Privacy policy

1. Who we are and how to contact us

AskCasa is a product of YOCASA HOSPITALITY MANAGEMENT LIMITED ("we", "us" or "our"), registered in England and Wales under company number 16050627. Our registered office is 33 St. Anne Gardens, Basingstoke, England, RG24 9QE.

We are the data controller for personal information processed through this public website and our business enquiries. For privacy questions, requests or complaints, email samuel@askcasa.ai or write to our registered office, marked "AskCasa privacy".

2. What this policy covers

This policy covers the public AskCasa website, correspondence with us and the AskCasa platform when made available. AskCasa is in development. The current public website does not provide account registration, a live guest concierge, Google account connections or payments.

The Google account section below explains our commitments for optional Google integrations when they become available. Visiting this website does not grant us access to your Google account. Before launching a connected feature or collecting account, guest or payment information, we will update this policy with its specific data uses, permissions, recipients, lawful bases and retention periods.

Where a property operator uses AskCasa to process guest or staff information on its behalf, that operator determines the purposes of that processing and provides its own privacy information. Our responsibilities as its processor will be set out in our data processing agreement before that service becomes available.

3. What data we collect and where it comes from

• Website requests: our hosting provider, Microsoft Azure, may process your IP address, requested page, request time and browser or device information to deliver the site and protect it against abuse.
• Enquiries: when you email us, we receive your email address, name if provided, message, attachments and any business or contact details you choose to share. We also keep our replies and relevant follow-up correspondence.
• Platform information, when available: account and business details, password hashes and session credentials; property information; booking information supplied by operators or connected booking calendars; guest messages and AI-generated replies; voice input and transcripts when voice features are used; operational tasks, photos or video uploaded by authorised users; subscription and payment status; and security, audit and usage records. Property content and media may contain personal information if you include it.
• Authorised Google data: if you choose to use a future Google integration, information will come from Google only after you grant the permissions described for that feature. See section 6.

Please do not send passwords, payment card details, guest records or sensitive personal information in a website enquiry. You are not required by law or contract to provide information to browse this site. Providing enough contact information to answer an enquiry is optional, but we may be unable to respond without it.

4. Legal basis and how we use information

• Delivering and protecting the website: our legitimate interests in operating a reliable website, preventing misuse and keeping our services secure.
• Answering enquiries and discussing partnerships or early access: our legitimate interests in responding to people who contact us and managing business relationships. If you ask us to take steps towards a contract with you, we may also rely on those pre-contractual steps.
• Meeting applicable legal duties: compliance with legal obligations where we must keep or disclose information.
• Providing the platform, when available: performing our contract with account holders for account administration, subscription billing and service messages; legitimate interests in service security and support; and consent where required for optional marketing or non-essential tracking. For guest or staff information processed on an operator's instructions, the operator identifies the lawful basis in its own notice.

An early-access enquiry does not create an account, a subscription or permission for unrelated marketing. If we introduce optional marketing subscriptions, we will explain the applicable basis and give you a clear way to unsubscribe. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

You can object to processing based on our legitimate interests by emailing samuel@askcasa.ai. We will consider your circumstances and stop that processing unless there is an applicable legal reason to continue.

5. Who receives information

We do not sell personal information. We use Microsoft Azure for website hosting and Google Workspace for email. These providers process information to supply their services. Access within our business is limited to people who need it to handle enquiries, operate the website or meet our obligations.

We may share relevant information with professional advisers where needed, or with authorities when required by law. We do not share website enquiry information with advertising networks or send it to AI providers to generate responses on the current public site.

When the platform is available, authorised property operators and their team members can receive the information needed for their roles. Configured AI and speech providers process the text, audio or media needed to generate answers, transcribe speech or produce spoken responses. Stripe processes subscription payments; we do not store full payment card numbers. Transactional email providers deliver verification and service notifications. We will identify the applicable providers and their processing arrangements before customer launch. Google account data is subject to the additional limits in section 6.

6. Google account data and optional integrations

Connecting a Google account will be optional and initiated by you through Google's authorisation screen. We will request only the permissions needed for the feature you choose and explain the data accessed, how it is used, who receives it and the applicable lawful basis before access begins. No Google sign-in, Calendar or Gmail permissions are requested by the current public website.

