Privacy Policy

Last updated: July 17, 2026

StayPilot is operated by HN International (“we”, “us”), which is the data controller for personal data processed through the Service. This policy explains what we collect when you use staypilot.ai and app.staypilot.ai, why we collect it, and the choices you have. The short version: we collect what we need to run the product, we don’t sell your data, and we don’t run advertising trackers.

1. Data we collect

• Account data — your email address and a hashed password (we can never see the password itself). If you sign in with Google, Google shares your verified email with us; we never see your Google password.
• Listing data — the listing URL you submit and the publicly visible content of that page (title, description, photos, amenities, reviews, location), which we fetch at your request and store to power your dashboard.
• Preferences — choices you make in the product, such as your primary content language.
• Waitlist / contact data — the email you give us on the landing page or when you write to us.
• Technical logs — like most services we keep server and error logs (IP address, browser user-agent, requested page, time) to keep the Service secure and debug problems. Sensitive values such as passwords are redacted from logs.
• Usage analytics — we use Google Analytics 4 to understand how the site and app are used (pages viewed, approximate location by country/city, device and browser, referring site, and interactions such as starting a trial). Google assigns a random identifier to your browser; we do not upload your name or email to it.
• Billing data — handled by Paddle, our merchant of record. Card numbers go directly to Paddle and never touch our servers; we receive only subscription status and receipts.

2. What we use it for

• Operating the Service: analysing your listing, generating content, tracking AI answers.
• Transactional email — password resets, verification, receipts, service notices.
• Security, abuse prevention, rate-limiting, and debugging.
• Improving the product using aggregated, de-identified usage patterns.

We do not sell personal data, and we don’t run advertising or ad-retargeting cookies.

3. Cookies

We use two kinds of cookies:

• Essential — a session cookie that keeps you signed in (separate ones for the marketing site and the app) and short-lived security tokens (CSRF). The Service cannot work without these.
• Analytics — Google Analytics 4 sets first-party cookies (_ga, _ga_*) to measure visits and recognise returning browsers. These are used only to understand and improve the product, never for advertising.

You can block or delete cookies in your browser, install Google’s opt-out add-on, or browse with “Do Not Track” / tracking protection enabled — the Service continues to work with analytics blocked.

4. Who processes data for us

We share data only with the processors needed to run StayPilot:

• Paddle — checkout, payments, taxes, receipts (merchant of record).
• Brevo — sending transactional email.
• ScrapingBee — fetching the public listing pages you submit.
• OpenAI — generating article drafts from your listing’s public content.
• Google — optional “Sign in with Google” authentication, and Google Analytics for usage measurement.
• Our hosting and infrastructure providers, which store the databases and logs above.

Each processor receives only what its job requires and acts under its own data-processing terms.

5. Retention

Account and listing data are kept while your account exists. Error and security logs are kept for a limited operational window and then pruned. Waitlist emails are kept until you ask us to remove you. When you delete your account (or ask us to), we delete or de-identify your personal data within 30 days, except records we must keep for legal or accounting reasons (which Paddle holds for billing).

6. Your rights

Depending on where you live (including under the GDPR), you can ask us to access, correct, export, or delete your personal data, or object to a use of it. Email [email protected] and we will respond within 30 days. You can also unsubscribe from any non-essential email with one click.

7. Security

All traffic is encrypted with HTTPS, passwords are stored only as strong one-way hashes, access to production data is restricted, and failed sign-ins are rate-limited. No system is perfectly secure — if we learn of a breach affecting your data we will notify you as the law requires.

8. International transfers

Our processors may store data in other countries. Where required, transfers rely on appropriate safeguards such as standard contractual clauses provided by each processor.

9. Children

The Service is for adults managing rental listings and is not directed at children under 16. We do not knowingly collect their data.

10. Changes

If we change this policy in a material way we will notify you by email or in the app before the change takes effect. The “Last updated” date above always reflects the current version.

11. Contact

Privacy questions or requests: HN International · [email protected].