Privacy Policy

Introduction

At StayAPI, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. Please read this privacy policy carefully.

StayAPI is a service operated by Botster PTE LTD, a company incorporated in Singapore. For the purposes of applicable data protection law, Botster PTE LTD is the entity responsible for your personal information when you use StayAPI ("we", "us", "our").

If you do not agree with the terms of this privacy policy, please do not access the service.

1. Information We Collect

1.1 Personal Information You Provide

When you register for an account, we collect:

• Name and email address
• Company name and website (optional)
• Billing information (processed securely through our payment provider)
• Communications you send to us
• Your marketing consent choice, including when and where it was provided or withdrawn

1.2 Automatically Collected Information

When you use our Service, we automatically collect:

• API usage data and request logs
• IP addresses and device information
• Browser type and operating system
• Access times and dates
• Pages viewed and actions taken
• Error logs and performance data

When you are signed in, we also collect a device signature derived from your browser and device characteristics (such as screen, language, and rendering settings) and store an identifier for your device, which we use solely to detect and prevent fraud and abuse of our free tier on the basis of our legitimate interests.

1.3 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Service and hold certain information. You can instruct your browser to refuse all cookies or indicate when a cookie is being sent.

2. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve our Service
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments and questions
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address technical issues
• Enforce our Terms of Service and prevent abuse
• Comply with legal obligations
• Send marketing communications (with your consent)
• Tailor and stop onboarding emails based on whether you have made an API call

2.1 Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal information only where we have a legal basis to do so, including:

• Performance of a contract: To provide and operate the Service you request.
• Legitimate interests: To secure and improve our Service, prevent abuse, and understand how it is used, provided these interests are not overridden by your rights.
• Legal obligations: To comply with applicable laws and regulations.
• Consent: For certain marketing communications or optional features, where required by law.

3. How We Share Your Information

We do not sell, trade, or rent your personal information. We may share your information in the following situations:

3.1 Service Providers

We share information with third-party vendors who perform services on our behalf, such as:

• Payment processing
• Email delivery services
• Analytics services
• Customer support tools
• Infrastructure providers

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

3.4 Consent

We may share your information with your consent or at your direction.

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and audits
• Access controls and authentication requirements
• Employee training on data protection
• Incident response procedures

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

5. Data Retention

We retain your personal information for as long as necessary to:

• Provide the services you've requested
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Maintain business records for analysis and/or audit purposes

When your personal information is no longer required, we will securely delete or anonymize it.

We may retain a minimal record of an unsubscribe request for as long as reasonably necessary to honor the request, demonstrate compliance, and prevent accidental resubscription.

Account deletion is irreversible: StayAPI deletes the account and its associated working data and cannot restore the account. We may retain limited records where reasonably necessary for legal or regulatory compliance, fraud or abuse prevention, enforcement of agreements, or unsubscribe suppression. Those records do not form a restorable account archive. Separate service providers may retain records under their own legal obligations and retention policies.

6. Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal information:

6.1 European Union (GDPR)

If you are a resident of the European Economic Area (EEA), you have the right to:

• Access: Request copies of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data
• Restriction: Request restriction of processing
• Portability: Request transfer of your data
• Object: Object to our processing of your data
• Withdraw consent: Where processing is based on consent

6.2 California (CCPA)

If you are a California resident, you have the right to:

• Know what personal information is collected
• Know whether your information is sold or disclosed
• Say no to the sale of personal information
• Access your personal information
• Request deletion of your personal information
• Not be discriminated against for exercising your rights

To exercise any of these rights, please contact us at info@stayapi.com. We may ask you to provide certain information to verify your identity before responding to your request, and we will respond within the time period required by applicable law.

7. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your jurisdiction. We take appropriate measures to ensure that your data receives an adequate level of protection in the jurisdictions in which we process it.

By using our Service, you consent to the transfer of your information to our facilities and to third parties as described in this Privacy Policy.

8. Children's Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us immediately.

9. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

10. Marketing Communications

If you select the optional marketing checkbox when registering, we may send a limited onboarding series during the first 21 days after email confirmation. The series includes practical API setup guidance, hotel-data use cases, product resources, and an offer of setup help. We use account activity, including whether you have made an API call, to stop messages that are no longer relevant.

Marketing consent is separate from acceptance of our Terms, is not required to use StayAPI, and may be withdrawn at any time. You can opt out by:

• Clicking the unsubscribe link in any marketing email
• Contacting us directly

Withdrawing marketing consent does not affect account confirmation, password reset, security, billing, quota, or other service communications. We do not add users who leave the checkbox unselected to the onboarding series.

11. Do Not Track

Our Service does not currently respond to Do Not Track (DNT) browser signals. However, you can control cookies through your browser settings and other tools.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification for significant changes

You are advised to review this Privacy Policy periodically for any changes.

13. Cookie Policy

13.1 What Are Cookies

Cookies are small text files stored on your device when you visit our website. They help us provide you with a better experience and understand how you use our Service.

13.2 Types of Cookies We Use

• Essential Cookies: Required for the Service to function properly (authentication, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use our Service
• Marketing Cookies: Used to deliver relevant advertisements (if applicable)

13.3 Managing Cookies

Most browsers allow you to control cookies through their settings. However, limiting cookies may impact your experience with our Service.

14. AI Assistants (ChatGPT, Claude, and Other MCP Clients)

You can connect StayAPI to AI assistants such as ChatGPT and Claude through our MCP server. This section explains what happens to your data when you do, and supplements the rest of this policy.

14.1 What We Collect

• Your StayAPI account details (name and email address), which link the connection to your account.
• How the assistant connects. Sign-in connections (the ChatGPT app and Claude connectors) ask you to sign in to StayAPI and approve access; the assistant never receives your StayAPI password or API key. Other clients, such as Claude Code, Cursor, and Claude Desktop set up with a config file, use your API key instead: you paste it into the client's settings, and the client stores it and sends it with every request.
• Connection records for sign-in connections: the authorizations and tokens we issue to the assistant. Tokens are stored in hashed form. Access tokens expire after one hour and are renewed automatically until you revoke access. Each assistant also registers its name and redirect address with us. That registration describes the assistant, not you, and is not linked to your account.
• Tool calls: the name of each StayAPI tool the assistant calls, the inputs it sends (for example a destination, travel dates, number of guests, or a hotel ID or URL), the result we return, the response status and time, and the IP address and user agent of the caller. We store up to 10 KB of inputs and 50 KB of results per call. Calls to the display-only show_hotels tool are not stored in these records.
• The caller's IP address depends on the assistant. For sign-in connections it is usually the assistant provider's server. For assistants that run on your own computer and use your API key, such as Claude Code, Cursor, or Claude Desktop, it is your own IP address. We also keep the most recent IP address that called StayAPI with your account.
• Results can contain personal data that travel sites publish, such as reviewers' names and the text of their reviews. This data is stored in the tool-call records like any other result.
• Billing records: one per billable tool call, showing when it was settled and whether your plan or your credits paid for it. They do not contain the tool's inputs or results. While a call is being processed, its record briefly holds a full copy of the call, which is cleared when processing finishes.
• Usage counts, aggregated per hour.

We do not receive your conversation with the assistant. The assistant decides which inputs to send to a StayAPI tool.

ChatGPT also attaches hints to each tool call: your language setting, a description of your browser or app, your approximate location (city, region, country, time zone, and rough coordinates), and anonymized IDs for you, the conversation, and your organization. We do not use, store, or log these hints.

14.2 How We Use It

• To run the searches and lookups you ask for
• To count usage against your account's quota and for billing
• To detect and prevent fraud and abuse, and keep the Service secure. Automated checks can suspend an account that is linked to accounts we have blocked for abuse.
• To provide support and investigate errors
• To understand how StayAPI is used and improve it (product analytics)
• To stop onboarding emails once you make your first successful API or MCP call (see section 10)

14.3 Who Receives It

• To answer a request, we send its search inputs (such as destination, dates, and number of guests) to the travel sites the tool reads from, such as Booking.com, Google, or Tripadvisor, and to the data and network service providers we use to reach them. We never send your name, email address, or account identifiers with these requests.
• Cloudflare, our network and security provider, sits in front of stayapi.com and api.stayapi.com. It handles every request and response, including tool calls and their results.
• AppSignal, our application monitoring provider, receives technical details of requests to our API: the request path and query, the response status and timing, the caller's IP address and user agent, and details of any errors, which can occasionally include part of a request. AppSignal keeps this data for up to 60 days.
• Tool-call records are stored on servers run by our hosting provider. We do not sell them or share them with advertisers.
• The assistant's provider (for example OpenAI or Anthropic) receives the results we return, including any personal data in them such as reviewers' names, and handles them under its own privacy policy.
• When an assistant shows StayAPI hotel cards, your browser loads hotel photos directly from the travel sites' image servers (for example Google and Booking.com). Those servers receive your IP address and browser details, as with any image on the web.

14.4 How Long We Keep It

• We keep the 100 most recent tool-call records per account. Older records are deleted automatically within minutes.
• Hourly usage counts are deleted after 90 days.
• Billing records and the most recent IP address that called StayAPI with your account are kept while your account exists.
• Authorizations and tokens are kept until you delete your account. Once you revoke a connection, its tokens stop working within a minute.
• Assistant registrations (an assistant's name and redirect address) are not linked to any account. A registration is deleted once it is more than 90 days old and no connection uses it.
• When you delete your account, its tool-call records, usage counts, billing records, authorizations, and tokens are deleted with it, subject to section 5.
• Our application and web server logs record technical details of each request, such as the caller's IP address, user agent, and the request path, and can include a tool call's inputs. They are deleted after 30 days. If a usage record cannot be delivered between our servers, a copy is kept in an error queue for up to 30 days.

14.5 Your Controls

• Revoke a sign-in connection at any time under Connected apps on your MCP page. Access stops within a minute. You can also disconnect StayAPI in the assistant's own settings.
• Connected apps lists only sign-in connections. To cut off an assistant that uses your API key, regenerate your API key on your dashboard. This also stops every other integration that uses the old key.
• Choose which StayAPI tools your MCP connections can use, on your MCP page.
• Delete your account in Settings. You cannot delete it while you have an active, trialing, paused, or past-due subscription, so cancel it first. A blocked account cannot be deleted from Settings; contact us instead.
• Email info@stayapi.com to exercise the rights described in section 6.

15. Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not adequately addressed your concerns.