Privacy policy
The WhatsApp assistant
The Sommet assistant, run by Anthropic (Claude) for Sommet, reads your own Sommet bookings, plans and saved preferences, and any photo you send, to answer your messages. Sommet keeps no copy. The model provider processes it under its API terms. You can turn this off in Privacy.
Sommet operates a members' concierge and booking service in the resorts shown in the app, currently Paros and Antiparos (Greece) and Gstaad and the Saanenland (Switzerland). This policy explains what personal data we collect, why, who we share it with, how long we keep it and the rights you have. The data controller is Sommet Paros/Antiparos Single Member P.C. (Μονοπρόσωπη Ι.Κ.Ε.), a company incorporated in Greece with its registered office at Tepeleniou 23, 16673 Voula, Attica, Greece, registered in the General Commercial Registry (GEMI) under number 194942201000, tax number (AFM) 803341350, EU VAT identifier EL803341350. For any privacy request, email support@sommet.life.
Where we hold your data
We store personal data in the European Union and Switzerland, including the Zurich-hosted analytics service described below. Some providers also process data abroad. Where a processor operates outside the EU or European Economic Area, we rely on an approved transfer mechanism, such as an adequacy decision or standard contractual clauses. Some of our providers, including Stripe, Clerk, Anthropic and OpenAI, are based in the United States; where they process your data we rely on standard contractual clauses or an adequacy decision such as the EU-US Data Privacy Framework. Where Swiss data-protection law applies, transfers must also meet its requirements.
What we collect
- Account and identity: your name, email address and phone number, handled through our sign-in provider, Clerk. If you choose Sign in with Apple or Google, we receive the account details those services share with us.
- Booking data: the transfers, tables, charters, experiences and other services you request, and the related dates, times, party details and locations.
- Payment data: processed by Stripe and, for authorised assistant card guarantees and payments, our secure payment vault provider, Basis Theory. Card numbers and security codes are handled by these providers; Sommet keeps payment references and masked card details. Vendors are the merchant of record for what you book and are paid through Stripe or, for an authorised assistant payment, through the Vendor's payment service. Any applicable Sommet platform fee is shown before you confirm. The Sommet Pass is the exception: we sell it to you directly and charge it to Sommet's own Stripe account, so for that purchase Sommet is the merchant of record.
- Location: precise location. In the customer app we use location only while you are using the app, for example to set a pickup or to sort places near you. In the Sommet Partner app we may use background location only while a partner is on an active job, so the guest and operations team can see fulfilment progress until the job is complete. We do not track partners while they are off shift. You can turn this off in your device settings, although some active-job features may then be unavailable.
- Partner identity and KYB: if you use the Sommet Partner app, we collect the information needed to verify you and your business, including government ID, business-registration documents, proof of insurance, licences, verification status, review notes and related metadata. We use Stripe Connect to support partner verification, payouts and merchant onboarding.
- Concierge messages: the messages you exchange with the Sommet concierge, which is an AI assistant with Sommet staff behind it, and any preferences you share to help with a booking. Photos sent to the WhatsApp assistant are read for one turn. Sommet keeps no copy. The model provider processes them under its API terms. Photos shared in the customer app are kept with the conversation.
- Health and allergy notes (optional): you can ask Sommet to store allergy, dietary and other health notes so a booking suits you or your household. We store them only after you give a separate permission in the app, and you can revoke that permission in Privacy. We use these notes only for the service you ask for. We never use them for advertising or profiling, and we keep health details out of the text we send to the AI provider.
- Photos and camera: the app opens your camera or photo library only when you choose to add a profile photo, scan a payment card or share a photo with the concierge. In the Partner app, the camera is used for verification documents, ticket scanning and listing photos you choose to take.
- Device calendar (optional, iPhone): if you allow calendar access, Sommet adds your plans and event tickets to a calendar named Sommet on the phone and shows your own events beside them on that iPhone only. Those events stay on the phone.
- Partner referral attribution: if you choose to continue from a partner's invitation link, we keep a short-lived, random invitation token and, when you create an account, record which partner introduced your household. We use this to apply the agreed platform fee to eligible bookings and to show the partner privacy-protected aggregate performance. Opening the web link alone does not attach a referral to you.
- Connected calendars (optional): if you connect a Google or Microsoft calendar, we read the calendars you show in that account (event times, busy or free status, and, for your own view only, the title and place) and, if you turn it on, add and update your own Sommet bookings and appointments in a calendar named Sommet that we create in your account. Your connected events are private to you. A household member sees your busy times only if you choose to share them with that named person, and then only start and end times. We do not read event descriptions, attendees or attachments. We store the connection's access tokens encrypted. When you disconnect, we stop syncing and delete the calendar events we copied into Sommet; events Sommet already added to your calendar stay there. On an iPhone you can instead connect the iPhone's own calendar: Sommet adds your plans to a calendar named Sommet on the phone and shows your other events in Sommet on that iPhone only. Those events never leave the phone.
- Notifications: if you allow them, we send push notifications about your bookings through Apple's notification service and Expo.
- Diagnostics and usage data: crash and error diagnostics through Sentry (EU region). With your separate permission, product analytics through our Zurich-hosted PostHog service help us understand visits and app-store journeys. Maps are provided by Mapbox.
Why we use it, and our legal bases
We use your data to create and run your account, to fulfil the bookings you make, to take payment through Stripe, to let the concierge team help you, to keep the service secure and reliable, and to meet our legal, accounting and tax obligations. Our legal bases are the performance of our contract with you (for your account and bookings), your consent (for optional marketing email and optional product analytics, each controlled separately and withdrawable at any time), our legitimate interest in running a safe and reliable service (for diagnostics, security and preventing abuse), and compliance with a legal obligation (for financial and tax records).
