Privacy Policy

Last updated: October 8, 2026

Insporation, Inc. ("hostAI," "we," "our," or "us") respects the privacy of the people who use our website and products. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the choices you have.

It applies to:

• our website at gethostai.com and its subdomains (the "Website");
• our client application at app.gethostai.com (the "App");
• the account, billing, onboarding, support, and marketing relationship we have with our clients (together with the Website and the App, the "Services").

It does not apply to the direct-booking websites we build and host for our clients. Those sites are operated by the property manager named on them, under that property manager's own privacy notice. Section 1 explains our role for data collected on those sites.

"Personal data" means any information that identifies, relates to, describes, or can reasonably be linked to a particular person or household. We use "personal data" and "personal information" interchangeably.

Your use of the Services is also governed by our Terms of Service, which incorporate this Privacy Policy. California residents and people in the EEA or UK should also read the additional disclosures at the end of this policy.

1. Our role

Clients. Short-term rental property managers and operators who sign up for hostAI, and the people who act for them (owners, staff, contractors). When we collect your personal data to run your account, bill you, support you, or market to you, hostAI decides how and why the data is used. In privacy-law terms we are the "controller" or "business" for that data. This policy is written for you.

Guests and visitors of client sites. hostAI provides the technology behind our clients' direct-booking websites and the guest emails and advertising they run. Data about a client's guests and site visitors belongs to that client. We process it only on the client's instructions, as the client's "processor" or "service provider," and we do not use it for our own purposes, sell it, or share it with other clients. The client is responsible for the privacy notice on its own website and for the consents it collects there.

If you are a guest and want to access, correct, or delete your data, or stop receiving messages from a property manager, contact that property manager. If you write to us instead, we will forward your request to the property manager and help it respond.

2. Personal data we collect

We collect only what we need to provide the Services.

2.1 Information you give us

Account and signup. When you create an account we ask for your name, work email address, company name, business address, the property management system (PMS) you use, and a phone number. The phone number is required so that we can contact you about your account and onboarding. We send text messages to it only if you separately opt in (Section 5).

PMS connection. To connect your PMS you provide an API key or authorize an integration. Through that connection we receive your listings, availability, rates, bookings, and guest records. We hold guest records as your service provider, as described in Section 1.

Brand assets and content. Your logo, photos, copy, reviews, policies, and other material you upload or point us to.

Billing. Billing is handled by Stripe, which collects your payment details directly. We receive confirmation of payment, the card brand, the last four digits, and your billing address. We do not store full card numbers.

Advertising accounts. If you use hostDistro, you grant us access to your own Google Ads account, and we receive the campaign, cost, and conversion data in it.

Communications. When you email us, book a demo, chat with us, join a video call, or reply to a message, we keep the content of that conversation and your contact details. Sales and onboarding calls may be recorded and transcribed by an AI note-taking tool so that we can keep accurate records. We will tell you at the start of a call if it is being recorded.

Conversations with our AI assistant. The Website offers an AI video assistant (currently named "Hazel") that answers questions about hostAI. If you start a conversation, your microphone audio, a transcript, and anything you tell the assistant (such as your name, email, portfolio size, and PMS) are captured so that our team can follow up. The assistant identifies itself as an AI at the start of each conversation. Your camera is not used.

2.2 Information collected automatically

Device and usage data. When you visit the Website or the App we receive your IP address, browser type, operating system, device type, referring page, pages viewed, links clicked, time spent, and approximate location inferred from your IP address.

Cookies and tags. We use cookies, pixels, and tags on the Website and the App. Section 6 explains what they do and how to control them.

Analytics. We use Google Analytics 4 on the Website to understand how pages are used.

Spam protection. Forms on the Website may use Google reCAPTCHA, which collects device and interaction data under Google's privacy policy.

Email engagement. Emails we send you may include a small image or tracking link that tells us whether the message was opened and which links were clicked.

2.3 Information from other sources

• Your PMS (Guesty, Hostaway, Hostfully, OwnerRez, or another system we support), as described above.
• Google, including Google Ads performance data and Google Search Console data for your domain.
• Public sources such as your existing website and listing pages, which we use to build your site and to identify prospective clients.
• Business contact providers used by our sales team to find and enrich prospective client contacts.

3. How we use personal data

3.1 Client data

We use your personal data to:

• create and run your account, connect your PMS, and build, host, and maintain your direct-booking website;
• send guest emails and run advertising on your behalf, and report the results to you;
• bill you and collect payment;
• provide support, onboarding, and training;
• send you service messages about your account, your site, and changes to the Services;
• send you marketing about hostAI products and content, which you can opt out of at any time;
• understand how the Services are used so we can improve them;
• detect, prevent, and respond to fraud, abuse, and security incidents;
• comply with the law, enforce our Terms, and protect our rights and the rights of others.

