Privacy Policy

Last updated: June 26, 2026

This policy explains, in plain language, what information TheHostlyAI ("we", "us") collects when you message a hotel through one of our connected channels, how we use it, and how you can ask us to delete it.

Who we are

TheHostlyAI is an AI assistant platform that hotels use to talk with their guests. When a hotel connects a messaging channel to TheHostlyAI, we help answer guest questions and manage requests on the hotel's behalf.

What messages we process

We process the messages people send to a hotel through channels such as our website chat and — when the hotel has connected them — Instagram, WhatsApp and Facebook. We only handle conversations on channels the hotel has chosen to connect.

What data we collect

The information in a conversation may include:

• Your name
• Your username or profile handle
• The content of your message
• The language you write in
• The date and time of the message
• The channel you used (for example: web, Instagram, WhatsApp or Facebook)

How we use your data

We use this information only to:

• Reply to your questions
• Handle guest requests for the hotel
• Improve the quality of our service
• Provide support to the hotel team

We do not sell your personal data. We do not use your messages for advertising.

Legal basis for processing

We process personal data on the following legal bases under GDPR Article 6:

• Contract performance (Art. 6.1.b): Processing is necessary to deliver the guest communication service the hotel has contracted with TheHostlyAI.
• Legitimate interests (Art. 6.1.f): Processing is necessary for the legitimate interests of the hotel in managing guest communications and requests, provided those interests are not overridden by the rights of the individual.

The hotel acts as the data controller for guest data. TheHostlyAI acts as a data processor on the hotel's behalf.

How long we keep your data

Guest conversation data is retained only for as long as necessary to deliver the service:

• Active conversations are retained while the guest stay is ongoing.
• After check-out, conversation data stored in TheHostlyAI is automatically deleted, unless the hotel has configured a different retention period within their PMS.
• Upon a deletion request, data is removed within 30 days in accordance with the Data deletion request section below.

Data retained in the hotel's own PMS or connected third-party systems is subject to the hotel's own data retention policies.

International data transfers

TheHostlyAI is hosted and operated within the European Union. We do not transfer personal data outside the EEA as part of our core infrastructure.

Where we use third-party sub-processors that may operate outside the EEA (such as Meta platforms or AI model providers), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission, or transfers to countries with an adequacy decision.

Sub-processors

To deliver the Service, TheHostlyAI works with a limited number of third-party sub-processors that may access personal data:

• Meta Platforms (Instagram, WhatsApp Business, Facebook): Message delivery and channel connectivity. Subject to Meta's own Data Policy.
• AI model providers: Used to generate automated replies. Data is processed transiently and not used to train models.
• Hotel PMS providers: Guest data may be passed to the hotel's PMS as part of the service, at the hotel's direction.

A full list of sub-processors is available upon request at support@thehostlyai.com.

Your rights

Under GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Rectification: Ask us to correct inaccurate data.
• Erasure: Ask us to delete your data (see Data deletion request below).
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Restriction: Ask us to restrict processing while a request is being resolved.

To exercise any of these rights, email support@thehostlyai.com. We will respond within 30 days.

Supervisory authority

If you believe your data has not been handled in accordance with this policy or applicable law, you have the right to lodge a complaint with the competent data protection authority.

In Portugal, the supervisory authority is:

Comissão Nacional de Proteção de Dados (CNPD)
Website: www.cnpd.pt
Email: geral@cnpd.pt

Data Processing Agreement (for hotels)

Hotels using TheHostlyAI act as data controllers for their guests' personal data. TheHostlyAI acts as a data processor on the hotel's behalf, as defined under GDPR Article 28. A Data Processing Agreement (DPA) is available to all hotel clients upon request. To request a DPA, contact support@thehostlyai.com.

Cookies and analytics

TheHostlyAI website may use minimal, privacy-respecting analytics to understand how the site is used. No advertising cookies or cross-site tracking are used. Where cookies are set, they are limited to what is necessary for the site to function or to measure aggregate, anonymised traffic. You can disable cookies in your browser settings at any time.

Contact

If you have any questions about this policy or your data, email us at greg@thehostlyai.com.