Boring Host AI Ltd, 128 City Road, London, United Kingdom, EC1V 2NX. Questions about anything on this page: contact@boringhost.ai.
1. Who we are
Boring Host AI Ltd ("boring host", "we") provides AI agents for property managers. This policy explains how we handle personal data. For our own website visitors, prospects, and customer account holders we act as controller. For guest, owner, staff, and vendor data that our customers run through the platform, we act as processor on our customers' behalf under our Data Processing Agreement, if you are a guest of a property manager who uses boring host, that property manager is the controller of your data and their privacy notice applies alongside this one.
2. What we collect
- Account data, your name, business name, email, phone number, and billing details when you sign up or talk to us.
- Customer content (as processor), data our customers connect or generate through the platform: guest and owner names and contact details, reservation and booking data, message content across channels (email, SMS, WhatsApp, booking-platform threads), call recordings and transcripts from AI voice services, work orders, and related operational records.
- Usage data, log and device information, pages visited, feature usage, IP address, and diagnostic events.
- Payment data, handled by our payment processors; we do not store full card numbers.
- Marketing data, your contact details and preferences if you subscribe to our newsletter or talk to sales.
3. How we use it, and our lawful bases
- To provide the platform (performance of a contract), operating Sidekicks, syncing with your PMS, sending and receiving communications you configure.
- To secure and improve the service (legitimate interests), monitoring for abuse, debugging, measuring what works, developing features.
- To communicate with you (legitimate interests or consent), service messages, and marketing you can opt out of at any time.
- To comply with the law (legal obligation), accounting, tax, and responding to lawful requests.
4. AI processing
Sidekicks use large language model providers to generate and understand text and speech. Our AI subprocessors currently include Anthropic, OpenAI, and Google. Data is sent to them only to provide functionality (for example drafting a reply to a guest message) under agreements that prohibit them from using it to train their general models. We do not use identifiable personal data to train general-purpose AI models without explicit consent. Aggregated, anonymised usage statistics may be used to improve the service.
5. Who we share data with
- Cloud hosting and infrastructure providers that run the platform.
- Communications infrastructure (telephony and SMS carriers, and Meta's WhatsApp Business Platform) to deliver the channels you use.
- AI providers as described above.
- Analytics providers for our marketing site (see the Cookie Policy).
- Payment processors for billing.
- Professional advisers and authorities where the law requires.
We do not sell personal data.
6. International transfers
Some providers process data outside the UK and EEA. Where they do, we rely on UK adequacy regulations, the UK International Data Transfer Addendum, or EU Standard Contractual Clauses, together with additional safeguards where appropriate.
7. Security
We protect data with encryption in transit and at rest, access controls and least-privilege permissions, tenant isolation, logging, and regular reviews. No system is perfectly secure; if a personal data breach occurs that we are required to report, we will notify the relevant supervisory authority without undue delay and within 72 hours where feasible, and affected individuals where the risk requires it.
8. Retention
- Account data, for the life of the customer relationship and up to 3 years after, unless the law requires longer.
- Customer content we process on your behalf, for as long as your workspace instructs; deleted on termination per the DPA, normally within 90 days.
- Financial records, 6 years, per UK tax requirements.
- Marketing data, until you opt out.
9. Your rights
Under UK and EU data protection law you can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests, withdraw consent at any time, and object to direct marketing. You will not be discriminated against for exercising your rights. Write to contact@boringhost.ai; we verify requests before acting on them and normally respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
If you are a California resident, you have equivalent rights under the CCPA/CPRA, including the rights to know, delete, correct, and to not be discriminated against. We do not sell personal information.
If you are a guest of one of our customers, we may redirect your request to that property manager, who controls your data, and we will assist them in fulfilling it.
10. Children
The platform and our sites are not directed at children and we do not knowingly collect data from anyone under 16.
11. Changes
We will post changes here and, for material changes, give at least 30 days' notice by email or in the platform.
12. Contact
Boring Host AI Ltd, 128 City Road, London, United Kingdom, EC1V 2NX, contact@boringhost.ai