Privacy policy
Last updated: 14 October 2026
AskWhisper is a brand name of Amodamo BV, Krekelstraat 95, 2660 Hoboken, Antwerp, Belgium — VAT BE0797.635.552.
This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Who We Are
AskWhisper is a brand name of Amodamo BV, a company incorporated under Belgian law (VAT BE0797.635.552), with its registered office at Krekelstraat 95, 2660 Hoboken, Antwerp, Belgium.
We operate a hospitality technology platform that enables hotels, aparthotels, B&Bs, and other accommodation providers to automate and personalise guest communications — including check-in, digital key delivery, upselling, and messaging via WhatsApp.
In GDPR terms, Amodamo BV acts as a data controller with respect to the personal data of our platform users (hotel staff and administrators), and as a data processor with respect to the personal data of end guests — which is processed on behalf of our hotel clients who are themselves data controllers for their guests.
2. Data We Collect
Platform Users (Hotel Staff and Administrators)
When you create an account or use our platform, we may collect the following categories of personal data:
- Your name and job title
- Your email address and phone number
- Your username and hashed password
- Technical usage data such as your IP address, browser type, pages visited, and session duration
- Any correspondence you send us, such as support requests
Guest Data (Processed on Behalf of Hotel Clients)
When our platform processes data on behalf of a hotel client, that hotel is the data controller for their guests' personal data. We process this data only as instructed by the hotel, under a separate Data Processing Agreement (DPA). Typical categories include:
- Guest names and contact details
- Reservation information
- WhatsApp message history between the hotel and the guest
If you are a hotel guest who has received a message through our platform, the hotel is responsible for the lawful basis of that communication. Please contact the hotel directly for questions about your booking data.
Website Visitors
If you visit askwhisper.com, request a demo, or sign up for a waitlist or a webinar, section 3 describes exactly what we collect, why, and for how long.
3. Our Website: Visitors and Demo Requests
This section covers askwhisper.com itself: what happens when you read it, what the cookie banner controls, and what we do with a demo request, a waitlist signup or a webinar signup. Amodamo BV is the data controller for all of it.
Your cookie choice
On your first visit a banner asks what you allow. Apart from the strictly necessary storage described below, there are two optional categories. Both are off until you switch them on:
- Analytics: our own detailed measurement, Google Analytics 4 and PromptWatch.
- Marketing: the Meta Pixel.
Nothing in either category loads before you allow it. Your choice is kept in your browser's local storage as a small record holding your two choices, a version number and the time you decided. When what a category covers changes, we raise the version and ask you again.
You can change or withdraw your choice at any time with the Cookie settings link in the footer of every page. Withdrawing takes the same one click as agreeing. When you withdraw analytics, the visitor and session identifiers described below are deleted from your browser straight away, and Google Analytics and the Meta Pixel are told to stop setting cookies. Cookies those providers had already placed stay in your browser until they expire or you delete them in your browser settings.
We also record that a choice was made (accept all, reject all or a custom mix), without any identifier, so we can see how many visitors decline without knowing who they are.
Google Consent Mode
Google Analytics only loads once you have allowed analytics. When it loads, it is first told that every Google consent signal is denied and is then given your actual choice: analytics storage follows your Analytics choice, and the advertising signals (ad storage, ad user data and ad personalisation) follow your Marketing choice. If you later change your mind through Cookie settings, the new choice is passed on straight away.
What we measure for every visitor, without identifiers
Whatever you choose, our own analytics records a small set of events that carry no identifier: that a page was viewed, how fast it loaded and responded for you (Core Web Vitals: loading time, responsiveness and layout stability), that a page address could not be found, and the cookie decision described above. Each event is stored with the page address, the time, your country and your device type (mobile, tablet or desktop). Your country comes from a header our hosting provider adds to every request; your browser's user-agent string is read to work out the device type and then discarded. We never store your IP address. Nothing is written to your device for these events, so they cannot be linked to each other or to you.
What we measure only with your Analytics consent
- Our own analytics. We give your browser a random visitor identifier, kept in local storage for 12 months after your last visit, and a session identifier that expires after 30 minutes without activity. With them we record which pages and sections you view, how long a section is on screen while the tab is visible, how far you scroll and what you click. Once per visit we also record the referring website, any campaign tags in the link you arrived through (utm parameters), your landing page, language, screen size and time zone, and the country, device type, browser and operating-system family worked out as described above. We do not record anything you type.
- Google Analytics 4 (Google Ireland Limited / Google LLC) places cookies to measure visits and where they come from.
- PromptWatch loads its visitor-analytics script, which measures visits to our website.
What runs only with your Marketing consent
The Meta Pixel (Meta Platforms Ireland Limited) places cookies so we can measure whether our advertising on Meta's platforms leads to visits and sign-ups. It does not load at all without this consent, including for visitors who have JavaScript turned off.
