Privacy policy

Last updated: 21 July 2026

Protecting your personal data is at the heart of what we do: Dialspot builds AI agents for the hospitality industry, and we apply to our own tools the standards our clients expect from us. This policy describes what data is collected, why, and what your rights are — on the one hand on www.dialspot.ai(the “Site”), and on the other hand on platform.dialspot.ai(the “Platform”), the space reserved for client properties, in particular when they connect their Outlook mailbox to it.

If you arrived here from a Microsoft consent screen, section 3 is the one that concerns you: it details what connecting a mailbox authorises, and what is retained.

1. Data controller

The Site and the Platform are published by Dialspot, represented by Grégoire Chouteau. For any question relating to your personal data: gchouteau@dialspot.ai.

2. Data we collect

We only collect the data you voluntarily provide to us or that is necessary for the operation and audience measurement of the Site:

• Contact form: name, email address, property and message. This information is sent to us by email in order to respond to your request.
• Appointment booking: booking a demo slot is done through Calendly, which collects your name, your email and the chosen slot in accordance with its own privacy policy.
• Email agent demo: the messages you write in the “Write to her” demo are sent to an artificial intelligence model to generate the reply. They are not used for commercial purposes nor associated with your identity — we invite you not to enter any personal data in them.
• Voice agent demo: when you speak to the demo agent, your voice is captured by your microphone (with your explicit permission) and processed by our partner ElevenLabs to hold the conversation. The contact details you choose to share during the demo (first name, last name, email, phone) are used only to illustrate the booking journey and, only if you agree, so that Dialspot can contact you again. No banking data is ever requested.
• Audience measurement and advertising: the Site uses Google Analytics 4, Google Ads conversion tracking and the LinkedIn Insight Tag, which set cookies and collect pseudonymised browsing data (pages viewed, source, device).

3. The Platform and connecting your mailbox

This section concerns client properties that use the Platform and connect their Microsoft Outlook mailbox to it in order to run the email agent. In this context, the property is the data controllerfor its guests' data, and Dialspot acts as a processor, on its instructions.

Permissions requested. When connecting, Microsoft asks for your consent for the following permissions, and only these:

• User.Read— read the name and address of the connected mailbox, in order to display them on the property's profile;
• Mail.ReadWrite — read the messages received by the property and prepare replies to them;
• Mail.Send— send the reply to the guest from the property's mailbox;
• offline_access — keep the authorisation between sessions, so that the agent works without manual reconnection.

Access covers exclusively the mailbox that has been connected. We do not access the mailboxes of other users in your organisation, nor your files, nor your directory.

What is actually retained.

• The address of the connected mailbox, displayed on the property's profile so that you know which account is linked.
• The access authorisationissued by Microsoft. It is stored in such a way that it can never be read back through the Platform's interface or API, and is used solely to obtain from Microsoft a temporary access of about one hour.
• The content of the exchanges processed by the agent: the message received and the reply produced are recorded in order to feed the conversation history and the statistics of the property's dashboard. These messages may contain personal data of the hotel's guests (name, contact details, stay details). We do not copy the entire mailbox: only the exchanges actually processed by the agent are recorded.
• Activity data: timestamp, event type, response time, success or error status.

Purposes and legal basis. This processing serves to respond to requests received by email, to display the conversation history and the agent's performance indicators, and to ensure the operation, diagnostics and security of the service. It is based on the contract concluded between Dialspot and the property. This data is neither sold nor transferred, is not used for advertising purposes and is not used to train any artificial intelligence model.

Withdrawing the authorisation. Access can be cut off at any time, without our intervention, from myapps.microsoft.com by revoking the access granted to Dialspot, or, for an administrator, from Microsoft Entra ID → Enterprise applications → Dialspot → Permissions. Revocation takes effect immediately: the stored authorisation becomes inoperative and the agent stops accessing the mailbox. To request the deletion of data already recorded, write to us at gchouteau@dialspot.ai.

4. Purposes and legal bases

• Responding to your requests (form, appointments) — performance of pre-contractual measures taken at your request.
• Running the AI demos — your consent, expressed by the voluntary use of the demo and the microphone permission.
• Contacting you again for commercial purposes after a demo — only with your agreement expressed during it.
• Measuring the audience and the effectiveness of our campaigns — your consent to the setting of cookies; you can refuse them (see section 7).

5. Recipients and processors

Your data is neither sold nor rented. It is only accessible to Dialspot and to the strictly necessary technical providers:

• Hostinger — hosting of the Site and the Platform (European Union);
• Microsoft (Outlook) — receipt of your messages;
• Microsoft (Microsoft Graph, Microsoft Entra ID) — access to the connected mailbox and authentication, for the Platform;
• Supabase — the Platform's database (accounts, properties, conversation history);
• Calendly — appointment booking;
• ElevenLabs — voice processing for the voice agent demo;
• OpenAI — generation of the replies for the email agent demo;
• Google and LinkedIn — audience measurement and advertising.

Some of these providers are established outside the European Union (notably in the United States). Transfers are governed by the mechanisms provided for by the GDPR (standard contractual clauses or adequacy decision, notably the Data Privacy Framework).

6. Retention periods

• Contact requests and commercial exchanges: 3 years after your last contact.
• AI demo messages: not retained by Dialspot beyond the processing of the conversation.
• Contact details left during the voice demo: deleted if you did not wish to be contacted again, otherwise 3 years.
• Audience measurement cookies: 13 months maximum.
• Platform — mailbox access authorisation: kept until it is revoked, after which it is inoperative.
• Platform — agent conversation history: kept for the duration of the contract with the property, then deleted at its request.

7. Cookies and trackers

The Site sets audience measurement and advertising cookies (Google Analytics 4, Google Ads, LinkedIn Insight Tag). You can refuse or delete them at any time through your browser settings, as well as through the opt-out mechanisms offered by these providers: Google Analytics opt-out and LinkedIn opt-out. Refusing cookies does not affect access to the Site.

8. Security

The Site is served entirely over HTTPS. Exchanges with our internal systems are authenticated by technical secrets, access is limited to authorised persons, and the AI demos are protected against abusive use (rate limiting).

9. Your rights

In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have a right of access, rectification, erasure, restriction, objection and portability over your personal data. To exercise it, write to us at gchouteau@dialspot.ai — we reply within one month. If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

10. Changes to this policy

This policy may be updated to reflect changes to the Site or to the regulations. The date at the top of the page indicates the last revision. In the event of a substantial change, a notice will be displayed on the Site.