Privacy Policy
ConSergio.ai — DevInterface srl Version 2.1 · Last updated: 2 October 2026 · Effective from: 2 October 2026
Language. This English text is a courtesy translation of the Italian original. In the event of any discrepancy or conflict between the two versions, the Italian version shall prevail.
This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and describes how DevInterface srl processes personal data in the context of the ConSergio.ai service and its related website. It replaces version 1.1, in force since 3 September 2026.
1. Data Controller
DevInterface srl Via Guglielmo Marconi 20, 37012 Bussolengo (VR), Italy VAT no. 04080300231 E-mail: [email protected]
The Controller has not appointed a Data Protection Officer (DPO), as the conditions for mandatory appointment under Article 37 GDPR do not apply.
2. Who this Policy is for
This Policy is addressed to:
- accommodation businesses that subscribe to or are evaluating ConSergio.ai, and the natural persons acting on their behalf;
- Staff Users of those businesses, as regards service communications and platform security;
- partners in the ConSergio.ai referral programme and the persons acting on their behalf;
- visitors to the ConSergio.ai website;
- users of the Guest web app, solely as regards the measurement tools described in Article 9.
Are you a guest, have you booked with a property, or have you written to its assistant on its website? If you have scanned a QR code in your room, made or requested a booking, completed the online pre check-in or used the assistant on a property’s website, your data is processed by the property, which is the Data Controller. DevInterface acts solely as a technology provider, on the property’s behalf. The privacy notice that applies to you is the one made available by the property — within the web app, on its website or in the pre check-in form — and it is the property you should contact to exercise your rights. This Policy does not govern that processing, except as set out in Article 9 for the measurement of use of the web app.
3. Roles: who processes what
Two levels of processing must be distinguished.
| DevInterface is… | Reference document | |
|---|---|---|
| Data of customer properties (account, contacts, billing, platform usage, security) and of partners | Data Controller | This Policy |
| Data of Guests in their rooms (Concierge Module: requests, conversations, surveys, name and any stay data) | Data Processor on behalf of the property, which is the Controller | Data Processing Agreement (DPA), Article 3.2 |
| Data of persons making bookings and of visitors to the property’s website (Reservations Module and Widget: bookings, contact details, requests, conversations) | Data Processor on behalf of the property | DPA, Article 3.3 |
| Identity data of guests staying at the property (Pre Check-in and Alloggiati Web Function) | Data Processor on behalf of the property; the State Police receives it by law | DPA, Article 3.4 |
| Browsing data in the Guest web app, collected with consent through measurement tools | Data Controller | This Policy, Article 9 |
For Staff User data processed within the platform (account, roles, permissions, action logs), DevInterface acts as Processor on behalf of the property. It acts as Controller for service communications, support and platform security.
4. Categories of data processed
- Registration and account data: first and last name, role, e-mail address, language, name and details of the property, credentials in non-reversible form, IP address and user agent at registration, any referral code used.
- Proof of acceptance of contractual documents: user, document version, date and time, IP address and user agent.
- Billing data: company name, address, VAT number and tax code, recipient code, invoice and payment history. We do not process payment card data, which is collected directly by the payment services provider.
- Partner data: company name, contact details, referral code, data of the users who access the partner panel, customers attributed and related commissions.
- Usage and technical data: access logs, IP address, timestamp, device and browser type, actions performed in the management panel, push notification subscriptions for the panel.
- Service consumption data: metrics on the use of features and artificial intelligence resources, used for billing, cost monitoring and technical sizing.
- Content uploaded by the property: service descriptions, images, documents, rates and other informational materials. Such content should not contain personal data; if it does, it remains the responsibility of the property.
- Communications: content of support, quotation or information requests sent to DevInterface.
