Data Processing
Last updated: September 21, 2026
This page describes how The Night Reception (a service of Lang IT Services Inc.) handles personal information when it acts on behalf of a business. It is written to sit alongside our Terms of Service and Privacy Policy. If a business has its own data processing agreement, that agreement applies instead where it differs from this page.
1. Roles
When enquiries come from a business's website visitors, the business is responsible for that information (the controller), and we process it on the business's behalf (the processor). We act only on the business's instructions and only to provide the service. For the business's own account and configuration data, we are the responsible party.
2. What we process, and why
- Enquiry data: the name, email address, phone number, message or conversation, time, and language shared by the business's visitors, across web chat, the business's contact form, and email to its Night Reception address.
- Configuration data: the business's name, notification email addresses, website domains, booking link, hours, and front-desk instructions.
We process this only to answer and capture enquiries, draft replies for the business, notify the business, and run and protect the service. We do not use it for advertising and we do not sell it.
3. Subprocessors
We use the following providers to run the product. We share only what each needs.
- Vercel — website hosting and the AI Gateway. United States.
- Neon — database. United States.
- Resend — email sending and receiving. United States.
- AI model providers reached through the AI Gateway — these vary; destinations vary.
We will give a business notice before adding a new subprocessor that handles personal information, so the business has a chance to object.
4. AI processing and training
Replies and draft replies are generated by AI models reached through Vercel's AI Gateway. We set a data control on each request so it is routed only to providers that do not train on prompts, and we do not use content to train models. We do not claim, and do not currently guarantee, provider-level zero data retention; the AI Gateway deletes prompts and outputs after each request, and we choose providers that do not train on prompts.
5. Cross-border transfers
The providers above are mainly in the United States, so personal information may be transferred to and stored outside the business's country or province. We limit what is sent to what each provider needs to do its part.
6. Security
We use reasonable technical measures, including encryption in transit and access controls. We do not claim a certification, an audit, or a specific compliance standard. No system is completely secure, so we cannot promise absolute security.
7. Helping with requests
If someone asks a business to access, correct, or delete their information, we will help the business respond, including by locating or updating the relevant records and, on the business's instruction, deleting them.
8. Breach notification
If we become aware of a breach affecting personal information we process for a business, we will notify that business without undue delay, with the information it needs to meet its own obligations.
9. Ending the service
When a business ends the service, we will delete or return the personal information we processed on its behalf, on its instruction, subject to any legal requirement to keep it.
10. Health information
The service is not designed for personal health information. Businesses must not use it to process health or medical information.
11. Contact
Lang IT Services Inc.
Calgary, Alberta, Canada
contact@langitservices.com