❋
Privacy Policy:
Jasper
In-Room Concierge
Version: 1.0
Effective date: 10 June 2026
Last reviewed: 10 June 2026
CONTENTS
Who we are
What Jasper is and how it works
The WhatsApp pairing feature
What personal data we collect and why
Our lawful basis for processing
How we share your data
International data transfers
How long we keep your data
How we protect your data
Your rights under UK data protection law
Children
Changes to this policy
Contact us
SECTION 1
Who we are
This Privacy Policy is published by Nevertheless AI Ltd ("NtL", "we", "us", "our"), a company incorporated in England and Wales. NtL is the developer of the Jasper in-room concierge platform.
NtL is the data controller for the personal data described in this policy. This means we determine the purposes for which your personal data is processed and are responsible for it under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
The hotel that has deployed Jasper in your room ("the Hotel") is an independent data controller for its own processing of your personal data — for example, your booking information. Each controller's use of your data is governed by their own privacy notice.
SECTION 2
What Jasper is and how it works
Jasper is a voice-activated, privacy-first in-room concierge device. It enables hotel guests to make service requests, ask questions about the hotel, and access information about the local area — by speaking naturally, without lifting a phone.
Jasper is designed with privacy at its core. The following are the default operating conditions for every Jasper device in normal, business-as-usual use:
On-device voice processing. Your voice is captured and processed entirely on the Jasper device in your room. Voice audio is not transmitted over the internet.
No stored audio. No audio recording is retained beyond the instant your spoken request is processed. Audio is converted to a text transcript in local memory and immediately discarded.
No persistent transcripts. Text transcripts of your requests are held only in the device's temporary memory for as long as your session is active. They are automatically deleted when your session ends and, at the latest, when you check out.
No personal identity on the platform. The data sent from the device to NtL's platform does not include your name, contact details, voice, or any information that would allow NtL to identify you individually.
When you make a request, Jasper sends a limited, non-identifiable record to NtL's secure platform so that the request can be fulfilled and the hotel can act on it. This record contains:
The device's unique product code and the room number (not your name or identity)
The date and time of the interaction
A summary of the request category (for example: "room service request" or "information query")
The outcome of the request (for example: "forwarded to housekeeping")
Your identity is not included in any of this data. NtL cannot identify you from it.
SECTION 3
The WhatsApp pairing feature
Some of what you might ask Jasper — for example, a restaurant menu, a booking confirmation, or a detailed excursion itinerary — is more useful when you can read it at your own pace on your own device, rather than having it read aloud in the room. For requests like these, Jasper may offer you the option to receive the information via WhatsApp.
Pairing is entirely optional and always requires your active consent. Jasper will never send messages to your WhatsApp without you first initiating the pairing yourself.
How pairing works
Jasper indicates that a richer response is available via WhatsApp.
You choose to initiate pairing by sending a message from your personal WhatsApp account to the Jasper WhatsApp Business number displayed on the device or in accompanying materials. Sending this message is your opt-in.
Once you send that message, your WhatsApp identifier (which may include your phone number) is received by NtL's platform and temporarily associated with your stay so that Jasper can send you messages for the duration of your stay.
After you check out, your WhatsApp identifier is permanently deleted from NtL's systems. No messages will be sent to you after check-out.
What Jasper will and will not send you via WhatsApp.
Jasper uses WhatsApp only to send you information you have explicitly requested during your stay — for example, a menu, a booking confirmation, or travel information. Jasper will never send you promotional or marketing messages via WhatsApp, either during or after your stay, and will never share your WhatsApp contact details with any third party for marketing purposes.
Stopping WhatsApp messages
You can opt out of WhatsApp messages from Jasper at any time by:
Replying STOP to any Jasper WhatsApp message
Blocking the Jasper WhatsApp Business number in your WhatsApp settings
Asking hotel staff to disable your pairing
Any opt-out request is processed immediately. No further messages will be sent.
WhatsApp as a communications channel
Jasper uses the WhatsApp Business Platform (Cloud API), provided by Meta Platforms, Inc. ("Meta"). When you pair your WhatsApp account with Jasper, Meta processes the messages sent between the Jasper platform and your WhatsApp account in its capacity as a data processor acting on NtL's instructions. NtL and Meta have entered into a Data Processing Agreement under which Meta is bound to process your data only for the purpose of delivering those messages.
Meta's own privacy policy for the WhatsApp Business service is available at www.whatsapp.com/legal/privacy-policy.
SECTION 4
What personal data we collect and why
The table below sets out the personal data NtL processes, the source of that data, and the purposes for which it is used.
