Privacy Policy

This Privacy Policy explains how Hostlio Pro, operated by Loti Members LLC (“we”, “us”), collects, uses and shares personal data when you visit hostliopro.com, sign up, or use the Hostlio Pro dashboard, mobile app and guest-facing features.

1. Our role

For data about our customers (hotel owners and staff) and website visitors, we are the controller. For data about a hotel’s guests that we process to run the service for that hotel, the hotel is the controller and we act as its processor (a “service provider” under California law). That processing is governed by our Data Processing Addendum. Guests who want to exercise their rights should contact the hotel; we help the hotel respond.

2. Data we collect

• Account data: name, email, phone, hotel name, number of rooms, country, guest currency and time zone
• Billing data: plan, billing period and payment status. Card details are collected and stored by Stripe, never by us
• Hotel data: room types, rooms, rates, availability, reservations and settings
• Guest data processed for hotels: guest names, contact details, booking details and the content of guest messages received on WhatsApp and OTA inboxes
• Online check-in data: identity document details and images, date of birth, nationality, companions and a digital signature, when the hotel uses online check-in. We treat this as sensitive data
• Signup and security data: IP address, a hashed email and the outcome of signup attempts, used to prevent fraud and abuse
• Marketing source: the first campaign or page that brought you to our website (for example UTM parameters and the referring site), stored in your browser and sent with your signup
• Usage data: how the dashboard and app are used, and technical logs

3. How we use data

• To provide the service: syncing channels, showing reservations, sending guest messages and running online check-in
• To draft and send AI replies to guest messages on the hotel’s behalf
• To run your subscription: the free trial, automatic charges when the trial ends and at each renewal, invoices and plan limits such as the monthly AI message quota
• To keep the service secure and prevent fraud
• To measure which marketing channels bring customers
• To answer support requests and send service and billing emails
• To meet legal obligations

We do not sell personal data and we do not share it for cross-context behavioural advertising. Guest message content is not used for our marketing. Our AI provider processes message content only to generate replies and, under its commercial terms, does not use it to train its models.

4. Legal bases (EEA, UK, Türkiye)

We rely on performance of our contract with you, our legitimate interests (security, fraud prevention, improving the service, measuring marketing), compliance with legal obligations and, where required, your consent. For guest data, the hotel determines the legal basis.

5. Who we share data with

We use the subprocessors below. Each is bound by a contract that protects the data. When you connect a sales channel (such as Booking.com, Airbnb or Expedia), data is exchanged with that channel under its own terms.

* Planned — added to this list before they process any data

We may also disclose data when required by law or to protect our rights.

6. International transfers

We are based in the United States and some subprocessors process data outside the EEA, the UK and Türkiye. Where required, transfers are protected by the European Commission’s Standard Contractual Clauses, the UK Addendum or other lawful transfer mechanisms.

7. How long we keep data

• Guest message content is anonymised after the retention period the hotel sets in its settings (default: 60 days)
• Guest contact details are kept for 90 days after departure, unless the hotel deletes them sooner
• Online check-in data is kept only as long as the hotel needs it to meet its guest-registration duties, and is deleted with the hotel’s account at the latest
• Account and hotel data are kept while the account is active and deleted within 30 days of a verified deletion request
• Billing records are kept for as long as tax and accounting law requires
• Signup and security logs are kept for a limited period for fraud prevention

8. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted by role and by hotel. Our database provider is SOC 2 Type 2 audited and card payments are handled by Stripe, a PCI DSS Level 1 service provider. More on our Security and data page.

9. Your rights

EEA and UK: you can request access, correction, deletion, restriction, portability, and object to processing. You may also complain to your local data protection authority.

California (CCPA/CPRA): you can ask to know, delete and correct your personal information. We do not sell or share personal information, and we will not discriminate against you for exercising your rights.

Türkiye (KVKK): under Article 11 of Law No. 6698 you can learn whether your data is processed, request information, correction or deletion, and object to results arising from automated processing.

To exercise any right, email hello@hostliopro.com. To close your account, see Delete your account.

10. Cookies and browser storage

The dashboard uses essential cookies and storage to keep you signed in. Our website stores your language choice and the first marketing source in your browser’s local storage. We do not use advertising cookies. If we add website analytics, we will update this policy first.

11. WhatsApp and guest messaging

Hostlio Pro connects to the WhatsApp Business Platform and to OTA inboxes to send and receive guest messages for hotels. Guest phone numbers are used only to communicate about the stay. Guests can stop receiving messages by telling the hotel.

12. Children

Hostlio Pro is a business service and is not directed to children under 16.

13. Changes

We will post changes on this page and update the date above. For material changes we will also notify customers by email or in the dashboard.

14. Contact

• Email: hello@hostliopro.com
• Address: Loti Members LLC, 2108 N ST STE N, Sacramento, CA 95816