Privacy Policy

Who we are

HOSTARA TECHNOLOGIES LTD is a UK-registered company that provides automated guest communication services for short-term rental hosts. We use a combination of AI technology and human oversight to help hosts manage routine guest messages on WhatsApp.

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have.

What data we collect

If you are a host (our client)

When you sign up to use HOSTARA, we collect your name, email address, phone number, business address, and details about your rental properties, address, check-in instructions, house rules, Wi-Fi details, local recommendations, and similar property information you provide to us.

If you are a guest

When a guest sends a WhatsApp message to a number managed by HOSTARA on behalf of a host, we receive and process the guest's WhatsApp phone number, the content of their messages, and the timestamps of those messages. We use this information solely to classify the message and either generate an automated reply or escalate it to the host.

If you are a website visitor

We may collect basic analytics data through cookies when you visit hostara.co. Details of any analytics tools used are set out in our Cookie Policy.

If you are a prospective client

If you have been in contact with us before signing up (for example, through Reddit or email), we may hold your name, contact details, property count, and notes from our conversations in our CRM system.

Why we process your data (legal basis)

Under UK GDPR, we must have a lawful basis for processing personal data. Ours are as follows.

Host data is processed on the basis of contractual necessity. We need your information to provide the service you have signed up for.

Guest data is processed on the basis of the legitimate interests of the host, specifically managing guest communication for their short-term rental property. Hosts are contractually required to inform their guests that automated messaging may be used on WhatsApp.

Website analytics are processed on the basis of legitimate interests or consent, depending on the type of cookie used.

Prospect data is processed on the basis of legitimate interests, specifically managing our sales pipeline and following up with people who have expressed interest in our service.

We use the following third-party services to deliver our product. Each acts as a sub-processor of personal data on our behalf.

TwilioUnited States

We use Twilio to send and receive WhatsApp messages. Guest phone numbers and message content pass through Twilio's infrastructure. Twilio maintains appropriate international data transfer mechanisms.

OpenAIUnited States

We use OpenAI's API to classify incoming guest messages and generate appropriate replies. OpenAI does not use data submitted via its API to train its models. OpenAI maintains appropriate international data transfer mechanisms.

Make.comEuropean Union

We use Make.com as our automation platform and for temporary data storage during message processing. Make.com operates on EU-based servers and is GDPR-compliant.

Meta / WhatsAppGlobal

Messages are delivered to guests via the WhatsApp Business API. Meta's own terms of service and privacy policy apply to message delivery.

NotionUnited States

We use Notion as a CRM to store prospect and client contact information.

We do not sell your personal data to anyone. We do not share your data with any party other than those listed above, unless required to do so by law.

International data transfers

Some of our sub-processors are based in the United States. Where personal data is transferred outside of the United Kingdom, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent transfer mechanisms approved by the UK Information Commissioner's Office.

How long we keep your data

Guest message data

90 days

Host property data

Contract + 30 days

Billing & payment records

7 years

Prospect & pre-signup contact

12 months inactive

Retention periods reflect HMRC requirements, contractual obligations, and your right to ask us to remove data at any time.

Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of accessAsk for a copy of the personal data we hold about you.

Right to rectificationAsk us to correct inaccurate or incomplete data.

Right to erasureAsk us to delete your personal data in certain circumstances.

Right to restrict processingAsk us to limit how we use your personal data.

Right to objectObject where we rely on legitimate interests.

Right to data portabilityReceive your data in a structured, machine-readable format.

To exercise any of these rights, please email [email protected]. We will respond within one calendar month.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). HOSTARA is registered with the ICO under registration number ZC125088.

ICO website: ico.org.uk/make-a-complaint
ICO helpline: 0303 123 1113

Changes to this policy

We may update this privacy policy from time to time. Any changes will be published on this page with an updated "Last updated" date. If we make significant changes that affect how your data is processed, we will take reasonable steps to notify you.

About our AI system

HOSTARA uses artificial intelligence to classify incoming guest messages and generate replies to routine enquiries. Every message is assessed before a reply is sent. Messages classified as sensitive, complex, or high-risk are not answered by the AI, they are immediately escalated to the host.

HOSTARA is not a safety monitoring service. Guests should always contact emergency services directly in the event of an emergency. The host remains fully responsible for the safety and welfare of their guests at all times.

Questions about your data?

We're a small team and we read everything. Email us and we'll respond within one calendar month, usually much sooner.

[email protected]