Purpose
Data
Source
Processed on-device to convert speech to text. Not transmitted. Discarded immediately after conversion. Not stored.
Voice input (audio)
Your spoken requests
Captured on the Jasper device when you speak to it
Held in device memory during the session to enable Jasper to understand and respond to your requests in context. Deleted at end of session or check-out.
Session transcript
Text representation of your requests
Generated on-device from your voice input
Sent to NtL's platform to enable fulfilment of your request and allow the hotel to action it. Does not identify you.
Interaction record
Device ID, room number, timestamp, request category, outcome
Generated automatically when you make a request
Used solely to send you information you have explicitly requested via WhatsApp during your stay. Permanently deleted at check-out. Never used for marketing.
WhatsApp identifier (wa_id)
Typically your phone number
Received when you voluntarily initiate a pairing by messaging the Jasper WhatsApp Business number
Delivered to your WhatsApp account via the WhatsApp Business Platform. Content is end-to-end encrypted in transit. NtL does not retain message content after delivery.
WhatsApp message content
The content of messages sent to your WhatsApp
Generated by Jasper in response to your requests (e.g., a menu, a booking confirmation)
Data we do not collect
NtL does not collect or process the following through Jasper:
Your name, email address, passport, or any direct identifying information
Payment card or financial account details
Special category data (health, religion, ethnicity, biometrics, and so on) — Jasper's design actively prevents this category of data from being processed or retained
Your booking details — these remain with the Hotel and are not accessible to NtL
Any data from your device, browser, or WhatsApp account beyond what you explicitly send to the Jasper WhatsApp Business number
SECTION 5
Our lawful basis for processing
Under UK GDPR Article 6, NtL relies on the following lawful bases:
Explanation
Processing activity
Lawful basis
NtL has a legitimate interest in operating Jasper as an effective in-room concierge service. Processing voice on-device to fulfil your requests is the core function of the product. This processing is minimal, does not leave the device, and does not identify you.
On-device voice processing and session transcripts
Legitimate interests
Article 6(1)(f)
NtL and the Hotel have a legitimate interest in logging service requests for operational fulfilment, quality monitoring, and audit purposes. These records do not identify you.
Interaction records sent to NtL's platform
Legitimate interests
Article 6(1)(f)
You provide consent when you choose to initiate pairing by sending a message to the Jasper WhatsApp Business number. Pairing is voluntary. You may withdraw consent at any time by replying STOP or blocking the number, with immediate effect.
WhatsApp identifier and message delivery
Consent
Article 6(1)(a)
A Legitimate Interests Assessment (LIA) has been completed for the processing activities relying on legitimate interests. A copy is available on request by contacting contact@neverthelessai.io.
SECTION 6
How we share your data
NtL does not sell your personal data to any third party. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.
The Hotel
The Hotel receives non-identifiable interaction records (room number, request category, and outcome) so that its staff can fulfil your requests — for example, sending housekeeping to your room or confirming a spa booking. The Hotel does not receive your voice data, WhatsApp details, or session transcripts.
Meta Platforms, Inc. (WhatsApp Business Platform)
When you choose to pair your WhatsApp account, your WhatsApp identifier and the content of messages sent to you pass through Meta's WhatsApp Business Platform (Cloud API). Meta acts as a data processor on NtL's behalf, bound by a Data Processing Agreement. Meta does not use business conversation data processed through the Cloud API to train consumer AI models or to serve you advertisements.
Meta is headquartered in the United States. See Section 7 for how this international transfer is safeguarded.
Cloud infrastructure and workflow providers
NtL uses a small number of third-party service providers to operate its platform. Each acts as a data processor under a written Data Processing Agreement and processes data only on NtL's instructions:
Amazon Web Services EMEA SARL (AWS) — cloud hosting for the Jasper platform. Primary data location: UK (London region).
Supabase, Inc. — database services for operational platform data. UK Addendum to EU Standard Contractual Clauses in place.
N8N GmbH — workflow automation (for example, routing service requests to hotel staff). Headquartered in Germany; adequacy transfer.
Salesforce UK Limited — internal business operations. UK entity; no restricted transfer.
None of these providers have access to raw voice audio, session transcripts, or your WhatsApp message content beyond what is necessary for the technical delivery of those services.
Legal disclosure
NtL may disclose personal data where required to do so by law, regulation, court order, or to comply with a lawful request from a competent authority. We will notify you of any such disclosure unless prohibited from doing so.
SECTION 7
International Data Transfers
NtL is a UK-based company and processes most data within the UK. Where data is transferred to countries outside the UK that have not been granted adequacy status by the UK Government, NtL ensures appropriate safeguards are in place.
