Privacy notice
What is stored
- Reservations - mirrored from the host's own booking system (today, Smoobu): dates, the booking reference and the guest details the booking system itself gives GuestHostAI.
- Guest messages - the questions a guest asks and the replies GuestHostAI drafts or sends.
- The host's own sources and the facts read from them - a guide, document, photo, video or note the host adds, and the facts GuestHostAI extracts from it to answer guests.
- Alerts - the in-app notices raised to the host (for example, "a guest sounds upset" or "this question could not be answered").
- A guest's phone number, when one is used to message through WhatsApp or Telegram, is stored only as a one-way hash - the plain number is never kept.
How long it is kept
- A guest message is kept for 90 days, then automatically deleted.
- An alert is kept for 180 days, then automatically deleted.
- A cached description of an uploaded photo or video (what it shows) is kept for 365 days, then regenerated if the photo or video is still in use, or deleted if it is not.
- A guest's phone number is kept only as its one-way hash, for as long as the booking or channel binding that needs it exists.
Deleting an account or a property
Deleting a GuestHostAI account, or removing one property from it, stops the AI acting for it at once. For 7 days the host can undo the deletion from the app; after that window every trace of the deleted account - or of the removed property's own data - is permanently wiped, and nothing a later booking-system sync sends is allowed to bring it back.
Where it is processed
GuestHostAI's storage and processing run on Amazon Web Services in the eu-central-1 (Frankfurt, EU) region.
Outside services this data goes to
GuestHostAI is built to send as little as possible to each outside service, and never a guest's message to one that does not need it. These are the services any GuestHostAI data can reach:
- Amazon Web Services - hosts everything above: storage, the running software, and the host's alert emails.
- Anthropic's AI models, through Amazon Bedrock - read a guest's question and the host's own material to draft or write a reply.
- LangSmith (EU region) - receives a trace of each AI run (the steps it took and the text it worked from), used to debug and improve the assistant.
- TypeSafe AI (hosted in the United States) - compares knowledge-base answer text to find repeated answers. Only that already-scrubbed text is sent, never a guest's own message; anything that could identify a guest is removed first, and door codes, long numbers and passwords are masked before the text leaves. TypeSafe does not train its models on this data.
- Stripe - processes the host's subscription payment.
- Google (Docs, Drive, Sheets, Slides) - when a host adds a link to a shared Google document or file as a knowledge-base source, GuestHostAI downloads that document from Google through its public export link. No Google sign-in is used and nothing about a guest is sent to Google. Sign-in with a Google account is planned and not yet available.
- YouTube - when a host adds a YouTube video as a knowledge-base source, GuestHostAI downloads that video from YouTube to read what it shows. Nothing about a guest is sent to YouTube.
- Any other web page a host links - when a host adds a web address as a knowledge-base source, GuestHostAI downloads that page from the site it points to. Nothing about a guest is sent to it.
- Meta, through the WhatsApp Cloud API - if a host connects WhatsApp as a messaging channel, a guest's messages on that channel pass through Meta's API to reach GuestHostAI and to be sent back.
- Telegram - the same, for a host who connects Telegram as a channel.
- The host's own property-management system (Smoobu today) - GuestHostAI reads a reservation and a guest's messages from it, and writes a reply back to it.
Who to contact
Ales Pogacar s.p
Ulica Ljudevita Stiasnyja 12, Kamnik, 1241, SI
Questions about this notice, or a request to see or delete your data: hello@guesthostai.com.