Privacy Policy

1. Who we are and what this policy covers

AnswerBnB is an AI-powered guest communication and property operations service for short-term rental operators. It connects to a customer’s property management system (PMS) or channel manager, reads reservations and guest conversations, answers guest questions from that property’s own knowledge, and hands a conversation to the customer’s team when a person is needed. AnswerBnB is not itself a PMS, and it does not connect to Airbnb or other booking channels directly; guest messages reach it through the customer’s PMS.

The service is operated by Answerbnb (“AnswerBnB”, “we”, “us”), based in Pakistan. The person responsible for privacy matters is Adnan Khan, who can be reached at info@answerbnb.com. Privacy requests are handled by email; we do not currently operate a separate privacy portal or a designated data protection officer.

This policy covers the website at answerbnb.com and the AnswerBnB application. It is written to describe what the service does today. Where something differs by connected system, or is not yet available, it says so.

2. Our role: customer data and our own data

AnswerBnB acts in two different roles, and this matters for who to ask about what.

• Customer data. The property, reservation, guest and conversation information that a customer brings into AnswerBnB (typically from its PMS) belongs to that customer. The customer decides why and how it is used, and AnswerBnB processes it on the customer’s behalf to provide the service. In data protection terms AnswerBnB acts as a service provider or processor for this data. A guest who wants to exercise rights over their information will usually get the fastest answer from the property manager they booked with, who is our customer.
• Our own data. For account holders (name, email, organization, sign-in), for website visitors, and for people who write to us, AnswerBnB decides why and how the information is used and acts as the responsible party (controller).

3. Information we process

We process only what the product needs. Categories, and where each comes from:

What a guest record contains depends on the connected system: some systems supply a guest’s email address and phone number, some supply only a name, and some supply no guest information at all. The section on connected systems lists this by system.

4. Why we process it

• To provide AnswerBnB: connect to your PMS, synchronize properties and reservations, and show reservations and conversations in one place.
• To generate replies: classify a guest’s message, answer it from the property’s own knowledge and reservation context, check the answer against that knowledge, and hand over to your team when the AI should not answer.
• To let your team review, correct and approve what the AI knows and says.
• To operate accounts: sign-in, invitations, password reset, notifications you enable, and support requests.
• To keep the service secure and prevent fraud and abuse, including investigating suspected misuse.
• To debug, maintain and improve the service, using operational records and counts rather than reading guest conversations for that purpose.
• To comply with legal obligations and to establish or defend legal claims.

Where a law requires a legal basis for our own processing, we rely on the performance of our agreement with you, our legitimate interests in running and securing the service, compliance with legal obligations, and consent where consent is required. We do not sell personal information and we do not use it for advertising.

5. Connected PMS and third-party systems

Customers can connect third-party PMS and channel-manager systems. These providers are independent services with their own terms and privacy policies, and they are integration partners, not part of AnswerBnB. The customer is responsible for having the right to connect the account and to give AnswerBnB access to the information in it. What is exchanged depends on what each provider’s interface offers and on what the customer has authorized, so integrations are not all alike. As of the effective date:

In the other direction, AnswerBnB sends: replies (written by the AI or by your team) through the provider, where that provider’s interface supports sending; the requests needed to connect and to keep the connection working, including registering to receive notifications from the provider where it allows that; and, where the provider supports it (currently Guesty), an approval or pre-approval of a guest’s booking inquiry as part of handling that inquiry for a property where AI messaging is turned on. AnswerBnB does not create bookings, take guest payments, or change your rates through these connections.

Some providers send notifications (webhooks) to AnswerBnB, and AnswerBnB also checks connected accounts for new messages on a schedule. Disconnecting a provider stops both; see how long we keep information for what happens to information already received.

6. How AI processing works

Where a customer has turned AI messaging on for a property, AnswerBnB uses an external AI inference provider to read guest messages and draft or check replies. The AI provider we use is Groq. Groq receives content in order to return a result, and is bound by its own terms and its data processing addendum, in which it states that it acts as a processor for customer data and processes it to provide, maintain and support its service on the customer’s instructions and as the law requires.

What is sent to the AI provider

• The guest’s message and the recent messages of that conversation.
• The passages of that property’s own knowledge that are relevant to the question, and instructions on how to answer.
• For questions about distance or location, the property’s location text.
• The guest’s first name, only when a personalized closing or polished reply is generated.

We do not add a guest’s email address or phone number to AI requests. Anything a guest writes in a message is included, and so is anything a customer places in its property knowledge, so customers should not put secrets in knowledge that the AI should not repeat. Reservation availability and balances are determined by AnswerBnB from the PMS data rather than by the AI.

Training and retention

AnswerBnB does not train or fine-tune AI models on customer or guest content, and we do not authorize AI providers to use it to train their models. Groq’s published documentation states that it does not retain customer data for inference requests by default, that it keeps system-reliability logs for up to 30 days, that a zero-data-retention setting is available, and that the customer data it does retain is held in the United States. We rely on those published terms and have not verified more than that.

Human oversight

AI replies can be wrong. A property’s AI is off until its owner turns it on; it can be turned off for a whole organization, for a property, or muted for a single conversation; the AI is built to hand over to a person rather than guess when the property’s knowledge does not support an answer; and your team can always reply.

