Security with no fine print
You work with data from people who trust you. This is exactly what we do with it.
Request a demoSecurity sheet
What you can expect from Karibai, point by point.
Personal data
- We process your guests' data as a data processor, under GDPR. You remain the controller.
- Your information and your guests' is stored and processed in the European Union.
- Conversations are not used to train AI models, nor sold or shared with third parties.
- If you delete your account, everything goes: conversations, messages, files and the WhatsApp templates registered in your name.
- The data processing agreement (DPA) is published, with its annexes.
Responsible AI
- Kari introduces itself as a virtual assistant in its first message and never claims to be a person.
- The guest can ask to talk to someone on your team at any time, and Kari hands the conversation over.
- Kari answers only with your property's and the booking's information. If it does not have it, it says so.
- In an emergency, it points to the emergency number and alerts your team at the same moment.
- Outside the stay and the area, Kari declines: no medical or legal advice, nothing unrelated to being a guest.
Access and team
- Three roles: owner, admin and support. Each person sees and does only what their role allows.
- Access by invitation. Whoever leaves stops seeing the data at once.
- Two-factor authentication and passkeys available for every account.
- Each person manages their active sessions from their security settings.
Infrastructure and providers
- Encryption in transit and at rest, with access limited to the people on your team.
- Your integration credentials (WhatsApp, PMS) are stored encrypted.
- Extra payments go straight to your Stripe account. Karibai stores no card data.
- We publish the list of subprocessors and keep it up to date.
The documents
The policies and agreements that govern how data is processed. You can read them here.
Frequently asked questions about security
If your legal team needs anything else, write to us.
Who is the data controller?
You are. Karibai acts as a data processor on your behalf, under a DPA that defines what we do with the data and what we do not.
Where is the data stored?
In the European Union, both storage and processing.
Are conversations used to train the AI?
No. Neither yours nor your guests'. Nor are they sold or shared with third parties.
What does the AI Act require and how do you comply?
That the guest knows they are talking to an AI and can ask for a person. Kari introduces itself as a virtual assistant in its first message, never claims to be human and hands the conversation to your team when the guest asks.
What happens to the data if I stop using Karibai?
Deleting the account removes conversations, messages, files and the WhatsApp templates registered in your name. Bookings and properties stay in your PMS, their source.
Can I require two-factor for my team?
Each person can enable two-factor authentication or a passkey from their security settings. If you need to enforce it for the whole team, let us know.
Need more information on data protection?
We answer any questions from your legal or compliance department.