Privacy policy

1. Controller

hantha GmbH, Dick 48/B, 39058 Sarntal (BZ), Italy · VAT IT03231400213 · info@geowatt.ai · PEC hantha@pec.bz.it

For data that hotels or agencies store in the tool about their staff and customers, the hotel or agency is the controller. geowatt processes such data as a processor (see Data Processing Agreement).

2. Visiting the website

Our servers process technically necessary data (IP address, time, page, browser) to deliver the site securely and prevent abuse. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted shortly.

For our own statistics we record events without cookies, using a shortened identifier that changes daily instead of the IP address.

3. Google Analytics (consent only)

Only if you agree in the banner do we load Google Analytics 4 on public pages. Google then sets cookies and processes usage data with a shortened IP address. Legal basis: Art. 6(1)(a) GDPR. You can withdraw consent at any time via “Cookie settings” in the footer.

We measure page views and website usage events, e.g. button clicks, scroll depth, started and completed checks or sign-ups. We never send names, email addresses, websites or free text, only categories and rounded values.

The tool (app.geowatt.ai) and shared reports do not use Google Analytics.

4. Free AI check

You enter your hotel's website. We read public information from that website and ask AI assistants. Optionally you leave your email address to receive the result. Legal basis: Art. 6(1)(b) GDPR (your request) or (a) (consent to contact). To prevent abuse we store a hash of your IP address.

5. Account and workspace

For an account we process email address, password (encrypted), name, position and optionally a profile picture. In the workspace we store hotel details, check results, tasks, comments, files and logs. Legal basis: Art. 6(1)(b) GDPR (contract).

If you sign in with Google, Google provides your name, email address and profile picture.

6. Shared links and reports

When you share a task or report via link, we count views and clicks without cookies so you can see whether it was read. Legal basis: Art. 6(1)(f) GDPR.

7. AI processing

geowatt sends questions about hotels and public hotel information to AI systems. We send no guest data and no account content that the function does not need. Under their terms, providers do not use these requests to train their models.

8. Processors

We use the following processors:

Lovable Labs Inc. (inkl. Supabase Inc., Cloudflare Inc.): Hosting, database, sign-in, file storage (EU/USA).

OpenAI (ChatGPT): AI queries about hotels (no guest data) (USA).

Google (Gemini): AI queries about hotels (no guest data) (USA/EU).

Anthropic (Claude): AI queries about hotels (no guest data) (USA).

Google Ireland Ltd. (Google Analytics): Website analytics, only after consent (EU/USA).

9. Transfers to third countries

Some processors are based in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR).

10. Retention

Check results are kept for 13 months so you can see trends. Account data is kept until you delete your account. Statutory retention duties (e.g. invoices) remain unaffected.

11. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR) and may withdraw consent. In the tool you can download your data and delete your account yourself (profile menu). Otherwise email info@geowatt.ai.

You may lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it).

12. Security

Connections are encrypted (HTTPS). Hotel data is strictly separated in the database: every query checks that you are a member of that hotel.