Privacy Policy

What we collect

When you sign up: your name, email address, year of birth (just the year, never the full date — it's used only to work out which experience is right for your age), and a securely hashed password (we never store your actual password). If you're under 13, we also collect a parent or guardian's email address to get their consent before your account can be used.

Your conversations

Your chats with Fernando are private to you — nobody else using this app can see them, including other guests. They're kept so you can come back to earlier conversations, until you delete a conversation or your account. Deleting a conversation removes its messages and any pictures in it immediately; deleting your account removes everything you own, at once.

Pictures you ask Fernando to make

Every picture request is checked against age-appropriate rules before anything is drawn, and every finished picture is checked by an on-device safety classifier before you see it; pictures that fail are never saved or shown. A picture Fernando makes for you is kept on this server for 24 hours so you have time to save it to your own device — after that it's deleted from the server. The prompt, seed, and settings used to make it are kept separately for 30 days, so it can be recreated exactly if you (or, for reviewing a flagged request, an admin) need to see it again — after 30 days those details are deleted too. A housekeeping sweep enforces these times every 15 minutes (and each time the service starts); it also removes any picture file that no longer belongs to a message. Email confirmation links expire after 24 hours and password-reset links after 1 hour; expired links are deleted by the same sweep.

Audio blogs from the Study

A document you give the Study for an audio blog is kept, encrypted, only until the audio blog is made (or for 24 hours if none uses it), then deleted. The finished audio blog is kept on this server for 7 days so you can listen again or save it to your own device — after that the recording is deleted, though the message and its list of sources stay in your conversation until you delete it. Its working notes — the passages drawn from your sources, its script, and the record of how each fact was checked — are kept encrypted for the same 7 days, so that if one comes out wrong the cause can be found and fixed, then deleted. A film of an audio blog, if you ask for one, is kept for the same 7 days as the recording, then deleted in the same way.

Voice

None of your audio is recorded or stored. When you talk to Fernando in the listening room (13 and over), your voice is sent to the hotel's own speech service on our own machines, turned into text there, and the sound is thrown away straight after. The text appears in your conversation and is kept like anything you type, until you delete the conversation or your account. When Fernando reads a reply aloud, the sound is made on our machines as it plays and is not kept either. No outside service hears you.

What your Valets remember

Valets are for guests aged 13 and over. Once a conversation with a Valet has been quiet for a while, the hotel's own AI models, on our own machines and never an outside service, fold what you said into that Valet's notes, so the next conversation starts where the last one stopped. Each Valet's notes are its own. You can read them on the Valet's page and wipe them with one press; they are encrypted before they are stored, no other guest and no admin page shows them, and they are kept until you wipe them or delete the Valet or your account.

For guests aged 13 to 17 that is all a Valet keeps across conversations: nothing beyond those notes is carried over, and Fernando's general “remember that” list is not available under 18.

What Valets note and make for guests 18 and over

So that a Valet never forgets what you tell it, the details you give it — names, dates, amounts, wishes, decisions — are noted from each of your messages, with your exact words and where you said them. It is done by the hotel's own AI models on our own machines, never sent to an outside service. You can read, correct or remove every one under “What I've noted” on the Valet's page. If you ask a Valet for a finished piece — a will, a CV, a plan — and say yes when it offers, the document it prepares is kept so you can download it in Word or as a PDF. A Valet's own replies are also read, by the same models, a little after each one, for the key points of what it has told you, so that a write-up of them is quick to make when you ask for one. Those points are kept, encrypted, with that Valet; they never join what it has noted about you, and they are deleted with the Valet or any of its conversations. Each download is made fresh when you ask and is never kept as a file. While one is being prepared, its working notes sit, encrypted, in your own folder on the server and are deleted the moment it is finished.

All of it is encrypted before it is stored, and only you can see it: no other guest, and no admin page shows any of it. It is kept for as long as the Valet is — deleting the Valet or your account removes it all at once, and deleting one of a Valet's conversations removes what was noted from it and the documents made with it.

Safety review (flags)

If a request looks like it breaks our rules for your age group, it's logged for a site admin to review, and (for policy violations, not for someone reaching out about self-harm — see our Terms of Use) your account may be temporarily paused while that happens. The flagged text is kept (encrypted) for as long as the flag is under review or on record; feedback you send through “Report an issue” is kept until an admin has reviewed it. Both are deleted with your account.

