Your data

AI concierge on WhatsApp and data protection: what the hotel needs to know

Updated 15 October 2026

When a Swiss hotel entrusts its WhatsApp conversations to an AI concierge, the hotel remains responsible for its guests' data within the meaning of the Federal Act on Data Protection (FADP); the provider acts as a processor. The hotel therefore needs to know what is kept, for how long, who has access, where it is processed, and to tell its guests. Here is how these questions arise, and how Léon answers them.

In brief

Who is responsible for what

The revised FADP has been in force since 1 September 2023. It distinguishes two roles:

• the controller, who decides why and how the data is processed. For conversations with its guests, that is the hotel;
• the processor, who processes the data on behalf of the controller and according to its instructions (Art. 9 FADP). That is Léon's role.

In practice, the hotel answers its guests' requests and chooses its providers; Léon undertakes by contract to process the data only for the service, to protect it and to help the hotel answer these requests.

What Léon keeps, and for how long

Léon keeps what he needs to answer and so that the team can pick up a conversation: the guest's WhatsApp number, their profile name and the content of the exchanges. Only what is necessary is kept, for a period agreed with the hotel in the contract; at the end of that period, the data is deleted automatically.

The service's technical logs mask the text of messages and phone numbers.

Who has access

• The hotel's team, from a protected area. Two-factor authentication is mandatory for management accounts.
• The Léon team, to ensure the quality of the answers and to pick up a conversation, within the limits set by the contract.

Providers and place of processing

An AI concierge on WhatsApp involves at least three types of provider: messaging, hosting of the service and the AI model provider. Always ask for the list by name, with the countries.

• Messaging: WhatsApp (Meta Platforms), European Union and United States.
• Artificial intelligence: language model providers, United States and European Union.
• Hosting of the service: specified in the contract, with each provider and its country, before launch.

Where data is sent to a country whose level of protection the Federal Council does not consider adequate, Léon relies on the safeguards provided by the FADP (Art. 16), in particular the recipient's certification under the Swiss-U.S. Data Privacy Framework or standard contractual clauses.

Security

• Encrypted connections.
• Encrypted backups, with restoration tested.
• Two-factor authentication mandatory for management accounts.
• Minimisation: only what is necessary is kept.

Sensitive data (health, bank details, identity documents) has no place in a WhatsApp conversation; we recommend that hotels handle it through their usual channels.

In the event of a data security breach, the processor informs the hotel as soon as possible; the hotel reports it to the Federal Data Protection and Information Commissioner (FDPIC) if it is likely to result in a high risk for the data subjects (Art. 24 FADP).

What the hotel must tell its guests

The FADP requires people to be informed when their data is collected (Art. 19). For an AI concierge on WhatsApp, the hotel states at least the following in its privacy policy:

• that WhatsApp messages are processed by an automated assistant;
• the purpose: answering requests related to the stay;
• the recipients and, where applicable, the foreign countries where the data is processed;
• the retention period;
• how to exercise their rights.

The FDPIC has pointed out that the FADP applies directly to AI-based processing, and that it must be made transparent when a person is interacting with a machine. With Léon, your guests know they are talking to an AI and can always reach a person.

WhatsApp Business rules

WhatsApp imposes its own rules on businesses, in addition to the law:

• The 24-hour window: when a guest writes, the business can reply freely for the 24 hours following their last message. After that, it can only write to them with template messages approved by Meta.
• The guest's consent: a business only writes to a guest first if they have agreed to receive its messages on WhatsApp.
• AI assistants: Meta allows assistants dedicated to the business's own service, but not general-purpose AI assistants. Léon answers only from the hotel's house book.

Travellers' rights

A traveller can ask the hotel for access to their data (Art. 25 FADP), its rectification, its erasure or its delivery in a common format (Art. 28 FADP). A reply is due, in principle, within 30 days.

With Léon, the hotel's team erases a traveller's data from its area, using their WhatsApp number or their booking. Each erasure is recorded in a log that does not contain the erased data.

End of the contract

The WhatsApp number and the house book belong to the hotel, including if it stops. What happens to the conversations (return and deletion) is set out in the contract.

Questions to ask any provider

1. What is your role under the FADP, and do you have a data processing agreement ready to sign?
2. Which providers are involved, and in which countries?
3. How long do you keep conversations, and who can read them?
4. How do we erase the data of a traveller who asks for it?
5. Does the guest know they are talking to an AI?
6. What happens to our data and our number if we stop?

To choose a tool beyond the question of data, see also our guide AI concierge on WhatsApp: the questions to ask before you choose.