Privacy Policy

Who we are

HostOS is a hotel marketing agency in India. We help hotels and resorts show up in AI answers and search, and get more direct bookings, through AI visibility optimization, direct booking optimization, social media management and performance marketing. This policy is written to meet the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it.

We play two different roles. For information about people who contact us and the hotels we work with, we decide how it is used, so we are the Data Fiduciary. For information about a hotel's guests that we handle while running the hotel's campaigns or messaging flows, the hotel decides how it is used and we act on its instructions, so the hotel is the Data Fiduciary and we are its Data Processor.

This website

We keep this website as light as we can:

• We don't use cookies, analytics, advertising pixels or tracking of any kind.
• Our fonts are hosted on this website, so loading a page doesn't contact a font service.
• The explainer video on the home page is served from this website, not from a video platform, and loads only when you press play.
• There are no forms. The OTA commission calculator runs entirely in your browser, and the numbers you enter are never sent to us or stored anywhere.

Like any website, our host (Netlify) receives technical information such as your IP address and browser type when it delivers a page. It uses this to serve the website and keep it secure. We don't use it to identify you.

When you tap a WhatsApp button, WhatsApp opens with a message you can edit before sending. Nothing is sent unless you send it. If you do, we receive your name and phone number as shown on WhatsApp, and whatever you choose to write, such as your hotel's name, city, website and Instagram handle. We use this only to reply to you, run your free AI visibility audit, and discuss working together. If you email us, the same applies to your email address and message.

Information hotels share with us

When a hotel works with us, we collect:

• Contact details of the owner and the staff we work with
• Billing details and GST registration
• Business information such as room types, rates, policies, photos, booking mix and the results we report each month
• Access to the accounts we need for the work, such as the hotel's Google Business Profile, Instagram and Facebook pages, Google and Meta ad accounts, website, booking engine and website analytics

We use this to provide the services in the hotel's proposal, report on results, bill for our work and stay in touch. Payments to us are processed by banks or payment providers; we don't store card numbers.

Access to your accounts

Your accounts stay in your hotel's name. When we need access, we ask for it in the safest way each platform offers:

• Where a platform allows it, we ask to be added as a user or partner with our own login, so you never need to share your password.
• We ask only for the level of access the work needs, and use it only for the work you've agreed to.
• We keep any login details we're given private, and share them with no one outside HostOS.
• You can remove our access at any time. When our work together ends, we remove our own access, or ask you to, and hand back anything we manage for you.

Hotel guests

While running a hotel's marketing, we may handle information about its guests and potential guests on the hotel's instructions. This can include:

• Messages sent to the hotel on WhatsApp, Instagram or Facebook through flows we set up, and the name and phone number or profile they come from
• Booking or enquiry details needed to measure which campaigns bring bookings, for example when we set up conversion tracking on the hotel's own booking engine
• Guest lists the hotel chooses to use for advertising audiences on Google or Meta, which the platforms process in the ways they describe
• Guest photos, videos and reviews, used only with the guest's permission

The hotel is responsible for having a lawful basis for this, such as the guest's consent for marketing messages or for their photos to be shared. We help hotels collect and keep that consent properly, and we use guest information only for the purpose the hotel has instructed. Marketing messages go only to people who agreed to receive them, and they can stop them at any time.

If you are a hotel guest and want to access, correct or delete your information, please contact the hotel first, as it decides how your information is used. We'll help the hotel respond, and you can also contact us using the details below.

Who we share data with

We never sell personal data. We share it only as needed to provide our services:

• Google, for search and hotel listings, Google Business Profile and Google Ads.
• Meta, which operates Instagram, Facebook and WhatsApp, including the WhatsApp Business Platform and Meta ads.
• Our website host and other service providers who help us run our business, under terms that require them to protect the data.
• Professional advisers, such as our accountant or lawyer, where needed.
• Government authorities, when the law requires it, such as a lawful request from a court or regulator.

Some of these companies store or process data outside India. When they do, we use only countries that the DPDP Act and its rules allow.

How long we keep data

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires, for example for tax and invoice records. WhatsApp and email conversations with people who contact us are kept while they're useful for replying and for our records. When a hotel stops working with us, we hand back or delete the guest information we handle for it, as the hotel instructs, unless the law requires us to keep it.

Security

We protect data with access limited to the people who need it, secure storage, and the platforms' own security features, such as two-step verification. If there is a personal data breach, we will act as the DPDP Act requires: for information we hold as Data Fiduciary, we will inform the Data Protection Board of India and the people affected; for information we handle for a hotel, we will tell the hotel promptly so it can do the same.

Your rights

Under the DPDP Act, you can:

• Ask for a summary of the personal data we hold about you and how it is used
• Ask us to correct, complete, update or delete it
• Withdraw consent you have given, as easily as you gave it
• Nominate someone to exercise these rights for you if you are unable to
• Raise a grievance with us, and if you're not satisfied with our response, complain to the Data Protection Board of India

Our services are for businesses, and this website isn't meant for children. We don't knowingly collect personal data from children.

Grievance Officer

For any question, request or complaint about your personal data, contact our Grievance Officer:

Kaushal SadGrievance Officer, HostOS
WhatsApp: +91 96254 15997
Email: kaushal@hostos.online

We will acknowledge your request promptly and respond within the time the DPDP Act and its rules allow.

We may update this policy as our services or the law change. When we do, we'll change the date at the top of this page, and tell the hotels we work with about any significant change.