Privacy Policy
Last updated: July 5, 2026
This Privacy Policy explains how Anana processes personal data in connection with our AI agent platform for hospitality (hotels, restaurants, wellness venues). It covers our website (getanana.com), our application (app.getanana.com), our API (api.getanana.com), and the messaging, voice, and booking workflows that Anana performs on behalf of our customers.
1. Controller
Omoc, Inc (doing business as Anana), 10 Montague Terrace, Apt 1B, Brooklyn, NY 11201, United States, is the controller for personal data processed about:
- Operator users (staff of our hospitality customers who log into Anana)
- Visitors to our websites
- Anana employees and applicants
- Anana's own business contacts (prospects, customers, suppliers)
For personal data of end guests and leads (people who chat with, call, SMS, or email a venue powered by Anana, or whose booking/profile data is synced from a Property Management System or CRM), our hospitality customer is the controller and Anana acts as their processor under a Data Processing Agreement. Where this policy describes guest data, it does so in our capacity as processor and for transparency only; the venue's own privacy notice governs that processing.
Contact: privacy@getanana.com
We have not appointed a Data Protection Officer; Art. 37 GDPR does not require us to do so. Privacy questions and rights requests are handled at privacy@getanana.com.
2. EU Representative (Art. 27 GDPR)
Anana is established in the United States. In accordance with Art. 27 GDPR, Anana has designated the following EU representative for matters relating to the processing of personal data of data subjects in the EU/EEA:
Probo Inc, 7 rue Commines, 75003 Paris, France — privacy@probo.com
EU/EEA data subjects and supervisory authorities may contact our EU representative directly on all issues related to processing for the purpose of ensuring compliance with the GDPR.
3. Data Subjects and Categories of Personal Data
3.1 Operator users (Art. 13)
When a staff member of a hospitality customer is provisioned an Anana account, we process:
- Identification and account data: name, work email, role, organization/tenant ID
- Authentication data: login identifiers, session tokens, MFA factors (via Stytch)
- Usage data: pages viewed, actions taken in the app, artifacts created/sent, IP address, device/user-agent
- Support communications: messages sent to support@getanana.com
3.2 End guests and leads (processed on behalf of our customers)
For transparency, the personal data Anana handles on behalf of venues includes:
- Inbound messages: chat widget conversations, inbound SMS, inbound email (content, sender identifiers, timestamps)
- Voice calls: audio recordings of WebRTC and SIP calls, machine-generated transcripts, call metadata (caller number, duration, routing)
- Booking and guest profile data synced from the venue's PMS/CRM: name, contact details, reservation details, stay history, and any fields the venue chooses to expose
- Embeddings: vector representations derived from messages and documents, used for retrieval; stored in pgvector
- Artifact metadata: messages sent, drafts, versions
Anana does not determine which guests to contact, which fields to ingest, or how long the venue retains guest records — the venue does. The guest should refer to the venue's privacy notice.
3.3 Website visitors
- Server logs (IP address, user-agent, timestamps, requested URL) processed by AWS and Vercel for security, abuse prevention, and basic operation.
- Cookies: our websites use cookies. The categories and purposes of cookies in use, and the controls available to you, are described in our separate Cookie Policy and managed via the cookie banner displayed on first visit.
3.4 Employees, applicants, and business contacts
We process standard HR data for employees/applicants and standard B2B contact data for prospects, customers, and suppliers. Employee processing is described in a separate internal notice.
4. Purposes and Legal Bases (GDPR Art. 6)
| Purpose | Data subjects | Lawful basis |
|---|---|---|
| Provide the Anana platform to operator users (accounts, authentication, app access, support) | Operator users | Art. 6(1)(b): performance of contract with the customer |
| Process guest messages, calls, bookings on behalf of the venue | End guests/leads | Processor: venue's lawful basis applies; Anana relies on Art. 28 |
| Generate AI responses, transcripts, summaries, and embeddings to operate the service | Operator users, end guests | Art. 6(1)(b) (operators); processor for guests |
| Security, fraud and abuse prevention, audit logging | All | Art. 6(1)(f): legitimate interest in securing the service |
| Service communications (incident notices, billing, product updates) | Operator users, customer admins | Art. 6(1)(b) and Art. 6(1)(f) |
| Marketing emails to prospects | Business contacts | Art. 6(1)(f): legitimate interest in B2B outreach; opt-out at any time |
| Compliance with legal obligations (tax, accounting, lawful requests) | All | Art. 6(1)(c) |
| Recruitment | Applicants | Art. 6(1)(b) pre-contract / Art. 6(1)(a) consent for retention |
Where we rely on legitimate interest, you have the right to object (see Section 10).
Special category data. Anana does not intentionally collect special category data (Art. 9). However, free-text guest messages and call content can incidentally contain health, dietary, or similar details, and the Practice Better integration can surface practitioner-client health records. Anana processes this data solely as a processor on the venue's behalf. The Art. 9(2)(a) explicit consent condition, and the notice to the individual, are the responsibility of the venue (controller); this obligation is allocated to the venue in our Data Processing Agreement.
5. Sources
- Operator user data: provided directly by the user or by their employer (the customer) when provisioning an account.
- Guest/lead data: received from the guest directly (when they message, call, or email the venue) or from the venue's PMS/CRM via integrations the venue has authorized.
- Website data: collected directly through your browser.