- Browsing and measurement data: collected as described in Article 9, including, for measuring advertising campaigns and only with advertising consent, the cryptographic fingerprint of the e-mail address of the person registering for the Service or completing the contact form on the website, the identifiers of advertising cookies and, for the contact form, the IP address and the browser used.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provision of the Service, account management and support | Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) |
| Billing, management of payments and overage | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Management of the partner programme and the “Invite a friend” programme, including attribution of customers and calculation of commissions and rewards | Performance of the contract with the partner or the customer (Art. 6(1)(b) GDPR) |
| Tax, accounting and document retention obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Proof of acceptance of contractual documents | Legitimate interest (Art. 6(1)(f) GDPR) |
| Platform security, prevention of abuse, automated submissions and fraud, data integrity | Legitimate interest (Art. 6(1)(f) GDPR) |
| Service improvement, technical analysis and cost monitoring | Legitimate interest (Art. 6(1)(f) GDPR) |
| Statistical measurement of the use of the website, the panel and the Guest web app | Consent, withdrawable at any time (Art. 6(1)(a) GDPR and Art. 122 Italian Legislative Decree 196/2003) |
| Measurement of the effectiveness of advertising campaigns | Consent, withdrawable at any time (Art. 6(1)(a) GDPR and Art. 122 Italian Legislative Decree 196/2003) |
| Service communications (technical notices, contractual changes, usage thresholds) | Performance of a contract (Art. 6(1)(b) GDPR) |
| Sending commercial communications about similar products and services to existing customers | Legitimate interest, with the right to object at any time (Art. 6(1)(f) GDPR and Art. 130(4) Italian Legislative Decree 196/2003) |
| Sending newsletters and promotional communications to non-customers | Consent, withdrawable at any time (Art. 6(1)(a) GDPR) |
| Establishment, exercise or defence of legal claims | Legitimate interest (Art. 6(1)(f) GDPR) |
Providing registration and billing data is necessary to activate and deliver the Service: failure to provide it prevents use of the Service. Providing data for promotional purposes and consenting to measurement tools are optional and do not affect use of the Service.
6. Method of processing and automated decision-making
Data is processed using electronic means, with appropriate technical and organisational measures to ensure its security and confidentiality, and is accessible only to authorised personnel.
DevInterface does not carry out automated decision-making or profiling producing legal effects or similarly significantly affecting data subjects within the meaning of Article 22 GDPR.
7. Third-party providers
To deliver the Service, DevInterface relies on the following providers, which process personal data on its behalf as processors, unless otherwise indicated:
| Provider | Activity | Location |
|---|---|---|
| Contabo GmbH | Hosting of the application infrastructure, the database and the vector index | Germany (EU) |
| Amazon Web Services (S3) | Storage of files, images and documents; storage of backups | Italy — Europe (Milan) region, eu-south-1 |
| OpenAI | Generating responses of the assistant and the Widget, embeddings, translating content at staff’s request, survey questions | USA |
| Postmark (ActiveCampaign group) | Sending service e-mails and e-mails sent on behalf of properties | USA |
| Cloudflare, Inc. | Traffic delivery and protection; anti-automation verification on the registration, password recovery and booking request forms | Global network, headquartered in the USA |
| Stripe | Management of payments, subscriptions and billing. For payment instrument data, Stripe acts as an independent controller, under its own privacy policy | EU / USA |
| Slack Technologies | Internal operational notifications to DevInterface staff, limited to facts about customer accounts and properties (name, address, owner’s contact details) and to technical error reports; no data of guests, persons making bookings or visitors | USA |
| Google (Maps Platform) | Geolocation of the property’s address and place search for the assistant; receives no identifying data of guests | USA |
| Google (Tag Manager and Analytics) | Statistical measurement of the use of the website, the panel and the Guest web app, only with prior consent | USA |
| Meta Platforms Ireland | Measurement of advertising campaign conversions, only with prior advertising consent. Acts as joint controller or independent controller under its own terms | Ireland (EU) / USA |
| iubenda | Management of the cookie consent banner and preferences | Italy (EU) |
The vector index used by the AI assistant is self-hosted on the infrastructure above and does not involve an additional provider.
The up-to-date list of providers processing data on behalf of customer properties is set out in Annex B to the DPA. Data may also be disclosed to tax, legal and accounting advisers, and to the competent authorities where required by law.
8. Transfers to third countries
Primary data and backups are hosted in the European Union. The processing entrusted to the providers listed in Article 7 as established in the United States involves a transfer to a third country, or the possibility of access from a third country: processing by the artificial intelligence model provider, e-mail delivery, network and protection services, internal notifications and measurement tools. These transfers are subject to appropriate safeguards under Chapter V GDPR (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework). A copy of the safeguards adopted may be requested at the address in Article 1.
