Who we are and what this policy covers
DM2find BV (“DM2find”, “we”) builds an AI travel concierge for tourism boards and destination marketing organisations (“destinations”) and for the visitors who use it. We are based in Hilversum, the Netherlands (Chamber of Commerce number 89552407). You can reach us at sales@dm2find.ai.
This policy explains what personal data we process, why, who receives it, and what rights you have. It covers the dm2find.ai website, the chat assistant on destination websites, in the full-screen chat at chat.dm2find.ai and in embedded widgets, voice conversations, dictation, and any messaging channel a destination switches on.
Our role depends on where you are. When you talk to a destination’s assistant, the destination decides why and how your conversation is used and is normally the data controller. DM2find processes the data on its behalf as a processor. For our own website, demos and sales conversations, DM2find is the controller. A destination’s name and logo in a demo show which place the assistant covers; they do not mean the destination is our customer.
You are talking to an AI. Its answers can be incomplete or wrong, so check opening hours, prices and bookings with the provider before you rely on them.
What data we process
You do not need an account to use the assistant. We process the following, depending on how you use it.
| Data | What it includes |
|---|---|
| Chat | The messages you type or tap, the assistant’s answers, the language and the time |
| Voice conversation | Your speech during a live voice conversation, its transcript and the assistant’s spoken reply |
| Dictation | A short recording made when you tap the microphone in the text box, converted to text |
| Location and preferences | The destination or city you pick, and anything you tell the assistant, such as dates, food or interests. A precise location only if you choose to share it |
| Technical data | IP address, browser and device type, language, the page you came from and a random session identifier |
| Contact data | Only if you choose to email us or book a walkthrough: your name, email address and message. We do not ask for contact details in the chat or on this website |
Please do not share sensitive information in the chat, such as health details, passwords or payment card numbers. The assistant does not need them.
How voice and dictation work
The microphone is only used after you tap a button, and your browser asks for permission first. You can stop at any time. A live voice conversation ends automatically after five minutes.
Browser dictation. On some destinations the microphone button in the text box uses your browser’s built-in speech recognition. In Chrome, for example, the audio is processed by Google under Google’s own privacy policy. DM2find does not control or receive that audio.
Voice assistant (standard). For destinations with a live voice assistant, your audio is streamed to ElevenLabs, which turns your speech into text and generates the spoken reply. Audio recording is switched off at ElevenLabs, so the audio itself is not kept. The transcript appears in the chat so you can read along. ElevenLabs processes this data in the United States.
EU-only option. Destinations can choose a fully European setup. Dictation audio is then recorded in your browser, converted to a short audio file and sent through our own servers in Germany to a speech-to-text service hosted by Scaleway in the EU. The European voice assistant and the European chat use open models for listening and speaking and Mistral for the answers, all hosted by Scaleway in France and the Netherlands, with the destination data search on our own servers in Germany. No US provider is involved.
DM2find does not store dictation audio. The workflow that handles it is set not to keep the audio or the resulting text after a successful request. Transcripts of voice conversations are anonymous and are kept only for as long as they are useful to improve answer quality, and no longer than 12 months.
Messaging channels
A destination can offer the assistant on WhatsApp, Facebook Messenger, Instagram Direct, Telegram, WeChat or LINE. In production this always runs on the destination’s own account on that platform. The destination is then the controller, and DM2find processes your messages on its behalf.
What we receive. The messages you send, the platform’s identifier for you (on WhatsApp this is your phone number), your profile name if the platform shares it, your language and the time.
What the platform does. The platform delivers your messages and is a separate controller of its own processing, under its own terms and privacy policy: Meta for WhatsApp, Facebook Messenger and Instagram, Telegram for Telegram, Tencent for WeChat and LY Corporation for LINE. These platforms may process data outside the EU, and we do not control that.
How we use it. To answer you, as described in this policy. We do not use your details from a messaging channel for advertising.
Your choices. You can stop messaging at any time, and block or delete the chat in the app. Deleting it in the app does not delete it from our systems, so ask the destination or us if you want your conversation removed.
