Privacy Policy
This policy explains what personal data Lolla (“Lolla”, “we”, “us”) processes when you use the service, why, who we share it with, and the rights you and your guests have. Lolla is an AI front-desk used by businesses; for guest data, the business operating the workspace is the controller and Lolla is the processor acting on its instructions.
What we process
- Account data - your name, email, business name and type, role, and sign-in credentials (passwords are handled by our authentication provider, never stored in plaintext by us).
- Guest conversations - messages exchanged across your connected channels, including the message content and the language it was written in.
- Guest contacts - names and contact handles (email, phone, social or messaging identifiers) needed to recognise a guest and reply to them.
- Bookings & reservations - reservation details, dates, amounts and related notes synced from your property/channel systems.
- Usage & operational data - logs, approvals, agent runs and analytics that keep the service working and observable. We use essential cookies only to keep you signed in; we do not run third-party advertising or tracking.
How we use it
We process this data to provide the service: to bring conversations into one inbox, draft and (where you enable it) send replies, manage reservations and approvals, ground the AI in your knowledge, produce analytics, bill your subscription, and keep the platform secure. Connected integration credentials are encrypted at rest and used only to operate the channels you connect.
Sub-processors
To deliver the service we rely on a small set of trusted providers:
- Supabase - application database and hosting (stores your workspace data).
- Resend - transactional and notification email delivery.
- MiniMax and Anthropic - AI models that draft and translate replies and power the agents.
- Kashier - payment processing for your subscription (we never store card data).
Each sub-processor handles only the data needed for its function and under its own commitments. Guest message content may be sent to the AI providers above solely to generate a reply or translation.
AI processing
Replies and translations are generated by AI models. Relevant message content and your configured knowledge are sent to those models to produce a draft. AI output can be inaccurate, so a human reviews it before sending unless you have enabled autopilot for low-risk replies.
Retention
We keep workspace data for as long as your workspace is active. When you delete a workspace (Settings → Data & privacy), its conversations, messages, guests and reservations are permanently removed along with the workspace, and the subscription is cancelled. We may retain limited records (for example billing invoices) where the law requires it, and backups are purged on a rolling cycle.
Your data rights
Workspace owners can export all of their workspace data as a JSON bundle and permanently delete the workspace at any time from Settings → Data & privacy. For requests from individual guests (access, correction or deletion of their personal data), the business operating the workspace is responsible as the controller; we will support those requests on the controller’s instruction. To reach us about a data request, email support@lollaai.com.
Security
Data is isolated per workspace at the database level, integration secrets are encrypted at rest, and access is gated by role. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
International transfers
Our sub-processors may process data in regions outside your own. Where data is transferred internationally, we rely on the providers’ safeguards for such transfers.
Contact
Questions about this policy or your data? Email support@lollaai.com.