9. Cookies and measurement tools
9.1 By default, the website, the panel and the Guest web app use only the technical cookies and local storage necessary for operation, authentication and storing preferences, which do not require consent.
9.2 The Google Tag Manager container is always loaded, and receives the IP address and technical browser data of visitors. The statistical measurement tools (Google Analytics) and advertising measurement tools (including Meta’s Conversions API) that it governs are disabled by default and activated, through Google Consent Mode, only with prior consent, given and withdrawable at any time through the banner and the preference management panel provided by iubenda. Without advertising consent, no event is sent to Meta.
9.3 Guest web app. The consent banner is also shown in the web app opened by guests via QR code. With consent, DevInterface collects, as independent controller, browsing data on the use of the web app (pages visited, device, referrer), solely in order to measure and improve the Service. These tools do not receive the content of requests, conversations or stays, and are not loaded in the pre check-in form or in the Widget installed on properties’ websites. Guests’ browsing data is measured in the same tools used for the ConSergio.ai website, and DevInterface does not use it for advertising purposes.
9.4 The panel for properties may store notification preferences in the browser. The Widget installed on properties’ websites does not use measurement or profiling cookies: it keeps a conversation identifier in the browser’s session storage, on behalf of the property.
10. Retention periods
| Category of data | Retention |
|---|---|
| Account and configuration data | For the duration of the contractual relationship, including periods in which properties have no active subscription, and until the closure of the Account; erased on the date notified when the closure is scheduled, no earlier than 30 days, and kept in backups for no more than 7 days. Without prejudice to the periods set out below |
| Proof of acceptance of contractual documents | For the duration of the relationship and until the limitation periods for the rights arising from it have expired |
| Billing data and documents | 10 years from the accounting entry, as required by law |
| Partner and commission data | For the duration of the relationship with the partner and, for accounting data, 10 years |
| Action log in the panel | According to the history retention of the property’s Plan (30, 365 or 730 days); the IP address is removed after 90 days |
| Technical server logs | On a rotating basis, and in any event no longer than 6 months, subject to extension for the time needed to investigate and manage security incidents |
| Service consumption metrics | For the duration of the relationship; thereafter retained in aggregated, anonymous form |
| Support requests and communications | 24 months from closure of the request |
| Data processed for promotional purposes | Until objection or withdrawal of consent and, in any event, no longer than 24 months from the last contact |
| Measurement tool data | According to the tool settings shown in the consent preference panel |
| Data needed to defend a legal claim | For the duration of the dispute and until the time limits for appeal have expired |
Data of guests, persons making bookings and visitors to properties’ websites is retained according to the periods set by the property within the limits of the subscribed Plan and of legal obligations, as described for each module in Article 12 of the DPA and in the Terms of Service.
11. Data subject rights
Data subjects may exercise at any time the rights provided for by Articles 15-22 GDPR: access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest — including objection to commercial communications — and the right to withdraw consent at any time, without affecting the lawfulness of prior processing. Consent to measurement tools can be withdrawn at any time from the consent preference panel.
Requests may be sent to [email protected]. DevInterface will respond within one month of receipt, extendable by two months in cases of particular complexity.
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or with the supervisory authority of their habitual residence or of the place of the alleged infringement.
Requests from guests, persons making bookings and visitors to properties’ websites. For data processed by DevInterface as Processor on behalf of properties, requests must be addressed to the property concerned, which is the Controller. Where a request is received directly by DevInterface, it will be forwarded without delay to the property concerned, which DevInterface will assist as provided in the DPA.
12. Changes to this Policy
This Policy may be updated to reflect regulatory changes, supervisory authority decisions or developments in the Service. The version in force is always available within the Service and on the website, showing the date of last update. Material changes are notified to customers with reasonable prior notice.
Acknowledgement. This document is deemed to have been reviewed by the Customer when the Account owner ticks the relevant box, during registration for the Service or, for Customers already registered, in the management panel. The user identifier, document version, date and time, IP address and user agent are retained.
DevInterface srl — ConSergio.ai Privacy Policy — Version 2.1