3.2 Guest data held for clients

We use guest and visitor data only to provide the Services to the client whose website or PMS it came from. We do not use one client's guest data to market another client's properties, and we do not sell it. We may produce aggregated, de-identified statistics across clients (for example average direct-booking share) that cannot reasonably be linked to any person.

3.3 Artificial intelligence

We use third-party AI models to generate and improve content as part of the Services: website copy drafted from your PMS data and brand assets, guest segments and email copy for hostMail, the Hazel assistant on the Website, and transcripts and summaries of recorded calls. To do this we send the relevant data to AI providers (currently Anthropic and OpenAI) under commercial API terms that prohibit them from using it to train their models. AI output can be wrong; you are responsible for reviewing content before it is published to guests.

3.4 Legal bases (EEA and UK only)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Services to a client); our legitimate interests (improving and securing the Services, marketing to businesses, enforcing our rights); consent (non-essential cookies, SMS, and marketing where consent is required); and legal obligations. For guest data we act on the client's instructions, and the client is responsible for its own lawful basis.

4. How we share personal data

We do not sell personal data. We share it only as described here.

With service providers (sub-processors). Companies that process data for us under contract, only to provide the Services:

We will update this list when providers change. Clients may ask to be notified of sub-processor changes by email.

With your PMS and your payment processor. Booking and guest data goes to your PMS. Payment details go to your processor.

With Google (hostDistro). We manage Google Ads campaigns inside your own Google Ads account. Google serves the ads and collects data from people who see or click them under Google's privacy policy.

With professional advisers and in a business transfer. Lawyers, accountants, insurers, and, if we are involved in a merger, acquisition, financing, or sale of assets, the other party and its advisers under confidentiality terms.

When required by law or to protect rights. To comply with a subpoena, court order, or lawful request; to enforce our Terms; or to protect the safety, property, or rights of hostAI, our clients, their guests, or the public.

With your consent or at your direction.

SMS data. Mobile phone numbers and text-message opt-in consent are never shared with or sold to third parties or affiliates for marketing or promotional purposes. See Section 5.

5. Text messages (SMS)

This section describes text messages that hostAI sends to clients and prospective clients. Text messages that a property manager sends to its own guests are governed by that property manager's privacy policy.

How we get your consent. We send text messages only to people who have opted in by checking an unchecked box at signup or on a form on the Website, or by texting a keyword (such as START or JOIN) to our number. Providing your phone number alone does not opt you in. Consent to receive text messages is not a condition of purchasing any product or service from hostAI.

What we send. Account, onboarding, and setup notifications (for example, that your PMS connection needs attention or your site is ready for review), appointment reminders, and, if you choose, two-way conversations with our team about your account. We do not send promotional text campaigns unless you have separately opted in to marketing texts.

How often. Message frequency varies by account activity. During onboarding you may receive several messages a week; afterwards, typically a few per month.

Cost. Message and data rates may apply. Check with your carrier.

Opting out. Reply STOP to any message to stop receiving texts from hostAI. You will receive one final message confirming your opt-out. After that we will not text you unless you opt in again.

Help. Reply HELP to any message or email [email protected].

No sharing of SMS consent. Mobile information and SMS opt-in consent will not be shared with or sold to third parties or affiliates for marketing or promotional purposes. We share phone numbers only with the messaging vendor that delivers the messages, and only so it can deliver them.

Carriers. Wireless carriers are not liable for delayed or undelivered messages.

6. Cookies and similar technologies

On the Website and the App we use these categories of cookies and tags:

• Strictly necessary. Keep you signed in, remember your choices in a session, protect forms against bots, and balance load. These cannot be turned off.
• Analytics. Google Analytics 4 tells us how pages are used so we can improve them.
• Advertising and measurement. Google Ads conversion and remarketing tags for our own advertising.
• Preferences. Remember display choices.

Your choices. You can block or delete cookies in your browser settings; allaboutcookies.org explains how. Blocking cookies may stop parts of the App from working. You can opt out of Google Analytics with Google's browser add-on and manage ad personalization at adssettings.google.com. We do not currently respond to "Do Not Track" or Global Privacy Control browser signals; California residents can opt out of sharing for advertising by emailing us (see the California section).