6. Retention
| Data category | Retention |
|---|---|
| Operator user account and authentication data | For the life of the customer contract; deleted within 1 year of contract termination. |
| Voice recordings | Retained per the venue's configuration and not used for model training; Anana-held copies are deleted on the venue's instruction or within 1 year of contract termination. |
| Voice transcripts | Retained per the venue's configuration as part of the conversation record; deleted with the associated tenant data on the venue's instruction or within 1 year of contract termination. |
| Inbound messages (chat, SMS, email) | Retained per the venue's configuration as part of the conversation record; deleted on the venue's instruction or within 1 year of contract termination. |
| Booking/guest profile data synced from PMS/CRM | Controlled by the venue; Anana deletes on the venue's instruction or contract end. |
| Embeddings in pgvector | Tied to the source artifact; deleted when the source is deleted. |
| Audit logs (artifact create / version / send) | 2 years. |
| Server logs / WAF logs | Application production logs 30 days; AWS CloudFront/WAF edge logs per their configuration. |
| Database backups | Daily backups retained 7 days on a rolling cycle. |
| Business contacts (CRM) | Until objection or 2 years of inactivity. |
| Accounting and tax records | As required by applicable law (typically 7–10 years). |
After the retention period, data is deleted or irreversibly anonymized. Retention of guest data (recordings, transcripts, messages, bookings) is ultimately set by the venue as controller; the periods above are Anana's own outer limits.
7. Recipients and Sub-processors
We share personal data only with vetted sub-processors under a DPA. An up-to-date list is available on request at privacy@getanana.com.
Infrastructure and platform
- Amazon Web Services (hosting, storage, KMS — eu-central-1 / Frankfurt)
- Vercel (frontend hosting)
- Stytch (authentication)
- Sentry (error monitoring)
AI / LLM providers
- OpenAI
- OpenRouter (Anthropic)
- Perplexity
- Google Gemini
Voice (speech-to-text and text-to-speech)
- Deepgram, Gladia, AssemblyAI, ElevenLabs, Cartesia, BlueJay
Communications
- Resend (transactional email)
- Twilio (SMS and voice)
- Surge (SMS and voice)
Document and web AI
- Firecrawl, Reducto, Google Places
Tenant-authenticated integrations (not Anana sub-processors)
When a venue connects Anana to its own systems (e.g., WebHotelier, Fidelio on-prem, Practice Better, Kanika, Genesys Cloud, HubSpot, Composio), the venue is the controller of that integration and the integration provider is the venue's processor, not ours. Anana acts as the venue's agent only.
Other recipients include our professional advisors (legal, accounting) and competent authorities where required by law.
8. International Transfers
Anana is established in the United States and our production data is stored in AWS eu-central-1 (Frankfurt). Several sub-processors listed in Section 7 process data in the United States or other third countries (notably OpenAI, OpenRouter, Perplexity, Google, Sentry, Vercel, Stytch, Twilio, Resend, AssemblyAI, Deepgram, Firecrawl, Reducto).
For transfers of EU/EEA personal data to the United States or other third countries we rely on:
- Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914, plus supplementary measures where required
- EU–U.S. Data Privacy Framework where the recipient is certified under it
- Transfer Impact Assessments documenting the level of protection and any supplementary measures
A copy of the SCCs and our TIAs is available on request at privacy@getanana.com.
9. Security
We apply the following measures:
- Encryption in transit: TLS everywhere; HTTPS-only externally.
- Encryption at rest: AES-256 via AWS KMS for AWS RDS Postgres 17.4 (including pgvector) and AWS S3 (recordings, attachments, exports). Application-level AES-256-GCM for integration credentials.
- Multi-tenant isolation: row-level tenant filter enforced in the application data layer.
- Network protection: AWS WAF with managed rules and rate limiting (2000 requests per 5 minutes).
- Webhook integrity: HMAC verification on inbound webhooks where the provider supports it.
- Access controls: multi-factor authentication, role-based access control, least-privilege provisioning.
- Audit logging: artifact lifecycle events (create, version bump, send) are recorded.
- Transient stores: Redis is used for sessions and queues; data there is short-lived.
10. Your Rights (GDPR)
Where Anana is the controller, you may exercise the following rights:
- Access (Art. 15): obtain a copy of your personal data.
- Rectification (Art. 16): correct inaccurate data.
- Erasure (Art. 17): request deletion.
- Restriction (Art. 18): limit processing.
- Portability (Art. 20): receive your data in a structured, machine-readable format where applicable.
- Object (Art. 21): object to processing based on legitimate interest, including direct marketing.
- Withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time, as easily as it was given, without affecting the lawfulness of processing carried out beforehand.
- Not be subject to solely automated decisions with legal or similarly significant effects (Art. 22). Anana generates suggested replies and drafts; final operator review is part of the workflow.
To exercise your rights, email privacy@getanana.com, or contact our EU representative at privacy@probo.com (Section 2). We respond within one month (extendable by two further months for complex requests, Art. 12(3)).
If you are an end guest and want to exercise rights against a venue, contact the venue directly — they are the controller. We will assist them under Art. 28(3)(e).
11. Supervisory Authority
You have the right to lodge a complaint with a data protection authority. As Anana is established outside the EU/EEA, EU/EEA data subjects may lodge a complaint with the supervisory authority of the EU/EEA member state where they reside, where they work, or where the alleged infringement occurred. You may also contact our EU representative (Section 2).
12. Children
Anana is a B2B service intended for hospitality businesses and their staff. It is not directed at children, and we do not knowingly collect personal data from children. Guests who interact with a venue's chat, SMS, voice, or email channel do so under that venue's own policies; venues are responsible for any age-specific obligations relating to their guests.
13. Changes to this Policy
We update this Policy when our processing changes. Material changes will be communicated to operator users via the application or by email. The “Last updated” date at the top reflects the most recent revision.
14. Contact
- Anana: privacy queries and rights requests: privacy@getanana.com
- EU representative: Probo Inc, 7 rue Commines, 75003 Paris, France — privacy@probo.com