Why we process data and on what basis
We use personal data only for the purposes below. Where a destination is the controller, it determines the legal basis; the bases listed are the ones that normally apply.
| Purpose | Legal basis (GDPR) |
|---|---|
| Answer your questions and run the assistant | Legitimate interests in providing the service you asked for, or performance of a contract |
| Use of the microphone for voice and dictation | Your consent, given when you tap the button and allow microphone access in your browser |
| Security, abuse prevention and fixing errors | Legitimate interests in keeping the service safe and working |
| Improving answer quality and the service | Legitimate interests, using as little personal data as possible |
| Responding to enquiries, demos and sales conversations | Legitimate interests, or steps taken at your request before a contract |
| Meeting legal and accounting duties | Legal obligation |
You can withdraw consent at any time by ending the conversation or blocking microphone access in your browser. That does not affect processing that already took place. We do not use your conversations for advertising, and we do not use them to make decisions that have legal or similarly significant effects on you.
Who receives your data
We share personal data only with the parties below, and only as far as needed to run the service. We do not sell personal data.
| Recipient | What they do | Where |
|---|---|---|
| Hetzner | Hosts our servers, database and chat application | Germany |
| Scaleway | Speech-to-text, Mistral language model and text-to-speech for the EU-only option, in chat and voice | France and the Netherlands |
| ElevenLabs | Live voice conversations for destinations that use the standard voice assistant | United States |
| OpenAI | Language models that write answers in the standard chat setup. We use several models and pick the smallest one that can do the task | United States |
| Your browser vendor | Built-in dictation, if you use it (for example Google in Chrome) | Depends on the vendor |
| The destination | Receives the conversation as the data controller, and may receive anonymised statistics | Set by the destination |
| Messaging platforms | WhatsApp, Facebook Messenger, Instagram Direct, Telegram, WeChat and LINE carry your messages if a destination offers the assistant there | Set by the platform |
Tourism information in the assistant comes from public and open data sources. Those sources do not receive your data. We may also disclose data where the law requires it, or to professional advisers under a duty of confidentiality.
Booking a walkthrough. If you book a walkthrough, you do so through Cal.com, which uses Google Calendar to create the appointment. They receive your name, email address and chosen time and handle them under their own privacy policies. We then see the same details in our calendar.
Transfers outside the EU
Our servers are in Germany. Destinations that choose the EU-only option keep voice, dictation and chat processing inside the EU.
On the standard setup, some providers process data in the United States: ElevenLabs for voice, OpenAI for chat answers, and your browser vendor if you use browser dictation. We rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses, together with the safeguards described in the provider’s terms. You can ask us for a copy of the safeguards that apply. Messaging platforms, Cal.com and Google process data under their own terms and may do so outside the EU.
How long we keep data
We keep personal data no longer than needed for the purpose it was collected for. The periods below are the ones we apply.
| Data | Retention |
|---|---|
| Dictation audio | Not stored by DM2find |
| Live voice audio | Not stored by DM2find. Audio recording is switched off at ElevenLabs. |
| Chat conversations and voice transcripts | As long as they are useful to improve answer quality, and no longer than 12 months, then deleted or anonymised |
| Technical and server logs | Up to 7 days |
| Emails you send us | Until the matter is resolved |
| Accounting records | As long as the law requires |
If a destination is the controller, it can set a shorter period for its own assistant.
Cookies and local storage
The assistant stores a small amount of data in your browser, only to make it work: a random identifier that keeps your conversation together, and a saved copy of the destination’s colours and styling so the page loads quickly. This is strictly necessary for the service and is not used for tracking or advertising.
The dm2find.ai website does not currently use analytics. If we add cookies that need your consent, we will ask for it first. You can clear stored data at any time in your browser settings.
Your rights, security and contact
Your rights. Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing and a portable copy. You can object to processing based on legitimate interests, and withdraw consent at any time. We answer within one month. If your conversation took place on a destination’s assistant, we may pass your request to that destination, which is normally the controller. To help us find your conversation, tell us roughly when and where you used the assistant.
Security. We use encrypted connections, access controls, European hosting and logical separation between destinations. We keep access to personal data to the people and systems that need it. No online service is completely secure, so please do not share sensitive details in the chat.
Children. The assistant is not aimed at children under 16, and we do not knowingly collect their data.
Complaints. You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the authority in your own country.
Changes. We will update this policy when our service or the law changes, and change the date below. Last updated: 7 October 2026.
Contact. DM2find BV, Hilversum, the Netherlands. Chamber of Commerce 89552407. Email: sales@dm2find.ai.