Privacy Policy

Information We Collect

We collect information in several ways depending on how you interact with the Service:

Information You Provide Directly

• Account Information: Name, email address, phone number, profile photo, and authentication credentials when you create an account.
• Public Profile Information: Your Handle and any display name, photo, biography, links, workspace affiliations, services, policies, and other content you add to your public profile, along with your profile visibility settings.
• Organization Information: Company name, business address, team member details, and role assignments.
• Payment Information: Payment method details, billing address, and subscription information processed through Stripe. We do not directly store full credit card numbers.
• Property Information: Listing details, descriptions, photos, addresses, amenities, check-in/out instructions, WiFi credentials, house rules, and other property-related content you enter into the Service.
• Messages and Communications: Messages you compose, send, or receive through the Service, including messages sent via connected platforms (Airbnb, email, WhatsApp, etc.), internal team notes, and AI-generated message drafts.
• Files and Attachments: Photos, documents, receipts, and other files you upload to the Service.
• Preferences and Settings: Language preferences, notification settings, autopilot configurations, automated payment settings, and other account preferences.

Information from Connected Third-Party Platforms

When you connect third-party accounts to the Service (such as Airbnb, Hostaway, Guesty, Vrbo, Gmail, or WhatsApp), we receive data from those platforms, including:

• Reservation and booking details (dates, pricing, confirmation codes, statuses)
• Contact information for third parties associated with your bookings (names, email addresses, phone numbers)
• Listing and property data synced from connected platforms
• Messages and conversation history from connected messaging platforms
• Calendar and availability data
• Review and rating data
• OAuth access tokens and refresh tokens necessary to maintain the connection

Information Collected Automatically

• Log Data: IP address, browser type and version, operating system, pages visited, time and date of access, time spent on pages, and other usage statistics.
• Device Information: Device type, unique device identifiers, mobile operating system, and push notification tokens.
• Cookies and Similar Technologies: We use cookies, local storage, and similar technologies to maintain sessions, remember preferences, and collect usage data. See the "Cookies" section below for details.
• Analytics Data: Feature usage patterns, interaction data, and performance metrics collected through analytics tools.

Third-Party Personal Information

Through your use of the Service, you may provide us with personal information about third parties, such as individuals associated with your reservations, vendors, contractors, property owners, and other contacts. This information may include names, email addresses, phone numbers, physical addresses, booking details, and communication history. You are responsible for ensuring you have the necessary authorization to provide this information to us and that its use through the Service complies with applicable laws.

Information from Visitors to Public Profiles and Shared Links

If you visit a public profile or open a link that a user shared, we collect the log data described above. If you send a message through a public profile's contact form, we collect the name, contact details, and message you provide and deliver them to the profile's owner. If you report a public profile, we collect the content of your report and any contact details you provide.

Browser Extension (Vrbo Connect)

To connect certain platforms, such as Vrbo, we offer an optional Chrome browser extension ("Vrbo Connect"). The extension runs only after you install it and choose to connect your account, and it works solely with the platform you are connecting. When active, it:

• Reads the authentication session cookies for your own logged-in account on the connected platform (for example, your Vrbo Owner Dashboard session), so the Service can act on your behalf on that platform.
• Captures your device's public IP address at the time of connection, used only to route the Service's requests to the platform through a network region consistent with your own, which improves reliability.
• Reads the account email address shown on the connected platform's account-settings page, used only to confirm which account you are linking and to prevent linking the wrong account.

This information is transmitted over an encrypted (HTTPS) connection to your own ProhostAI account and stored encrypted. It is used only to sync your reservations, listings, and guest messages for the account you connected. It is never sold, and it is not shared with third parties except the service providers that operate the Service on our behalf (see "Third-Party Service Providers" below). You can disconnect the platform at any time in the app (Settings → Connections), which deletes the stored session; removing the extension from your browser stops it from capturing or sending any further data.

How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: Operating and maintaining the Service, including property management, reservation management, messaging, cleaning management, and payment facilitation features.
• AI-Powered Features: Generating message suggestions, automated responses, task detection, sentiment analysis, translations, and other AI-driven features. This involves transmitting relevant data to third-party AI providers (see "AI Data Processing" below).
• Automated Messaging: Sending messages on your behalf through connected platforms when you enable autopilot, scheduled messages, or other automated communication features.
• Payment Processing: Facilitating payments between account owners and vendors through Stripe, including automated payments upon task or cleaning completion.
• Public Profiles: Publishing your public profile at its web addresses, generating link previews for it, and, where your profile is listed, including it in the Service's directories and search results. Summary statistics on your profile are calculated only from your own business activity in the Service.
• Payment Account Setup: When you start setting up a payment or payout account, sending information from your account to Stripe to pre-fill its onboarding forms, as described in "Data Sharing" below.
• Communication: Sending you service-related notifications, push notifications, and account updates.
• Improvements and Analytics: Analyzing usage patterns to improve the Service, develop new features, and fix issues.
• Security: Detecting, preventing, and addressing fraud, abuse, security risks, and technical issues.
• Legal Compliance: Complying with applicable laws, regulations, and legal processes.

