Last updated: 31 July 2026
Valiris SAS is an AI-powered guest communication platform for short-term rental operators. We are registered in France and act as the data controller for the personal data described in this policy.
For our full company registration details, see our Legal Notice.
When you submit your email address via the waitlist form on our website, we collect your email address. Nothing else. We use this solely to notify you when Valiris is available and to send you relevant pre-launch updates.
When you create a Valiris account, we collect your name, email address, company name, and billing information (processed securely via Stripe). We also collect data about how you use the platform to improve the product and provide support.
You can optionally upload a profile photo. It is entirely up to you: leave it empty and we show your initials instead. If you do upload one, it is visible to the other members of your organisation and to nobody else, and you can remove it at any time from Settings, which deletes it from your profile.
Valiris processes guest messages and booking information on behalf of operators. In this context, Valiris acts as a data processor, not a data controller. The operator is the data controller for their guests' personal data. We process this data solely to deliver the service the operator has configured.
Guests can also send messages to their host directly through their guest portal link; these messages are processed for the same purpose and in the same way as messages relayed by the booking platform or PMS.
If a guest adds the portal to their home screen, they can choose to turn on notifications. We then store the push endpoint their browser issues, its two device keys and their chosen language, against that booking. This identifies a device, not a person, and we use it only to tell them about their own stay: a reply from their host, something waiting on them, an extra confirmed, and the moment their access codes become available. We never send marketing notifications. The notification itself carries no stay details, no access codes and no message text, because it appears on a lock screen. The subscription is deleted when the portal closes (seven days after departure), as soon as the guest turns notifications off, and when their browser tells us the device is gone.
Our website includes a chat widget that lets you ask questions about Valiris. When you use it, the messages you type are sent to Anthropic, Inc. (a third-party sub-processor based in the United States) to generate AI responses. We do not store or retain the content of your chat messages after the session ends. Your IP address is temporarily used for rate limiting purposes during the session only and is not stored. The legal basis for this processing is legitimate interest: providing you with product information before you decide whether to sign up.
Anthropic processes data in accordance with its own privacy policy. By using the chat widget, you acknowledge that your messages will be processed by Anthropic as a sub-processor.
If, and only if, you accept cookies in the banner on valiris.io, we load Google Tag Manager and Google Analytics. Google then collects your IP address, device and browser information, the pages you view on our site, and whether you arrived from one of our ads. This serves three purposes: working out which advertising campaigns bring people to Valiris, understanding in aggregate how the site is used so we can improve it, and letting Google show you our ads again when you browse other sites. We do not receive your name or email address from Google, and we do not combine this data with your platform account. If you refuse, none of it happens: nothing is downloaded from Google and no cookie is set. See our Cookie Policy for the exact cookies and how to withdraw consent.
We collect anonymised usage data (page views, feature interactions) to understand how the product is used and improve it. This data cannot identify you personally.
Waitlist email
Legal basis: consent. You voluntarily submitted your email. You can withdraw consent and be removed from the list at any time by emailing us.
Platform account & billing
Legal basis: contract performance. We need this data to provide the service you signed up for.
Guest message data
Legal basis: contract performance. Processed strictly to deliver the AI communication service operators have configured.
Advertising, analytics and remarketing
Legal basis: consent. Nothing loads until you accept in the cookie banner, and you can withdraw at any time via "Cookie settings" in the footer. Refusing has no effect on your use of the site or the service.