AskCasa's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

• Google user data will be used only to provide or improve the specific user-facing feature you authorise.
• We will not sell Google user data, use it for advertising or unrelated profiling, or use it to train general-purpose AI or machine-learning models.
• Transfers will be limited to what is necessary for the authorised feature, permitted security purposes, legal requirements or other circumstances expressly allowed by Google's policy.
• People will not read Google user data except where you authorise access to specific data, where necessary for security or legal obligations, or where Google's policy permits access to aggregated and anonymised data for internal operations.

You can revoke access through your Google account's third-party connections settings. Revoking access stops further access through that connection; it does not automatically delete information already received. You can request deletion of stored Google data by emailing samuel@askcasa.ai. We will explain any necessary legal retention and applicable deletion timing for the connected feature before launch.

7. International processing

Our hosting and email providers operate internationally, so personal information may be processed outside the UK. The locations and protections depend on the service and its contract. Transfers must have an applicable UK adequacy basis or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with any additional protections required.

Contact us for information about the arrangements relevant to your data or a copy of applicable safeguards, with confidential information removed where necessary. We will confirm the arrangements for connected Google or other product features before making them available.

8. Data retention

We keep enquiry correspondence for as long as it is needed to answer your enquiry, complete relevant follow-up and manage any resulting business relationship. We assess continued need using the enquiry's purpose, whether the discussion is still active, and any legal obligations or need to establish, exercise or defend legal claims. When no longer needed, information is deleted or anonymised.

Technical website information is subject to our hosting provider's applicable operational and security retention arrangements. Backups may retain copies until their normal expiry and are not used for new business purposes. You can contact us about the retention applicable to your information. Product and Google integration retention periods will be disclosed before those features collect data.

Platform retention depends on the data class and operator settings. The product's configured retention policy provides a default of 30 days for stored guest message bodies (operator-configurable from 7 to 90 days), 90 days after resolution for issue photos (30 to 365 days), two years for non-billing audit records (one to seven years), and seven years for billing audit records. These product settings do not describe website enquiry retention. Before customer launch, we will confirm the operational deletion and backup arrangements and disclose retention for other data classes, including audio, video, account records and Google data.

9. Cookies and security

The current public website does not set cookies, use browser local storage, load analytics or advertising trackers, or include registration forms. Fonts and images are served with the website. Email links open your own email application; a message is sent only when you send it.

The separate marketing application prepared for launch uses local storage to remember cookie preferences, and signed-in applications use browser session storage for session credentials. Its cookie-preferences control lets you change your choice. Non-essential tracking requires the applicable consent before it runs. These application features are outside the current temporary public deployment.

We use HTTPS and restrict access to information to help protect it against unauthorised access or disclosure. No internet service can guarantee absolute security. External websites linked from this site, including Google, have their own privacy and cookie policies. We will explain any changes to cookies or browser storage before introducing new features.

10. Your rights

For the steps to request erasure, including information associated with Meta services where applicable, see our data deletion instructions.

Depending on the circumstances, UK data protection law gives you rights to access your personal information, correct inaccuracies, request deletion, restrict processing, object to processing and receive a portable copy where applicable. You can also withdraw consent where it is the basis for processing.

To make a request, email samuel@askcasa.ai. We may ask for proportionate information to verify your identity before disclosing personal data. Requests are normally free, and we aim to respond within one month, subject to applicable legal extensions or exceptions. If your request concerns information handled for a property operator, we will help direct it to the responsible operator.

11. Complaints, children and automated decisions

Please contact us if you have a concern about our handling of your information. You can also complain to the UK Information Commissioner's Office (ICO); you do not need our permission to do so.

This website is intended for business audiences and is not directed at children. We do not knowingly collect children's information through it. If you believe a child has sent us personal information, please contact us.

We do not use website or enquiry information to make solely automated decisions with legal or similarly significant effects on you.

12. Changes to this policy

We will update this policy as our services or information practices change and show the latest revision date above. Where a change requires additional notice or consent, we will provide it before using information for the new purpose.

Our terms of service set out the rules for using AskCasa.