Live information (optional)

Fernando normally has no connection to the outside world: nothing you ask leaves this server. In the menu there is a switch, “Let Fernando send outside the hotel”, which is off unless you turn it on. With it on, when you ask about something that changes day to day — the weather, the news, sports results, live train departures where the hotel has set that up, and “what's the latest on” questions that need a web search — Fernando may look it up from an outside service, and he will always tell you when he has.

What leaves the server is the smallest thing that answers the question: for the weather, a place name you typed, or your location rounded to about a kilometre if you have shared it. Never your conversation. Every lookup is recorded on your account page — what was asked, when, and which service — so you can see exactly what went out, and remove any entry. Those records are kept for 30 days and then deleted; what the service sent back is never stored at all. Weather comes from Open-Meteo (open-meteo.com); news and sport from the public feeds of outlets such as the BBC, the Guardian and Sky News; scores from TheSportsDB; and trains from Realtime Trains. A web search goes first to the hotel's own search service running on this server (which passes the query on to public search engines without any account or identity attached), and to DuckDuckGo if that is unavailable; the pages it finds are then read by this server. None of these services is given anything about you. Everything fetched is checked by the same on-device screening that checks your own messages before Fernando sees it, and a page that tries to give Fernando instructions is thrown away. For an audio blog written from a longer brief, it may make up to four such searches, one for each subject the brief asks about — each is a few words naming the subject, never your brief itself, and each appears on your account page. A Junior Guest's account never uses web search at all.

On a Junior Guest account (under 13) the switch allows the weather and sports scores only — never news and never a general search — whatever the app appears to offer.

Reporting a reply that wasn't good enough

Under any of Fernando's replies there's a “Wasn't helpful” button. If you use it, we keep a copy of that one exchange — his reply and the message you sent just before it, plus which room it happened in and when — so the desk can work out what went wrong.

Nothing is kept unless you tick the box agreeing to it. Two extra things are offered separately, each off unless you turn it on: the photo you showed him, and a screenshot you choose from your device. On a Junior Guest account (under 13) a report can only ever contain the words — no photo and no screenshot, whatever the app appears to offer.

A report is kept for 30 days and then deleted automatically, along with anything attached to it. Only a site admin can see it. It is never used to train any AI model. You can see everything you've reported, and take any of it back, on your account page — withdrawing a report deletes the copy immediately. Reports are also deleted with your account.

Who can see your data

Nobody but you can see your conversations or generated pictures. Site admins can see account details and the content of anything specifically flagged for review, but not your everyday conversations otherwise. We don't sell or share your data with advertisers, and we don't use your data to train AI models or show you targeted ads — there are none.

How your data is protected

Your conversations, the titles of your chats, picture descriptions, anything Fernando remembers for you, what your Valets remember, note and make, and feedback you send us are encrypted before they are written to our database, so they are never stored as plain text. Passwords are never stored at all — only a one-way hash. Everything travels over HTTPS. You can change your password from Account settings, and forgotten passwords are reset only through a time-limited link sent to the email address on the account (or the parent/guardian address, for under-13 accounts). Changing or resetting a password signs out every device.

Location (optional)

Fernando can use your location only if you switch on “📍 Share my location” in the menu (☰) and your browser asks you to allow it. It is sent with your messages while the switch is on, used to answer that message, and never stored — not in your chat history, not in logs. You can switch it off at any time, and it isn't offered at all on accounts for under-13s. For directions, Fernando gives you a link that opens in your own maps app; the route is worked out on your device, not by us. (If the site owner enables in-chat turn-by-turn routing, place names and coordinates — never your identity or messages — are sent to OpenStreetMap's public services to look up the route; this page will say so here if that is switched on.)

Where things run

The AI models that power Fernando's answers and pictures run under our own infrastructure — your prompts and images are not sent to a third-party AI company's servers for processing. We use Cloudflare to secure and route traffic to our service, and (where configured) to check you're a human rather than a bot when you sign up.

Your rights

You can ask to see, correct, or delete your data at any time by contacting the site owner. Deleting your account removes your profile, conversations, and any pictures still within their retention window.

When this policy changes in a way that affects your data, we show you what changed the next time you open the app and ask you to agree before you carry on. Last changed 8 October 2026.