AI Concierge Privacy at Your Hotel, What to Ask Before You Start
November 11, 2026 · 4 min read · Mateo Bolívar
AI concierge privacy at your hotel is decided before you switch it on, with a few questions about what data it touches, who sees it, how long it is kept and how it is deleted. If the provider answers with documents rather than promises, you have a basis to decide.
This guide is a list of those questions, ordered so you can use it in a meeting with the provider and with whoever handles legal matters at the hotel. It is not legal advice.
Why AI concierge privacy is reviewed before, not after
An AI concierge talks with guests, and personal data shows up in a conversation even when nobody asks for it. A name, a room number, an allergy, a flight arrival time. If these questions are asked once the agent is already answering, any change is harder.
It also matters for your team. The front desk should know what the agent can and cannot say, and what to do if a guest asks what happens to their data.
What data the agent touches
Start with the inventory. Ask the provider, and write down the answer.
- What guest data the agent receives during a conversation.
- Whether the agent queries hotel systems, such as the PMS, and what data it brings from there.
- Whether the agent can take payments and how. In Contler's case, the website says payments are made with payment links that comply with PCI-DSS.
- What hotel data it uses to answer, such as hours, services and policies.
A practical rule is to ask only for what the task needs. If the agent answers the spa hours, it does not need to know anything about the guest.
Who sees the conversations
Conversations are read to review answers and to handle the cases that go to a person. That is fine, but you should know who can do it.
- Which hotel staff can see conversations and from where. At Contler, staff work from their own app on iOS and Android.
- Whether access can be limited by department or role.
- Whether provider staff can see conversations and in which cases.
- Which other providers take part in the service, for example to understand voice or generate answers.
How long they are kept and how they are deleted
This part is usually left for later, and it is the one that raises the most doubts.
- How long conversations and associated data are kept.
- Whether the hotel can ask for a specific guest's conversation to be deleted, and how that is confirmed.
- What happens to the data if the hotel stops using the service.
- Where the data is stored. If location matters for your hotel, ask for the answer in writing.
What ISO 27001 means and what it does not
Contler holds ISO 27001 certification for information security. It is a standard about how an organization manages information security, with controls and reviews.
It is worth reading precisely. ISO 27001 does not by itself prove that your hotel's use of the agent complies with every data protection law that applies to you, it does not say where the data is, and it does not remove every risk. It is a good signal about how the provider works, and your questions are still necessary.
What to tell the guest
The guest should know they are talking to an agent and how to ask for a person. The hotel's privacy policy should also mention the service.
Illustrative example. A guest writes that they have an allergy and asks whether the restaurant can prepare something special. The agent should not decide that. Ideally it passes the case to a person in the restaurant, and that conversation is not visible to departments that do not need it.
If you want to go beyond privacy and look at what guests think about AI, I wrote about that in this article on guest trust.
Frequently asked questions
Does ISO 27001 certification mean I already comply with the law?
Not by itself. It covers how the provider manages information security. Your hotel's compliance also depends on how you use the service and on the laws that apply to you.
Should I tell guests they are talking to an AI?
I recommend always doing it and keeping it visible how to ask for a person.
Who at the hotel should review these questions?
Whoever is responsible for guest service and whoever handles legal or data protection matters.
What you can do this week
Copy the questions in this guide into a document, add one column for the answer and another for the document that backs it, and bring them to your next conversation with the provider. If you want to see how the agent works with your hotel's information in the meantime, you can create it and review it with your team before opening it to guests.