When you complete a demo request, a waitlist signup or a webinar signup, we tell Google Analytics and the Meta Pixel that a conversion happened and which button or list produced it, but only if you allowed the matching category. We never pass them your name, email address or phone number.
Requesting a demo
The demo request form asks for your property, what you most want to improve, your name, your email address and your phone number. It also carries anything you typed into a prompt box on the page before opening the form.
We save the form while you fill it in, before you press submit. A moment after you stop typing, when you move between steps and when you leave the page, whatever you have entered so far is saved to our database as an unfinished request. That includes a name, email address or phone number you have typed but not yet submitted. If you close the form halfway, the unfinished request stays. We do this to see where the form is hard to finish, and so a colleague can follow up with you one-to-one about the request you started. We never use those details for bulk mailing. If you would like an unfinished request deleted, email info@askwhisper.com.
With each request we also store the page you opened the form from, which button opened it, your language, your country (from the request header, not from your IP address) and where your visit came from: the campaign tags in the link you arrived through (utm parameters), an advertising click identifier if the link carried one (Google's gclid or Meta's fbclid), the referring website and the first page you landed on. That source is noted in your browser's session storage on the first page of your visit, stays there until you close the tab, and only reaches us inside a demo request. It is stored with the request whatever your cookie choice, because you are sending us the request on purpose. If you allowed analytics, the request is also linked to your analytics session, so we can see the path that led to it.
Partner introductions. If you open the form from a page a partner of ours sent you (askwhisper.com/intro), we also store who introduced you, as the link names them: the partner's name, the first name of the person there who sent it, and the link's reference code. We use it to know who introduced you and to credit that partner for the introduction. It is stored with your request whatever your cookie choice, and it is never sent to an analytics tool or to Google or Meta.
We also record how the form is used: which step you reach, which fields you enter and leave and how long that takes, whether an entry was valid, how many characters it had, and whether you went back. These form events never contain the characters you type. They are sent whatever your cookie choice and carry your analytics identifiers only if you allowed analytics.
Property search. When you type your property's name, our server sends what you typed and your language to Google Places (Google LLC) to suggest matching accommodation, and then fetches the address, location, website and a photo of the place you pick. These requests go from our server, not from your browser, so Google does not receive your IP address or its cookies through them. You can also type the name without picking a suggestion.
Phone number. To pre-select your country's dialling code, our server reads your country from the request header. It is not stored.
Emails. When you submit, your request is emailed to our sales team with your email address as the reply-to address, and we send a confirmation to the address you gave. Both are sent through Resend (Plus Five Five Inc).
Legal basis. For a submitted request: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). For unfinished requests, form usage, the visit source and the identifier-free measurement above: our legitimate interests (Article 6(1)(f) GDPR) in answering demo requests, following up requests that were started, knowing which of our campaigns produce them, and keeping the website working and fast. For the analytics and marketing tools: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time through Cookie settings.
Waitlists and webinars
Some articles let you join a waitlist with your name, your property, your email address and, if you like, your phone number. The signup is emailed to our team through Resend. Webinar signups take your email address, which we email to our team through Resend, register with Zoom (Zoom Video Communications Inc) so Zoom can send you the join link, and use to send you a confirmation through Resend. Legal basis: steps taken at your request (Article 6(1)(b) GDPR).
Embedded videos
The videos on our campaign pages, from Wistia and Tella, are click-to-play: nothing loads from those providers until you press play. Once you do, the provider's own privacy policy applies to its player.
Sound on the partner introduction page
The page at askwhisper.com/intro can play sound. Whether you turned it on or off is kept in your browser's local storage (aw_intro_sound), holding only "on" or "off". It never leaves your browser and is kept whatever your cookie choice, because it only remembers a setting you chose.
Hosting and storage
The website runs on Vercel (Vercel Inc), which receives every request to the site in order to serve it. Analytics events, demo requests and the personalised-link records described in section 12 are stored in a Postgres database run by Neon in its EU region in Frankfurt, Germany.