We do not sell, rent, or trade your personal data. We share data only with the following third-party sub-processors, each of whom is bound by appropriate data protection agreements:
| Sub-processor | Purpose | Personal data | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All guest & operator data: messages, bookings, access codes, account data, KB documents | EU (Frankfurt, Germany) |
| Vercel | Website and application hosting | Guest messages & operator sessions in transit; visitor IP addresses in logs | United States |
| Stripe | Subscription payments and Extras payment links | Payment card details, billing information, guest name on Extras line items | United States |
| Anthropic | AI message generation | Guest message content; help-assistant queries; website chat messages | United States |
| OpenAI | Knowledge Base embeddings | Knowledge Base document text; guest question text | United States |
| Cohere | Search-result reranking | Guest question text; Knowledge Base document snippets | Canada |
| Resend | Transactional email | Operator/team email addresses; email body content | United States |
| Upstash | Rate limiting (abuse protection) | IP addresses and organisation IDs only, no message content | United States |
| Cloudflare | Bot protection on sign-up and login (Turnstile) | IP address and browser signals only, no message content | United States |
| Lodgify | PMS integration (user-initiated) | Guest names, guest messages, booking & property data | Spain |
| Guesty | PMS integration (user-initiated) | Guest names, guest messages, booking & property data, guest reviews | Israel / United States |
| Cal.com | Demo and onboarding call scheduling (optional) | Name, email address and booking time, sent to us to send a pre-call preparation email | United States |
| Google sign-in (optional) | Google account email and name at sign-in; encrypted push notification payload | United States |
Separately, if you accept cookies on this website, Google Ireland Limited receives your IP address, device and browsing information. Google's role differs by purpose: for Google Analytics it is our processor, handling that data on our instructions; for advertising and remarketing it is an independent data controller, deciding how it uses that data under its own privacy policy. This only ever happens with your consent, and never in the Valiris application itself.
Separately again, an operator can connect their own GetYourGuide partner account so their guests see tours and activities near the property on their booking portal. This is not a sub-processor arrangement: GetYourGuide is not processing anything on our instructions, and we send it no personal data. It is a third party the guest chooses to load, and it then acts as an independent data controller under its own privacy policy for the IP address, device signals and cookies it collects at that point. Nothing is requested from GetYourGuide until the guest taps to show the activities, having been told first what will be set and why (see our Cookie Policy). Any commission on a booking is paid by GetYourGuide to the operator, on the operator's own partner account; Valiris is not in that payment path and receives no data back.
If you or an operator enables browser push notifications, alerts are delivered through your browser's own push service: Google (Chrome, Edge, Android, via Firebase Cloud Messaging), Apple (Safari, iOS, via APNs), or Mozilla (Firefox), depending on the browser in use. Valiris holds no direct commercial relationship with these providers for push delivery; your browser's push subscription determines which one is used, and only an encrypted notification payload (title, body, and link) passes through it. When you set or reset a password, we check it against the Have I Been Pwned breached-password database using k-anonymity: only a truncated 5-character prefix of the password's hash is sent, never the password itself or a full hash.
Some of our sub-processors are companies established in the United States. Where personal data is transferred outside the European Economic Area, we rely on safeguards recognised under GDPR: the European Commission's Standard Contractual Clauses (SCCs) and, where the recipient participates, the EU-US Data Privacy Framework (DPF), together with supplementary technical and organisational measures.
For the full list of sub-processors and the transfer mechanism relied on for each, see our Data Processing Agreement.
Guest messages are processed by Anthropic's AI models to generate replies and to analyse sentiment and intent. Knowledge Base documents are converted into searchable embeddings by OpenAI, and search results are reranked by Cohere as part of the AI's retrieval pipeline.
Under these providers' API terms, data submitted via their API is not used to train their underlying models. The operator stays in control of what the AI can access and what it is allowed to share with guests, through the AI Configuration settings in the platform.
As a resident of the European Union, you have the following rights regarding your personal data:
To exercise any of these rights, email us at contact@valiris.io. We will respond within 30 days.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority: www.cnil.fr.
The Valiris application uses only essential and functional cookies required for basic functionality, such as keeping you logged in. Our public website additionally uses advertising measurement cookies from Google, but only after you accept them in the consent banner, and refusing takes a single click. See our Cookie Policy for the full list, the retention periods, and how to change your choice at any time.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we will notify active users by email or via a banner on the platform.
Continued use of Valiris after an update constitutes acceptance of the revised policy.
Questions about this policy?
We're a small team and we read every email. Reach out directly.
contact@valiris.io