Summary

Nōmae uses artificial intelligence, recommendation, and automation systems to organize information, personalize the guest experience, generate journey proposals, prioritize experiences, produce summaries and explanations, and assist hotels and users.

When a person interacts directly with a Nōmae AI system and it is not evident from the context, this will be clearly disclosed no later than the first interaction. AI is used as a support and personalization layer: relevant operational decisions, reservations, payments, changes with material impact, or actions requiring authorization must comply with applicable controls and confirmations.

This Policy supplements the Privacy Policy, the Legal Notice, and the applicable specific terms. It does not replace information on data protection or contractual terms.

1. Data Controller and Scope

This Policy applies to the artificial intelligence, recommendation, inference, and automation features integrated into Nōmae, including, depending on their deployment, Atlas, Journey Intelligence, Mission Boards, contextual assistance, personalization, recommendations, summaries, translations, experience classification, and agent-driven flows.

• Product Manager: Miguel Angelo Romo Rodríguez

• Trade Name: Nōmae

• Contact: legal@gonomae.com

Nōmae’s specific role as a provider or party responsible for the deployment of an AI system will depend on the architecture, the model used, who determines its purpose, and how the feature is offered. This Policy does not intend to anticipate a regulatory classification that must be evaluated for each system or use case.

2. Which Features May Use AI

In Journeys and itineraries, Nōmae may use AI or automation to generate, sort, or explain suggestions based on context, preferences, availability, and applicable rules. The primary control involves applying inventory and predefined restrictions, as well as requesting confirmation when the action requires it.

In experience recommendations, AI may prioritize options, estimate affinity, and tailor the content displayed. The system must distinguish between stated preferences and inferences, and respect restrictions and availability.

In Atlas and contextual assistance, AI can respond, summarize, translate, explain, and help navigate information about the stay or destination. When necessary, it must provide transparency regarding interactions with AI and rely on sources or operational confirmations.

In Mission Boards and operational signals, AI can organize tasks, suggest actions, or highlight opportunities for the guest or the hotel. Actions with material impact must be subject to authorization and traceability.

In profiling and inferences, Nōmae can estimate affinities, pace, fatigue, available windows, probability of interest, or other indicative signals. A distinction must be maintained between declared and inferred data, minimization must be applied, and corrections must be allowed when appropriate. In agent-based automation, systems can prepare or—when sufficient authorization exists—execute limited actions within a defined scope. These workflows must operate with scopes, authority limits, confirmations, logging, and the possibility of human intervention.

3. Transparency When Interacting with AI

When a feature is designed to interact directly with a person via AI and this is not obvious, Nōmae will display a clear indication that an AI system is being used. This information must appear no later than the first relevant interaction or exposure. Interfaces may use labels such as “AI Assistant, ” “Generated by AI,” or equivalents where appropriate. The goal is for the user to be able to distinguish an AI-generated response or recommendation from a confirmation issued by a hotel, supplier, or deterministic transactional system.

4. Data, Context, and Inferences

Systems may use only the context necessary for the activated feature, which may include stated preferences, stay data, permitted history, interactions, inventory, availability, restrictions, and derived signals.

Inferences must not be presented as facts stated by the guest. Nōmae must maintain, where relevant, the distinction between:

• information provided directly by the individual;

• data received from the hotel or an authorized integration;

• signals observed during use;

• inference or estimates generated by the system.

No particularly sensitive categories or attributes unnecessary for the purpose of the service should be inferred. The processing of personal data is governed by Nōmae’s Privacy Policy.

5. Human Intervention, Authority, and Actions

AI does not have unlimited authority by default. Functions that can interact with external systems, make reservations, modify a stay, generate charges, send communications, activate benefits, or perform other actions must operate within defined permissions, limits, and conditions.

As a general principle:

• low-risk and reversible actions may be automated within a previously authorized scope;

• actions with economic, contractual, sensitive, or difficult-to-reverse impacts must require appropriate confirmation or sufficiently specific prior authorization;

• the system must be able to record the context, permission, and rule that allowed an action when necessary for security, support, or auditing purposes.

Nōmae does not intend to use AI to make exclusively automated decisions that produce legal effects or similarly and significantly affect a person without the applicable legal safeguards.

6. Third-Party Providers and Models

Nōmae may integrate third-party models or services for certain AI functions. The selection of providers will be based on, among other factors, security, privacy, technical capability, terms of use, location of processing, and available controls. When personal data is used, the roles, contracts, measures, and safeguards described in the Privacy Policy and in the corresponding processing agreements will apply. External providers used by Nōmae are not authorized to use the data processed on Nōmae’s behalf to train their general models, unless there is a separate purpose, a valid legal basis, specific information, and the necessary controls in place.

7. Training and Improvement

Nōmae may analyze the performance of its systems to evaluate quality, security, errors, relevance, and performance. No individually identifiable guest profiles are used to train general AI models. For statistics, evaluation, or improvement of recommendation systems, anonymized and, where possible, aggregated information will be prioritized. Pseudonymization alone does not make data anonymous. Any future use of personal or pseudonymized data for a training purpose other than the requested service will require a prior legal assessment and an update to the applicable information and controls.

8. Limitations of AI

AI systems may produce incomplete, outdated, inaccurate, or incorrect information. A recommendation does not constitute a confirmation of availability, price, safety, schedule, access, quality, or suitability of an experience. When an issue depends on current operational or regulatory information—for example, availability, reservations, entry requirements, access conditions, security, transportation, flights, or third-party services—the source, hotel, provider, or competent authority shall prevail. Nōmae may limit, suspend, or redirect an AI feature when it detects risk, high uncertainty, lack of authorization, or the need for human review.

9. User Control and Rights

Where applicable, the user may correct stated preferences, request the rectification of personal data, withdraw consent, object to certain processing activities, or request a review in accordance with the Privacy Policy and applicable regulations.

Continuity or memory features across stays must respect the applicable settings, consent, or legal basis and allow for their deactivation or deletion when appropriate. For inquiries regarding AI, privacy, or the exercise of rights: legal@gonomae.com.

10. Content Generated or Manipulated by AI

When Nōmae generates or manipulates content and there is a legal obligation to identify it as artificial, a clear and distinguishable indication appropriate to the context will be applied. This may affect, among other cases, certain direct interactions with AI and synthetic content published or displayed to the user. Human or editorial review does not eliminate other applicable transparency or data protection obligations.

11. Security, Oversight, and Evolution

Nōmae will implement controls proportionate to the risk of each function, including, where appropriate, permission management, separation of duties, pre-validations, audit logs, action limits, recovery mechanisms, and incident review. Agent-based functions require special attention because they can combine information from different sources and perform tasks with greater autonomy. Their deployment must proceed through levels of authority and include verifiable controls before expanding their operational scope.

12. Changes and Contact

This Policy may be updated when systems, models, providers, purposes, levels of autonomy, regulations, or regulatory criteria change. If a modification materially alters the relationship with the user, the corresponding information will be updated and, where appropriate, a new choice or acceptance will be requested. Contact: legal@gonomae.com.