AI Data Processing

The Service uses third-party artificial intelligence providers to power AI features. When you use AI-powered features (including message suggestions, autopilot, automated responses, task detection, and content generation), the following data may be transmitted to AI providers:

• Message content and conversation history
• Contact names and information relevant to the conversation
• Listing and property details
• Reservation details
• Account preferences and custom instructions

Our AI providers include OpenAI, Anthropic, and Google. Data sent to these providers is processed in accordance with their respective privacy policies and data processing agreements. We use these providers solely to deliver AI features within the Service and do not sell your data to AI providers for their own purposes.

AI-generated content may be stored within the Service as part of your conversation and message history. We may also use aggregated, de-identified data to monitor AI quality and improve the Service.

Third-Party Service Providers

We share information with third-party service providers who assist us in operating and improving the Service. These providers are contractually obligated to use your information only as necessary to provide their services to us and in accordance with this Privacy Policy. Our service providers include:

• AI Providers: OpenAI, Anthropic, and Google — for AI-powered message generation, analysis, and automation features.
• Payment Processing: Stripe — for payment processing, subscription management, vendor payouts via Stripe Connect, and pre-filling Stripe account onboarding.
• Authentication: Clerk — for user authentication and session management.
• Cloud Infrastructure: Amazon Web Services (AWS) — for hosting and file storage (S3). Fly.io — for hosting application servers and background workers.
• Communication: Ably — for real-time messaging infrastructure. Firebase Cloud Messaging — for push notifications. Resend — for transactional email delivery.
• Error Tracking and Monitoring: Sentry — for error tracking. Grafana Labs (Grafana Cloud) — for application performance monitoring, metrics, and logs.
• Analytics: PostHog — for product analytics and feature usage tracking.
• Vector Search: Qdrant — for semantic search and AI memory features.
• Background Processing: Trigger.dev — for scheduled and event-driven background job execution. Cloudflare — for edge computing and webhook processing.

Data Sharing

We may share your information in the following circumstances:

• With Connected Platforms: When you send messages or update data through connected third-party platforms (e.g., Airbnb, Gmail, WhatsApp), the relevant content is transmitted to those platforms in accordance with your instructions.
• With Service Providers: As described in the "Third-Party Service Providers" section above.
• Within Your Account: Information is shared among authorized members of your account based on their assigned roles and permissions.
• Publicly, Through Your Public Profile: The information on your public profile is available to anyone on the internet unless you hide your profile. If your profile is unlisted, it is available to anyone who has its web address. See "Public Profiles and Shared Links" below.
• With People You Share Links With: When you share an item through a link, anyone who has the link can see the item as shown in its shared view, which may include the names of people who appear in or contributed to the item.
• With Stripe to Set Up Your Payment Account: When you start setting up a Stripe account through the Service, we send Stripe information such as your business name, display name, contact email, country, a description of your services, your industry category, and your public profile's web address, so that Stripe can pre-fill its onboarding forms. Stripe processes this information under its own privacy policy.
• For Legal Reasons: We may disclose information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.

We do not sell your personal information to third parties. We do not share your personal information with third parties for their own marketing purposes.

Public Profiles and Shared Links

Public profiles. Each user account on the Service has a public profile. A profile shows your display name (your first name and last initial, or your business name), your Handle, and any content you choose to add. It never shows your client list, street addresses, guest or reservation details, earnings, or property owners' properties or statements, unless you add that content yourself. You can hide your profile at any time in your profile settings. When you change your Handle, your previous Handle is held for 14 days; when your account is deleted, your Handle is held for 30 days. After that, we may release it to other users.

Region defaults. If your account is located in the European Economic Area, the United Kingdom, Switzerland, or Québec, your profile is unlisted by default: anyone with its web address can view it, but it is not listed in our directories or search results, and search engines are asked not to index it.

Shared links. When you share an item by link, the recipient sees a limited view of it. Shared views are designed to show people by first name where possible, but some items (for example, documents with comments) may show the names of people who contributed to them, so review an item before you share it. We record each time a shared link is opened, including the date and time and the log data described above, and may show the person who shared the link a record of those views. Where the Service lets you revoke or replace a shared link, doing so stops further access through that link.

Legal basis (EEA, UK, and Switzerland). We publish your unlisted public profile based on our legitimate interest, and yours, in letting the people you work with identify and contact you as a professional through a stable web address. We limit the profile to professional information, keep it unlisted and out of search engines by default, and let you hide it at any time. You have the right to object to this processing; hiding your profile gives effect to that objection. If you choose to make your profile listed, we rely on your consent, which you can withdraw at any time by changing the setting back. We pre-fill Stripe onboarding to perform our contract with you, because you asked us to set up a payment account. We log views of shared links based on our legitimate interest in security and in telling users who has accessed what they shared.