How long website data is kept
| Data | Where | Kept for |
|---|---|---|
| Your cookie choice | Your browser | Until you change it or clear your browser's storage. We ask again when what a category covers changes. |
| Analytics visitor identifier | Your browser | 12 months after your last visit, or until you withdraw analytics consent. |
| Analytics session identifier | Your browser | 30 minutes without activity, or until you withdraw analytics consent. |
| Sound setting on askwhisper.com/intro | Your browser (local storage) | Until you change it or clear your browser's storage. |
| Visit source and demo-form reference | Your browser (session storage) | Until you close the tab. |
| Demo requests, submitted or unfinished, with their visit source and any partner introduction | Our database | As long as we are in conversation with you about AskWhisper. If you become a customer, the request becomes part of that customer relationship. If you don't, we delete it once there is no realistic prospect of the conversation continuing, or straight away when you ask. |
| Personalised-link reading records (section 12) | Our database | As long as we are in conversation with you about AskWhisper, or until you ask us to delete them. |
| Analytics events | Our database | As long as we need them to compare how the website performs from one period to the next, and no longer. |
| Google Analytics data | The data-retention period set in our Google Analytics property. | |
| Meta Pixel data | Meta | As set out in Meta's own privacy policy. |
4. Legal Bases and Purposes
Under GDPR, we must have a valid legal basis for every processing activity. The following sets out our purposes and the legal basis for each.
Contract performance (Article 6(1)(b) GDPR): We process account and contact data to create and manage your account, to deliver platform features, and to send transactional communications such as confirmations and security alerts.
Legitimate interests (Article 6(1)(f) GDPR): We analyse aggregated usage data to improve and develop our platform. We also process data for fraud prevention and platform security. These interests do not override your privacy rights.
Consent (Article 6(1)(a) GDPR): We load analytics and marketing tools on our website only when you allow them in the cookie banner, and you can withdraw that consent at any time through the Cookie settings link in the footer. See section 3.
Legal obligation (Article 6(1)(c) GDPR): We retain financial and billing records to comply with Belgian accounting law.
Marketing communications: We send newsletters and marketing communications on one of two bases: either because we have a legitimate interest arising from a previous business interaction with you (every communication includes a clear and easy opt-out); or because you have given us your explicit consent, which you may withdraw at any time by clicking the unsubscribe link in any email or by contacting us at info@askwhisper.com.
5. WhatsApp and Meta Integration
A core feature of our platform is the ability to send WhatsApp messages on behalf of hotel clients, using Meta's Business Messaging API.
To enable this feature, we access:
- The WhatsApp Business Account connected by the hotel client
- The phone numbers of guests as provided by the hotel
- Message content as composed or templated by the hotel and/or our platform
We do not store your WhatsApp credentials. We do not use guest WhatsApp data for our own marketing purposes. We do not sell or rent WhatsApp message data to any third party.
We do store message logs for operational and support purposes. At present these are retained indefinitely. We are reviewing this practice and intend to introduce a defined retention limit in the near future. If you wish to request deletion of message data relating to you, please contact us at info@askwhisper.com.
Messages sent via WhatsApp are also subject to Meta's own privacy policy and terms of service. We recommend reviewing WhatsApp's Privacy Policy directly.
6. Google User Data and Limited Use
Some features of our platform connect to Google services (such as Gmail or Google Workspace) through Google APIs, with your explicit authorisation, to send and manage guest emails on your behalf.
Limited Use Compliance Statement: AskWhisper's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
In practice this means that we only use Google user data to provide and improve the features you have enabled, we do not sell it, we do not use it for advertising, and we do not allow humans to read it except with your consent, for security purposes, to comply with the law, or where the data has been aggregated and anonymised for internal operations. We do not use any data obtained through Google Workspace APIs to develop, improve or train generalised AI or machine-learning models.
7. Who We Share Data With
We do not sell personal data. We share it only in the following circumstances.
Sub-processors
We use a limited number of trusted third-party service providers to operate our platform. All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security standards.
| Sub-processor | Purpose | Location | Transfer Safeguards |
|---|---|---|---|
| Onfact (Infinwebs BV) | Invoicing and billing | Belgium (EEA) | N/A — within EEA |
| Attio (Attio Limited) | CRM | United Kingdom | EU adequacy decision for UK |
| MongoDB Atlas (MongoDB Inc) | Primary database platform (EU region cluster) | United States | Standard Contractual Clauses (GDPR Art. 46) |
| Resend (Plus Five Five Inc) | Transactional email delivery | United States | Standard Contractual Clauses (DPA) |
| Google Analytics (Google Ireland / Google LLC) | Website analytics | United States | EU-US Data Privacy Framework + SCCs |
| Meta Pixel (Meta Platforms Ireland Limited) | Marketing: measuring the performance of our advertising | Ireland / United States | Standard Contractual Clauses (GDPR Art. 46) |
The providers that run on our website, including Vercel (hosting), Neon (the website's database), Google Places (property search), PromptWatch and Zoom (webinar registration), are described in section 3.
Meta (WhatsApp Business API)
Guest phone numbers and message content are transmitted to Meta Platforms Ireland Limited for delivery via WhatsApp. This is a necessary part of the WhatsApp integration feature.
Hotel Clients
Guest data processed through the platform is shared with the relevant hotel client as the data controller. Platform user data (hotel staff accounts) is not shared with other hotel clients.