7. Your choices and rights

Marketing email. Click unsubscribe in any marketing email from hostAI, or email us. You will still receive service messages about your account.

Text messages. Reply STOP (Section 5).

Account information. Clients can update their contact and billing details in the App or by contacting support.

Access, correction, deletion, portability, and objection. Depending on where you live, you may have the right to ask what personal data we hold about you, to correct or delete it, to receive a copy in a portable format, to object to or restrict certain processing, to withdraw consent, and to appeal a decision we make on your request. To exercise a right, email [email protected] with the subject line "Privacy request." We will verify your identity, usually by confirming control of the email address on file, and respond within the time the law requires. We will not discriminate against you for exercising a right.

Guests. If your data came to us through a client, we will refer your request to that client and help it respond.

Authorized agents. You may use an authorized agent to make a request. We may ask for proof of the agent's authority and ask you to confirm the request directly.

8. Data retention

We keep personal data for as long as needed for the purposes above, and then delete or de-identify it.

• Client account data: for the life of the account and 90 days after it closes, except billing records, which we keep for seven years for tax and accounting purposes.
• Guest and PMS data held for a client: for the life of the client's subscription, then deleted or returned as described in the Terms of Service. Copies in encrypted backups age out within 35 days after that.
• Website analytics: Google Analytics data for 14 months.
• Call recordings, transcripts, and AI assistant conversations: 12 months.
• SMS consent records: for as long as we hold the number plus four years, so that we can demonstrate consent.
• Aggregated or de-identified data: may be kept indefinitely.

9. Security

We protect personal data with safeguards that are reasonable for the data we hold, including encryption in transit and at rest, access controls and least-privilege permissions, audit logging, secrets management, and vendor security review. Payment card data is handled by PCI-DSS-compliant processors and never stored by us. No system is perfectly secure. If a breach affects your personal data we will notify you and any regulator as the law requires.

10. International transfers

hostAI is based in the United States and stores data on Google Cloud infrastructure in the United States. If you use the Services from outside the United States, your personal data will be transferred to and processed in the United States, where privacy laws may differ from those in your country. Where the law requires a transfer mechanism, we rely on standard contractual clauses or another approved safeguard, and we will enter into a Data Processing Addendum with clients who need one.

11. Children

The Services are for businesses. They are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

12. Third-party sites and services

The Services link to and integrate with sites and services we do not control, including PMS platforms, payment processors, and Google. Their privacy practices are their own.

13. Changes to this policy

We will post any changes on this page with a new "last updated" date. If a change materially reduces your rights or expands how we use data we already hold, we will notify clients by email before the change takes effect.

14. How to contact us

Insporation, Inc. (hostAI)
1259 Guerrero Street
San Francisco, CA 94110
United States

Privacy requests: [email protected]
Support: [email protected]

To appeal a decision we make on a privacy request, reply to our response with "Privacy appeal" in the subject line.

Additional disclosures for California residents

This section supplements the rest of this policy for California residents.

What we collect and why. Sections 2 and 3 describe the categories of personal information we collect (identifiers, customer records, commercial information, internet activity, approximate geolocation, audio recordings, professional information, and inferences such as lead scores) and the purposes for each. Section 8 describes how long we keep it. We do not collect sensitive personal information other than account credentials.

Sale and sharing. We do not sell personal information. We "share" (as the CCPA defines it) internet activity and identifiers with Google for cross-context behavioral advertising on gethostai.com. You can opt out by emailing us or by managing ad personalization at adssettings.google.com. We do not knowingly sell or share the personal information of anyone under 16.

Your rights. You have the right to know what personal information we collect, use, disclose, and share; to delete it; to correct it; to opt out of sale or sharing; and not to be discriminated against for exercising these rights. Submit requests by email to [email protected]. We will verify your request as described in Section 7.

Service provider status. When we process guest data for a client, we act as the client's service provider. We use that data only to provide the Services to the client and do not sell or share it.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing.

Additional disclosures for the EEA and UK

Roles. hostAI is the controller for client account, billing, support, and marketing data. hostAI is a processor for guest and visitor data handled for a client; the client is the controller. Our Data Processing Addendum, available on request, governs that processing.

Lawful bases. See Section 3.4.

Your rights. You have the rights listed in Section 7, including the right to withdraw consent at any time, to object to processing based on legitimate interests, and not to be subject to a solely automated decision with legal or similarly significant effects. You may also complain to your supervisory authority; in the UK that is the Information Commissioner's Office (ico.org.uk).

Transfers. Data is processed in the United States under the mechanisms described in Section 10.