Who we share it with
We share the minimum needed to deliver a booking with the Vendor or partner fulfilling it, for example the driver of your transfer. We use trusted processors who act on our instructions under a data-processing agreement, including Clerk (sign-in; Apple and Google sign-in), Ably (live updates and messaging), Sentry (crash diagnostics, EU region), PostHog (optional product analytics), Mapbox (maps), Postmark and Resend (email), Meta (WhatsApp messages), Apple and Expo (push notifications) and our hosting provider. Stripe processes payments as an independent controller under its own terms, not as our processor.
AI assistant. The Sommet concierge is an AI assistant, powered by Claude from Anthropic in the United States, with Sommet staff behind it who step in when needed. Before we share anything, the app asks for your permission. With it, we send your message and request details to Anthropic, which can include personal information, so the assistant can answer and help with bookings. You can decline and keep using the rest of the app, and you can revoke the permission at any time in Privacy. When you send a message after declining, the app tells you it will share that message. Anthropic processes this data for us to provide the assistant. The assistant on WhatsApp works the same way.
If you use our optional AI trip-planner, we send a limited, minimised set of stay details to OpenAI, our AI provider in the United States, to draft itinerary ideas from our own venue catalogue. That set covers your stay dates and how you are arriving, your party size including how many adults and children are travelling and the ages of any children, the name of your accommodation and its approximate location (its town, and coordinates rounded to roughly a kilometre rather than a precise address), your stated preferences and notes, the ideas already in your itinerary and the local weather. The ideas are pencilled suggestions, not bookings, and you choose whether to act on them. If you use menu import in the Sommet Partner app, we send the menu photograph you upload to the same provider so it can read the dish names and prices into a draft you then check and correct before anything is published. We do not sell your personal data, we do not use it for advertising, we do not track you across other companies' apps and websites, and we do not use it, or permit our providers to use it, to train artificial-intelligence models. Our concierge is an AI assistant, with Sommet staff behind it who step in when needed. Where available, an automated booking assistant can also send booking data to an AI provider as described below. We also use OpenAI to turn voice notes you send on WhatsApp into text.
Where an automated booking assistant is available, it may use an AI provider (Anthropic or OpenAI), Browserbase (booking pages), Postmark (booking email) and Twilio (phone calls where enabled) to contact a Vendor for you. We share the name, party size, date and time needed for the booking, using a Sommet booking contact. We share your mobile number or booking notes only when you choose to share them. With your authorisation, the assistant can instruct the secure payment vault to provide a card guarantee or pay a deposit or charge to the Vendor, within your limits or after asking for your approval. The vault handles card data for submission to the Vendor's booking or payment service; card numbers and security codes are not sent to the AI provider. Audio is not recorded and call transcripts are not kept for real venues. Where calls are enabled, the assistant processes speech in memory.
Calendar providers and use limits: if you turn on adding Sommet items to a Google or Microsoft calendar, we send each item's title, time and place to that provider, which keeps your calendar under its own terms. We use calendar data only to show your calendar and keep Sommet items up to date. We do not sell it, use it for advertising, share it with partners, or use it to train AI models. Sommet staff do not read it, except with your permission, for security or where the law requires.
Sommet's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it
We keep account and booking data for as long as your account is open. When you delete your account, we close it and delete or anonymise your personal data on our own systems immediately, except for records we must keep longer by law. At the same time we instruct our analytics provider to erase its copy, which normally completes within a few hours. We keep bookings and payment records, because tax and accounting law requires it. We keep financial, invoicing and tax records for the Greek statutory accounting and tax period (generally at least five years). We keep partner identity and anti-money-laundering (KYB) records for five years after the business relationship ends, as anti-money-laundering law requires. We may keep the minimum needed to handle a live dispute, claim or fraud investigation until it is resolved. When a record is no longer needed for any of these purposes, we delete or anonymise it. See our account deletion page for the full deleted-versus-retained split.
Your rights
You can ask to access, correct, export or delete your personal data, and you can object to or restrict certain processing. To delete your account and data, open People in the Sommet app, select your name, then Account, then Account details, then Delete account, and confirm, or use the email path on our account deletion page. You can withdraw consent to marketing at any time. If you are in the EU or the EEA you have these rights under the GDPR; where Swiss law applies, you have the rights provided by the Swiss Federal Act on Data Protection. You can also contact the relevant data-protection authority: the Hellenic Data Protection Authority in Greece, or the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland at www.edoeb.admin.ch.
Website analytics choice
Website analytics is off until you allow it. You can change or withdraw that choice here at any time. Form contents are never captured by this setting.
Current website analytics choice: not chosen.
Cookies and local storage
Our website uses no advertising or tracking cookies. It sets only what is strictly necessary to run the site and remember your choices, which does not require your consent. Only if you allow analytics above, our analytics provider (PostHog) stores a small identifier in your browser's local storage and a cookie so it can count a visit without profiling you; you can withdraw that at any time using the control on this page, which removes it. The Sommet apps do not use web cookies.
Children
Only adults may hold a Sommet account, and we do not knowingly collect personal data directly from anyone under 18. A member may tell us how many children are travelling in their party and their ages, so that bookings and suggestions, including those from the optional AI trip-planner, suit the party. We use that limited information only to arrange and plan the stay, and it is covered by the same retention and deletion rules as the rest of the member's account data.
Contact
Email support@sommet.life for any privacy request or question, or write to Sommet Paros/Antiparos Single Member P.C., Tepeleniou 23, 16673 Voula, Attica, Greece.