related financial information over WhatsApp and does not collect payment data.

(c) Hotel WhatsApp Business accounts: when a hotel connects its WhatsApp Business Account to Dooria through Meta, Dooria accesses the account and phone number identifiers and the access tokens required to send and receive messages on the hotel's behalf.

4. Purposes. Responding to contact requests; answering guest messages and routing requests to hotel staff; personalising answers based on the guest profile and stay; request tracking and service statistics for the hotel; service security and improvement. Guest data is never used for advertising, never sold, and never used to train AI models.

5. Artificial intelligence. Guest messages are processed by an AI model to understand and answer requests. No decision with legal effects is made automatically. Any request requiring action is forwarded to hotel staff, and guests may ask to speak with a human at any time.

6. Recipients and sub-processors. Dooria team and staff of the relevant hotel only; one hotel's data is never accessible to another hotel. Sub-processors: Meta Platforms (WhatsApp Business Platform), OpenAI (US), Airtable (US), IONOS (EU), the hotel's internal communication tool, and our back-office provider. Transfers outside the EU rely on the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses.

7. Retention. Prospects: 3 years after last contact. Guest conversations and requests: 12 months after the end of the stay unless otherwise instructed by the hotel. Hotel-provided data: for the contract term, deleted or returned within 30 days after termination. WhatsApp access tokens: deleted upon disconnection or contract termination.

8. Security. Encryption in transit (HTTPS/TLS), per-hotel environment isolation, restricted named access, secure token storage.

9. Your rights. Access, rectification, erasure, restriction, portability and objection: contact@dooria.fr. You may lodge a complaint with the CNIL (www.cnil.fr). Data deletion instructions: https://www.dooria.fr/en/data-deletion

10. Changes. This policy may be updated; the last update date is shown above.