Anana

" Anana does not determine which guests to contact, which fields to ingest, or how long the venue retains guest records — the venue does. The guest should refer to the venue's privacy notice."

" Provider Covered Claims: Any action, proceeding, or claim that the Cloud Service, when used by Customer according to the terms of the Agreement, violates, misappropriates, or otherwise infringes upon anyone else's intellectual property or other proprietary rights. Customer Covered Claims: Any action, proceeding, or claim that (1) the Customer Content, when used according to the terms of the Agreement, violates, misappropriates, or otherwise infringes upon anyone else's intellectual property or other proprietary rights; or (2) results from Customer's breach or alleged breach of Section 2.1 (Restrictions on Customer)."

" We share personal data only with vetted sub-processors under a DPA. An up-to-date list is available on request at privacy@getanana.com."

" This Privacy Policy explains how Anana processes personal data in connection with our AI agent platform for hospitality (hotels, restaurants, wellness venues). It covers our website (getanana.com), our application (app.getanana.com), our API (api.getanana.com), and the messaging, voice, and booking workflows that Anana performs on behalf of our customers."

" Omoc, Inc (doing business as Anana), 10 Montague Terrace, Apt 1B, Brooklyn, NY 11201, United States, is the controller for personal data processed about: Operator users (staff of our hospitality customers who log into Anana)"

" When a staff member of a hospitality customer is provisioned an Anana account, we process: Identification and account data: name, work email, role, organization/tenant ID Authentication data: login identifiers, session tokens, MFA factors (via Stytch) Usage data: pages viewed, actions taken in the app, artifacts created/sent, IP address, device/user-agent Support communications: messages sent to support@getanana.com"

" For transparency, the personal data Anana handles on behalf of venues includes: Inbound messages: chat widget conversations, inbound SMS, inbound email (content, sender identifiers, timestamps) Voice calls: audio recordings of WebRTC and SIP calls, machine-generated transcripts, call metadata (caller number, duration, routing) Booking and guest profile data synced from the venue's PMS/CRM: name, contact details, reservation details, stay history, and any fields the venue chooses to expose Embeddings: vector representations derived from messages and documents, used for retrieval; stored in pgvector"

" Server logs (IP address, user-agent, timestamps, requested URL) processed by AWS and Vercel for security, abuse prevention, and basic operation. Cookies: our websites use cookies. The categories and purposes of cookies in use, and the controls available to you, are described in our separate Cookie Policy and managed via the cookie banner displayed on first visit."

" We process standard HR data for employees/applicants and standard B2B contact data for prospects, customers, and suppliers. Employee processing is described in a separate internal notice."

" Provide the Anana platform to operator users (accounts, authentication, app access, support) Operator users Art. 6(1)(b): performance of contract with the customer Process guest messages, calls, bookings on behalf of the venue End guests/leads Processor: venue's lawful basis applies; Anana relies on Art. 28 Generate AI responses, transcripts, summaries, and embeddings to operate the service Operator users, end guests Art. 6(1)(b) (operators); processor for guests Security, fraud and abuse prevention, audit logging All Art. 6(1)(f): legitimate interest in securing the service Service communications (incident notices, billing, product updates) Operator users, customer admins Art. 6(1)(b) and Art. 6(1)(f) Marketing emails to prospects Business contacts Art. 6(1)(f): legitimate interest in B2B outreach; opt-out at any time Compliance with legal obligations (tax, accounting, lawful requests) All Art. 6(1)(c) Recruitment Applicants Art. 6(1)(b) pre-contract / Art. 6(1)(a) consent for retention "

" Where we rely on legitimate interest, you have the right to object (see Section 10). Special category data. Anana does not intentionally collect special category data (Art. 9). However, free-text guest messages and call content can incidentally contain health, dietary, or similar details, and the Practice Better integration can surface practitioner-client health records. Anana processes this data solely as a processor on the venue's behalf. The Art. 9(2)(a) explicit consent condition, and the notice to the individual, are the responsibility of the venue (controller); this obligation is allocated to the venue in our Data Processing Agreement."

" Operator user data: provided directly by the user or by their employer (the customer) when provisioning an account. Guest/lead data: received from the guest directly (when they message, call, or email the venue) or from the venue's PMS/CRM via integrations the venue has authorized. Website data: collected directly through your browser."

" Where Anana is the controller, you may exercise the following rights: Access (Art. 15): obtain a copy of your personal data. Rectification (Art. 16): correct inaccurate data. Erasure (Art. 17): request deletion. Restriction (Art. 18): limit processing. Portability (Art. 20): receive your data in a structured, machine-readable format where applicable. Object (Art. 21): object to processing based on legitimate interest, including direct marketing. Withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time, as easily as it was given, without affecting the lawfulness of processing carried out beforehand. Not be subject to solely automated decisions with legal or similarly significant effects (Art. 22). Anana generates suggested replies and drafts; final operator review is part of the workflow. To exercise your rights, email privacy@getanana.com , or contact our EU representative at privacy@probo.com (Section 2). We respond within one month (extendable by two further months for complex requests, Art. 12(3)). If you are an end guest and want to exercise rights against a venue, contact the venue directly — they are the controller. We will assist them under Art. 28(3)(e)."

" You have the right to lodge a complaint with a data protection authority. As Anana is established outside the EU/EEA, EU/EEA data subjects may lodge a complaint with the supervisory authority of the EU/EEA member state where they reside, where they work, or where the alleged infringement occurred. You may also contact our EU representative (Section 2)."

" Anana is a B2B service intended for hospitality businesses and their staff. It is not directed at children, and we do not knowingly collect personal data from children. Guests who interact with a venue's chat, SMS, voice, or email channel do so under that venue's own policies; venues are responsible for any age-specific obligations relating to their guests."