Google User Data

If you connect a Google account to the Service, our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Calendar: With your permission, we read your calendar list and calendar events (read-only) to display your schedule, remind you before meetings, and attach meeting notes to events.
• Gmail: We read or send Gmail messages only for the mailbox features you enable, such as syncing conversations with your contacts and sending replies on your behalf.

We do not use Google user data for advertising, we do not sell it, and we do not transfer it to third parties except as needed to provide the features you enabled, to comply with applicable law, or with your explicit consent. Google user data is not used to develop, improve, or train generalized artificial intelligence or machine learning models.

You can disconnect a Google account at any time from Settings → Connections in the Service. Disconnecting revokes our access and deletes the Google data stored for that connection, subject to the retention exceptions described in the "Data Retention" section. You can also revoke access from your Google Account permissions page.

Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service, maintain your session, remember your preferences, and understand how the Service is used. Cookies are small data files stored on your device by your browser.

• Essential Cookies: Required for the Service to function, including authentication and session management.
• Analytics Cookies: Used to collect usage data and understand how users interact with the Service.
• Preference Cookies: Used to remember your settings and preferences (such as language selection).

You can control cookies through your browser settings. Disabling certain cookies may limit your ability to use some features of the Service.

Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

• Account Data: Retained for the duration of your account and for a reasonable period after account closure to comply with legal obligations and resolve disputes.
• Public Profile Information: Displayed while your profile is visible and your account is active. When you hide your profile or delete your account, we stop displaying it. Former Handles are held for the periods described in "Public Profiles and Shared Links" before release.
• Shared Link Activity: Records of views of shared links are retained for up to 24 months, the same as other log data.
• Messages and Communication History: Retained for the duration of your account. You may delete individual conversations through the Service.
• Payment Records: Retained as required by applicable tax and financial regulations.
• Log and Analytics Data: Retained for up to 24 months for operational and analytical purposes.
• Signed Agreements and Evidence Records: Signed rental agreements and their associated audit records are retained for up to 7 years from signing, reflecting typical statutes of limitations for contract claims, unless a longer retention is required by law.
• Guest Identity Documents and Photographs: Government-issued ID images and check-in photographs collected through host-configured verification steps are retained for up to 12 months after upload and then automatically deleted, unless subject to a legal hold or a legal retention obligation. Cryptographic fingerprints (hashes) of these files, which do not contain or reveal the images themselves, may be preserved as part of signed agreement records.
• Third-Party Personal Information: Retained for the duration of your account. You are responsible for managing the retention and deletion of third-party personal information in accordance with your own legal obligations.

Upon account termination, we may retain certain information as required by law or for legitimate business purposes, such as fraud prevention and legal compliance. We will delete or anonymize your information within a reasonable timeframe following account closure, except where retention is required or permitted by law.

Data Security

We implement commercially reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/SSL), access controls, and regular security assessments. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

OAuth tokens used to connect third-party platforms are stored securely and are only used to maintain authorized connections on your behalf. You can revoke access to any connected platform at any time through the Service.

International Data Transfers

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to the United States and other countries as described in this Privacy Policy.

Your Rights and Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to certain legal exceptions.
• Data Portability: Request a copy of your data in a structured, commonly used format.
• Opt-Out: Opt out of certain data processing activities, including marketing communications.
• Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.
• Disconnect Platforms: Revoke access to any connected third-party platform at any time through the Service, which will stop further data collection from that platform.
• Public Profile Controls: Hide your public profile, change whether it is listed, and remove content from it at any time through the Service.

To exercise any of these rights, please contact us at support@prohost.ai. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collecting the information, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• No Sale of Personal Information: We do not sell personal information as defined under the CCPA.

To submit a CCPA request, please contact us at support@prohost.ai.

European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing: We process your personal data on the following legal bases: performance of our contract with you (providing the Service), your consent (where explicitly obtained), our legitimate interests (improving the Service, security, fraud prevention), and compliance with legal obligations. For public profiles, shared-link activity, and Stripe onboarding pre-fill, see the legal bases in "Public Profiles and Shared Links".
• Data Subject Rights: In addition to the rights listed in "Your Rights and Choices" above, you have the right to object to processing based on legitimate interests and the right to lodge a complaint with your local data protection authority.
• Data Transfers: When we transfer your personal data outside the EEA, we rely on appropriate safeguards, including standard contractual clauses approved by the European Commission.
• Data Controller: For personal data of your account users and team members, Prohost AI, Inc. acts as the data controller. For personal data of third parties that you process through the Service (such as contacts associated with your reservations, vendors, and property owners), you are the data controller and Prohost AI, Inc. acts as the data processor.

Push Notifications

We may send push notifications to your mobile device to provide Service-related updates, including new messages, reservation alerts, cleaning reminders, and other notifications. You can manage your push notification preferences through the Service settings or your device settings at any time.

Links to Other Sites

The Service may contain links to third-party websites and services not operated by us. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at support@prohost.ai.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will update the "Updated" date at the top of this page and may notify you through the Service or by other reasonable means. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.