Legal Disclosures
We may disclose personal data to competent authorities such as courts, regulators, or law enforcement when required by applicable law, a binding legal order, or to protect our legitimate legal interests.
Business Transfers
In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.
8. International Transfers
Our primary database is stored on servers within a European region. However, some sub-processors are located outside the EEA. Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place as required by GDPR Chapter V.
The database behind our website (analytics events, demo requests and personalised-link records) is hosted by Neon in its EU region in Frankfurt, Germany.
For transfers to the United Kingdom, we rely on the European Commission's adequacy decision.
For transfers to the United States (Resend, MongoDB Inc, Google LLC), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. Where applicable, we also rely on the EU-US Data Privacy Framework adequacy decision.
9. How Long We Keep Data
We retain personal data only for as long as necessary for the purposes described in this policy, or as required by applicable law. Financial and billing records are retained for seven years in accordance with Belgian accounting law. How long we keep data from our website, including demo requests and analytics, is set out in section 3.
You have the right to request the deletion of any personal data we hold about you at any time. Please contact us at info@askwhisper.com to make such a request. We will respond within one calendar month and will delete or anonymise your data unless we are required by law to retain it.
10. Security
We implement technical and organisational measures appropriate to the risk, including:
- Encryption of data in transit (TLS) and at rest
- Access controls and role-based permissions
- Regular security reviews
- Staff training on data protection
- Incident response procedures
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority (GBA / APD) within 72 hours and will notify affected individuals without undue delay where required by GDPR.
Full details of our security measures are available in our Security Policy.
No method of internet transmission or electronic storage is 100% secure. We encourage users to use strong, unique passwords and to contact us immediately if they suspect any unauthorised access to their account.
11. Your Rights
Under the GDPR, you have the following rights with respect to your personal data. To exercise any of these rights, please contact us at info@askwhisper.com. We will respond within one calendar month.
- Right of access: You can request a copy of the personal data we hold about you.
- Right to rectification: You can ask us to correct inaccurate or incomplete personal data.
- Right to erasure: You can ask us to delete your personal data where there is no compelling reason for us to continue processing it.
- Right to data portability: You can request your data in a structured, machine-readable format to transfer to another service, where processing is based on consent or contract.
- Right to restriction: You can ask us to pause processing of your data in certain circumstances, for example while we verify its accuracy.
- Right to object: Where we process data on the basis of legitimate interests, you have the right to object. We will stop unless we have compelling legitimate grounds that override your interests.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Right to complain: You have the right to lodge a complaint with the Belgian Data Protection Authority (GBA / APD) at dataprotectionauthority.be, by email at contact@apd-gba.be, or by post at Rue de la Presse 35, 1000 Brussels, Belgium.
We will not charge a fee for exercising your rights unless the request is manifestly unfounded or excessive.
If your request relates to data held by a hotel (for example your booking record), please contact the hotel directly, as they are the data controller for that data.
12. Personalised Links We Send You
We sometimes send a named business contact a link to a personalised page on our website — by email, by post, or handed over at an event. Those pages are askwhisper.com/story and askwhisper.com/problems, and the link may carry your first name, your property's name, the colleague who sent it, a reference code, and your number of rooms in the web address.
When the link names you, by carrying a reference code, your first name or your property's name, we record how the page was read: which sections you reached, how long you spent on them, whether you used the page's calculator and the figure you set, and whether you followed a link. We attribute that to the recipient the link was sent to. We do this whether or not you have accepted analytics cookies, because it is not audience measurement: it is our own record of a business conversation we started with you.
If you open askwhisper.com/story or askwhisper.com/problems without those details in the link, the page is measured like any other page on our website and follows your cookie choice, as described in section 3.
Legal basis: legitimate interests (Article 6(1)(f) GDPR) in business-to-business direct marketing, and in knowing whether the material we send is any use. We do not record your IP address, we do not use this data to build a profile of you beyond that one page, and no other page on our website behaves this way.
If you would rather we did not, email info@askwhisper.com and we will delete the record and stop sending you personalised links. You have the same rights over this data as over any other personal data we hold — see section 11 above.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page with a revised "Last Updated" date and notify platform users by email or in-platform notification at least 14 days before changes take effect.
Your continued use of the platform after the effective date constitutes acknowledgement of the updated policy.
14. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:
AskWhisper / Amodamo BV
Krekelstraat 95, 2660 Hoboken, Antwerp, Belgium
VAT: BE0797.635.552
Email: info@askwhisper.com
You also have the right to contact the Belgian supervisory authority directly:
Gegevensbeschermingsautoriteit (GBA / APD)
Rue de la Presse 35, 1000 Brussels, Belgium
Website: dataprotectionauthority.be
Email: contact@apd-gba.be