How OpenStays.AI handles data

OpenStays.AI determines why and how personal data is used for this service and acts as the controller for that processing. Contact privacy@openstays.ai for privacy matters and hello@openstays.ai for general service questions.

This policy describes the current service. It is not a certification of legal compliance and will be reviewed as the product, processing and applicable law change.

Account and contact details: your email address, verification status, session records, and any name you choose to provide. If you choose Google sign-in, we also receive Google’s stable account identifier and verified email and name claims needed to authenticate and link your account.

Property Passport details: property or agency name, website, booking email, telephone and WhatsApp contact details, location fields, capacity, amenities, policies, media URLs, suitability notes, caveats, address privacy preference, and publication status.

Property build details: property and listing URLs, contact email, text descriptions, uploaded source files and voice notes, filenames, file types and file sizes you submit when adding a property.

Business prospect details: public business contact details, property or company information, source URLs, evidence, market, outreach status, objections and suppression records. We record the source and lawful-basis evidence available to us and do not ask research agents to obtain private consumer data.

Technical records: essential authentication cookies, email-verification timestamps, API usage events if developer access is used, and basic service logs needed to keep the site secure and working.

To create and secure your account, including authenticating through Google when you choose that option. Google sign-in does not subscribe you to marketing.

To create, verify, save, export, publish and maintain OpenStays Property Passports.

To send login/verification emails and operational messages about your profile or setup request.

To prepare requested AI-assisted draft profiles from public or submitted property pages.

To prevent duplicate requests and store source files and voice notes privately while we prepare your draft.

To protect the service, prevent duplicate or misleading profiles, debug problems, and improve data quality.

To make published profile information available to people, search engines, and AI travel agents through public pages, JSON, Markdown, API, sitemap and structured-data endpoints.

To identify relevant property businesses from public business sources, prevent duplicate outreach, honour objections and maintain a durable do-not-contact record.

Contract or pre-contract steps: when you ask us to create an account, profile, setup request or draft.

Legitimate interests: operating OpenStays.AI, keeping profiles accurate, preventing abuse, improving the service, and contacting business/property operators about relevant OpenStays.AI profile activity where appropriate.

Consent: where you make an optional choice that genuinely relies on consent. Account creation or a request for a draft is not described as marketing consent.

Legal obligation: where we need to keep or disclose limited records to comply with law or respond to valid legal requests.

Only profiles you publish, or ask us to prepare for your approval, are intended for public discovery. Draft profiles stay private until published.

Published profiles may include property name, consented and verified website, booking email, telephone and WhatsApp contact routes, approximate or exact location depending on your setting, property facts, amenities, policy notes, suitability notes, public media URLs, confidence signals and machine-readable profile data. Public contact details can be indexed, copied and used by people, search engines and AI systems.

Private account data, email verification tokens, session cookies, uploaded source documents and unpublished drafts are not intentionally published.

OpenStays.AI may store full address details to reduce duplicates and improve profile quality, but you control public location visibility. By default, the product is designed to show limited public location detail unless you choose more precise visibility.

Do not publish an address or exact coordinates unless you have the right to share them and are comfortable with them being indexed by search engines and AI systems.

We use contracted service providers that help us operate account access, communications, secure document handling, service reliability, and AI-assisted drafting or research. They may process only the data needed to provide those services under the applicable terms and safeguards.

We do not sell personal data. We do not act as a booking agent, payment processor, travel seller, escrow provider or property inspector.

AI tools may help research public business information and prepare private Property Passport drafts. Uploaded and generated material is treated as untrusted and requires review before publication or operational use.

OpenStays.AI does not use these tools to make solely automated decisions that produce legal or similarly significant effects for owners, prospects or guests. Owners decide whether their Passport is published, and objections or rights requests are reviewed rather than decided solely by AI.

We keep account, prospect, setup request and profile records only while needed to provide the service, honour suppression and objection records, maintain audit or security evidence, resolve disputes, or comply with law. Prospect records have structured collection, notice, objection and retention-review fields so overdue reviews can be identified rather than relying only on free-text notes.

Property source documents are private and scheduled for deletion 90 days after upload. We may delete them sooner after the draft is delivered or when a valid deletion request is completed, unless limited retention is legally required.

Expired verification tokens and sessions may be deleted or anonymised. Published profile data may remain publicly cached by third parties even after removal from OpenStays.AI.

You can download a private JSON export of your complete Property Passport from your owner dashboard. Treat it carefully because it may include address and contact data that are not public.

Depending on where you live, you may also have rights to access, correct, export, delete, restrict or object to processing of your personal data, and to withdraw consent where processing relies on consent.

Authenticated owners can record a request from the Privacy & data page in their dashboard. You can also email privacy@openstays.ai. We may need to verify that you control the relevant email address or Property Passport before making changes.

You may complain to the UK Information Commissioner’s Office or, where applicable, your local data-protection authority. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching a regulator.

OpenStays.AI uses cloud services that may process data outside your country. Where required, we assess the transfer and use applicable contractual and organizational safeguards, which may include data-processing agreements and standard contractual clauses.

For privacy questions, profile removal, data access or deletion requests, contact privacy@openstays.ai.

This policy and the supporting controls should be reviewed by a qualified privacy lawyer. Technical controls and policy text are evidence of governance, not a substitute for that review.