Privacy notice

Oist Concierge

Last updated: 2 November 2026

This notice explains how we process personal data when you contact Oist Concierge, our booking assistant on WhatsApp. It complements the privacy notice of the Oist app.

1. Who is responsible

The controller is CircleApp, LLC, 8 The Green, STE R, Dover, DE 19901, United States. Oist is a product of CircleApp, LLC.

Privacy contact: privacy@oist.app

2. What data we process

• Your WhatsApp phone number and WhatsApp profile name.
• The messages you send to the concierge and our replies.
• Booking request details: name for the booking, date, time preference, number of guests, venue, format and budget range.
• Notes you choose to share for the venue, such as dietary requirements or a special occasion.

We do not ask for identity documents, payment card details or your home address. Please do not send them in the chat.

3. Why we process it and on what legal basis

• To handle your booking request and communicate with you about it: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• To pass dietary or similar notes to the venue when you choose to share them: your explicit consent, given by sending the note for that purpose (Art. 9(2)(a) GDPR). You can withdraw it at any time.
• To keep operational records, prevent abuse and improve our partner offering, including an anonymous count of requests for venues we do not work with: our legitimate interest (Art. 6(1)(f) GDPR).
• To meet legal obligations, for example tax or accounting rules: Art. 6(1)(c) GDPR.

4. AI and human review

The first replies come from an AI assistant. It collects your request and suggests options from our partner venues. It does not confirm bookings. Every booking is reviewed and confirmed by a member of the Oist team, so no decision with legal or similarly significant effects is taken solely by automated means. You can ask to speak with a person at any time.

5. Who receives your data

• Partner venues receive what they need to accept your booking: name, date, time, number of guests and any notes you asked us to pass on. Venues process this data under their own responsibility.
• Service providers acting on our behalf: Meta Platforms (WhatsApp messaging), our WhatsApp Business solution provider, Anthropic (AI processing of messages), Google (storage of booking requests) and our hosting provider.

We do not sell your data and do not use it for advertising.

6. International transfers

Some providers process data outside the European Economic Area, including in the United States. Where this happens, transfers rely on an adequacy decision such as the EU–US Data Privacy Framework, where the provider is certified, or on the European Commission's Standard Contractual Clauses.

7. How long we keep it

• Booking requests: up to 24 months after the booking date, then deleted or anonymised, unless a longer period is required by law.
• Notes for the venue: deleted together with the booking request.
• Requests for venues we do not work with: kept only in anonymous form, without your number or name.

8. Your rights

You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Write to privacy@oist.app or ask in the WhatsApp chat. You also have the right to lodge a complaint with a data protection authority, in Spain the Agencia Española de Protección de Datos (aepd.es).

9. Age

Oist Concierge is intended for people aged 18 and over.

10. Changes

We will update this notice when the service changes. The date at the top shows the latest version.