Transfer mechanism
Recipient / location
WhatsApp Business UK Data Transfer Addendum, incorporating the UK International Data Transfer Agreement (IDTA). Supplemented by a Transfer Risk Assessment.
Meta Platforms, Inc. (USA)
UK Addendum to EU Standard Contractual Clauses (SCCs), supplemented by a Transfer Risk Assessment.
Supabase, Inc. (USA)
Contract with the EU entity of AWS; adequacy applies. AWS is also certified to the UK Extension to the EU–US Data Privacy Framework.
AWS EMEA SARL (primary: UK region)
Adequacy — Germany is within the EEA.
N8N GmbH (Germany)
SECTION 8
How long we keep your data
Retention period
Data type
Not retained. Discarded on-device immediately after speech-to-text conversion.
Voice audio
Held in device memory for the duration of the active session only. Deleted automatically at end of session or check-out.
Session transcripts
Retained for operational and audit purposes for a period proportionate to the service relationship with the Hotel. Non-identifiable.
Platform interaction records (room number, category, timestamp, outcome)
Retained for the duration of your stay only. Permanently deleted upon check-out.
WhatsApp identifier
(wa_id)
Not retained by NtL after delivery. Subject to WhatsApp's own 30-day cloud storage policy within Meta's infrastructure.
WhatsApp message content
SECTION 9
How we protect your data
NtL implements technical and organisational measures appropriate to the nature of the data and the risks involved. Key measures include:
On-device processing. Voice audio never leaves the Jasper device. The device uses a small language model (SLM) to process requests locally, with no dependency on external AI services for core voice processing.
Encryption in transit. All data sent from the Jasper device to NtL's platform is encrypted in transit. Communication between the device and NtL's infrastructure uses mutual TLS certificates, meaning only authenticated Jasper devices can connect.
Encryption at rest. Data stored on NtL's platform is encrypted at rest.
Access controls. Access to platform data is restricted to authorised NtL personnel only, using role-based access controls and multi-factor authentication where applicable.
End-to-end encryption for WhatsApp messages. Messages delivered via the WhatsApp Business Platform are protected by WhatsApp's Signal Protocol encryption during transit.
Data minimisation by design. Jasper's architecture is designed to collect and transmit the minimum data necessary to fulfil each request. Guest identity is excluded from the platform data model by design.
In the event of a personal data breach, NtL will notify affected individuals and the Information Commissioner's Office (ICO) in accordance with its obligations under UK GDPR Article 33 and 34.
SECTION 10
How we protect your data
As a data subject, you have the following rights in relation to personal data NtL holds about you:
Right of access. You may request a copy of the personal data NtL holds about you.
Right to rectification. You may request that inaccurate data is corrected.
Right to erasure. You may request deletion of your personal data, subject to any applicable legal obligations that require NtL to retain it.
Right to restrict processing. You may ask NtL to restrict how it uses your data in certain circumstances.
Right to object. Where NtL processes your data on the basis of legitimate interests, you have the right to object. NtL will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
Right to withdraw consent. Where processing is based on consent (WhatsApp pairing), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent for WhatsApp messages, reply STOP to any Jasper WhatsApp message or block the Jasper WhatsApp Business number.
Right to data portability. Where applicable, you may request your data in a portable, machine-readable format.
Please note. Because Jasper is designed to process data without retaining information that identifies you individually, NtL may hold little or no data attributable to you specifically. Where data is linked to a room number rather than a named guest, NtL may require the Hotel's assistance to verify your identity before responding to a subject access request.
To exercise any of these rights, please contact NtL at contact@neverthelessai.io. We will respond within one calendar month.
If you are unhappy with how NtL has handled your personal data or your rights request, you have the right to lodge a complaint with the UK data protection regulator:
Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Helpline: 0303 123 1113
SECTION 11
Children
Jasper is deployed in hotel rooms and is intended for use by adults. Children under the age of 18 may be present in hotel rooms, but a Jasper device will only be present in a room where an adult guest has checked in and has had the opportunity to read this policy. Parents and guardians are responsible for supervising children's interactions with Jasper.
NtL does not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data through Jasper, please contact us at contact@neverthelessai.io and we will take steps to delete it.
SECTION 12
Changes to this policy
NtL may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Where a change is material, NtL will take reasonable steps to bring the updated policy to the attention of hotel partners so that guests can be informed. The effective date at the top of this document will always reflect the most current version.
SECTION 13
Contact us
For any questions about this Privacy Policy, to exercise your data protection rights, or to raise a concern about how your personal data is handled, please contact Nevertheless AI Ltd: