Privacy built for operational trust

This policy explains how Santara AI handles personal data across our public website, dashboard, connected channels, direct booking pages and AI-assisted features.

It applies to hosts and operators, workspace members and cleaners, guests whose information is supplied through a reservation or connected channel, website visitors, and people who contact us or request access to the service.

Aircierge AI LLC, a Wyoming limited liability company with its principal office at 1021 E Lincolnway 10163, Cheyenne, WY 82001, United States, is the controller for personal data processed for Santara's public website, accounts and direct service relationships.

When Santara processes guest, reservation or team data supplied by or on behalf of a host, the host or operator is the controller and Aircierge AI LLC acts as processor. Công ty TNHH AirCierge AI in Vietnam supports delivery of the service as a processor.

The data involved depends on the features you use and the services you choose to connect.

We receive data directly from users and workspace members, and from services they choose to connect.

We use data only where it supports the service, the safety of the platform or a legal obligation. The legal basis depends on the data, the feature and the law that applies.

Where applicable, processing is based on performing our contract with you, complying with law, our legitimate interests in operating and securing the service, or consent where we specifically ask for it. When we rely on legitimate interests, we consider the purpose, necessity and potential effect on the people involved.

Some Santara features use AI providers, including OpenAI or Anthropic depending on the feature and configuration, to produce drafts, summaries, classifications or recommendations.

When an AI feature is used, the service sends the input and operational context needed to return that result. Data is not sent to an AI provider merely because it is stored in Santara.

Santara does not use workspace content to train a general-purpose AI model of its own. An AI provider processes submitted content under its applicable API terms, data controls and retention settings; those conditions can differ by provider and configuration.

Some host-facing tools classify operational signals or show a guest score and labels such as ‘At risk’. These indicators support review and prioritisation; they do not decide whether a person may stay. Depending on applicable law, a person may ask about or object to profiling involving their personal data.

The public Santara assistant may send the conversation and the page context needed to answer a visitor's question to an AI provider. Do not submit passwords, payment-card details or unnecessary guest data to the assistant.

AI assistants you connect. A workspace member can connect an outside AI assistant, such as ChatGPT, Claude or Grok, through the Santara AI MCP server at mcp.santara.ai. The member signs in to Santara AI, picks one workspace and approves the connection; Santara AI then gives the assistant an access key. The member's password is never shared with the assistant.

When the member asks it something, the assistant receives only the workspace data needed to answer, read through the member's own role. That can include bookings, guest names, contact details and messages, calendar and prices, cleaning, tickets, reviews and revenue. Door codes and Wi-Fi passwords are never sent to an outside assistant. Billing details, payment-card data and team management are never available to an assistant.

Owners and admins choose on the AI assistants page which kinds of change an assistant may make at once, may only propose for the member's approval in the chat, or may never make. Santara AI records every change an assistant makes or proposes: which assistant, which member, what changed and when. For each assistant request we log the tool used, its outcome and its timing; we do not store the assistant conversation or log the values sent with a request.

The provider of the assistant, for example OpenAI for ChatGPT or Anthropic for Claude, processes what it receives under its own terms and privacy policy. That provider is not our processor, so how data is handled inside the assistant follows that provider's settings and the member's own account with them.

A member can disconnect an assistant at any time in Settings → Channels → Apps. Its access key then stops working for changes within seconds and for reading within ten minutes. Records of assistant actions are kept with the workspace's other activity records and deleted with the workspace.

AI output can be incomplete or inaccurate. Hosts should review guest-facing messages, pricing changes and operational decisions before acting.

We use service providers only where they are needed to operate a feature, deliver the service or meet a legal obligation.

Santara's primary application infrastructure is operated on AWS in Singapore. Aircierge AI LLC, Công ty TNHH AirCierge AI and our service providers may also process data in other countries where they operate.

For international transfers that require a transfer safeguard, including transfers subject to European Union data-protection law, we use the European Commission's Standard Contractual Clauses together with appropriate organisational and technical measures.

We keep data only for as long as it is needed to provide the service, maintain an account, resolve disputes, protect the platform and meet legal obligations. Retention is determined by the type of record, the account's status, operational need and applicable tax, accounting, security and legal requirements.

When a workspace is approved for deletion, its active operational data enters our deletion process. Some records may be kept longer for tax, accounting, fraud prevention, security, legal claims or another lawful requirement. Backup copies expire through their own retention cycle rather than being edited individually.

Santara uses technical and organisational safeguards designed to reduce unauthorised access, loss, misuse or alteration. Data is transmitted over TLS, workspace access is role-aware, and connection credentials are protected.

Team access can be revoked, and support access should be limited to what is needed to resolve a request. No internet transmission or storage system can be guaranteed completely secure.

Depending on the applicable law and your relationship with Santara, you may have the following rights:

Email hello@santara.ai with the subject ‘Personal data request’ and describe the account, workspace or booking involved and the right you want to exercise.

We may request information needed to verify identity, authority and the scope of the request before providing, changing or deleting data. If Santara processes the data only on a host's instructions, we may direct the request to that host or help them respond.

We will acknowledge and respond within the period required by applicable law. A request may be extended, limited or refused where the law permits, including where identity or authority cannot be verified. You may also complain to the data-protection authority available to you under applicable law.

Santara uses necessary cookies for authentication, session refresh, language, theme and verified guest access. Integrated services such as Stripe may set cookies when their features are used.

On the public Santara website, Google Analytics may receive page views, referral source, visit time, browser and device information, IP-derived approximate location and cookie identifiers. We use this information to understand and improve the website, not to provide Google with guest reservation content.

Google Analytics runs on the public Santara website by default, with IP anonymization enabled. A visitor can block or delete analytics cookies in their browser settings, or use Google's Analytics opt-out browser add-on, without losing access to the public website.

Santara is designed for hosts, operators and their teams and is not directed to children. Reservation data may include information supplied by an adult about people travelling with them where it is needed to provide a stay.

If you believe a child's data was provided inappropriately, contact us so we can review and take suitable action.

We may update this policy when our product, providers or legal obligations change. The latest update date appears at the top of the page. Where a change materially affects how data is handled, we will provide an appropriate notice.

For privacy questions, complaints or personal data requests, contact hello@santara.ai.