7. Service providers

These are the providers that materially handle information for AnswerBnB. We have listed only providers we actually use.

The customer’s own PMS and channel providers (see connected systems) are separate from this list; they act under their own terms. AnswerBnB does not currently use advertising or analytics tools, session-recording tools, an error-monitoring service, a payment processor, or a separate file-storage service. Application logs record errors, timings and counts and are not designed to record the content of guest messages.

We may change providers. When a change affects how information is handled we will update this section and its effective date.

8. International processing

AnswerBnB is based in Pakistan, and the providers above process information outside Pakistan: in Malaysia and Singapore (hosting and file backups), in South Korea (the database and sign-in), and in the United States (AI inference and email, as those providers state). The customer’s PMS provider may process information elsewhere. By using AnswerBnB you understand that information can be processed in these places.

The providers’ own data processing terms describe the safeguards they apply to transfers; they are their terms rather than terms we have negotiated separately, and we do not currently offer a choice of processing region. Where a location is not stated in the table above, we have not verified it.

9. How long we keep information, and deletion

We have not adopted automatic deletion periods for customer data. This is what actually happens today:

• Account and organization information is kept while the account exists.
• Reservations, guest records, conversations and messages are kept for as long as the customer’s account exists. There is no automatic deletion schedule; they are removed when deleted as described below.
• Knowledge content. Customers can delete knowledge sources, documents and facts in the product; deleting them removes them from AnswerBnB and from the AI’s use.
• Raw notifications from connected systems, synchronization records, audit records and email delivery records are kept until the organization is deleted. There is no automatic purge of these today.
• Disconnecting a PMS stops synchronization and notifications, asks the provider to revoke access where the provider supports that, and deletes the stored connection credentials. Information already received from that PMS stays in the account until it is deleted.
• Removing a team member removes their access to the organization. Their sign-in account itself remains until the organization is deleted (when they belonged to no other), or until they ask us to remove it, which we do by hand: there is no tool for it yet.

Deleting an organization or a guest

A customer’s owner can ask us at info@answerbnb.com to delete the organization or an individual guest’s records. We verify the request, and we carry the deletion out ourselves; there is not yet a self-service button, and we do not commit to a fixed completion time. We confirm to the requester in writing when it is done.

• Deleting an organization removes everything of that organization from AnswerBnB’s database: properties, knowledge, reservations, guests, conversations, messages, escalations, connections, raw notifications, audit and email-delivery records; sign-in accounts that belonged to no other organization are removed too, including from the authentication provider when asked.
• Deleting a guest removes that guest’s reservations, conversations, messages, and the escalations, action items and individual learning events that referred to them. It does not remove the wording of an unanswered question that has been collected into a combined “knowledge gap” record, which is stored without the guest’s identity and is removed when the organization is deleted.

What deletion does not reach

• Backups of the database, which our database provider keeps (it states that it makes daily backups by default). Deleted information can remain in them until they expire; how long they are kept for our project is not verified. The hosting provider’s backups are of the application’s files and do not contain customer records.
• The AI provider’s own limited retention described in how AI processing works.
• Emails already delivered to recipients, and information in the customer’s own PMS or on booking channels.
• Information we must keep to meet a legal obligation or to establish or defend a claim.

10. Who at AnswerBnB can see customer information

Authorized AnswerBnB personnel can access customer information, including guest conversations, when it is needed to operate the service. We do not claim otherwise. There are two different kinds of access, and only the first is controlled inside the application:

Application-level access

• Administrative viewing. The platform administrator account can open a customer’s account in a clearly marked administrative view. Each session requires a written reason (at least 10 characters), lasts at most two hours, and its start and end are recorded together with the reason. Individual pages viewed during a session are not logged separately.
• Customer-controlled viewing. An organization’s owner or administrator can view the product as one of their own team members, other than an owner, for testing; these sessions are recorded too.

Infrastructure-level access

• The people who run AnswerBnB also have access to the production database, the hosting account and its runtime logs, and the authentication provider’s dashboard. This is how the service is operated and repaired. It is separate from administrative viewing, is not limited to it, and is not recorded by the AnswerBnB application. We have not verified what access logging our database and hosting providers keep for our account.

We use this access for support you ask for, security and abuse investigation, debugging and fixing faults, and legal obligations. We do not use it to read guest conversations for marketing or to build AI models. Customers on a plan that includes human support can expect our staff to see the conversations involved in that support.

11. Security

• Connections to the site and the application use HTTPS.
• Sign-in is handled by a maintained authentication provider (Supabase Auth). AnswerBnB does not store passwords. At sign-up the password passes through our server in memory on its way to the provider; we neither store nor log it.
• Every signed-in request is checked against the caller’s organization membership and role on the server; an organization identifier supplied by a browser is never trusted on its own.
• Database queries for a customer’s data are scoped to that customer’s organization in code, on top of the access check.
• PMS credentials are encrypted at rest with AES-256-GCM; the encryption key, the AI provider key and the database credentials are kept in server-side configuration and are never sent to browsers.
• Actions such as escalations, AI decisions and administrative viewing are recorded.

AnswerBnB holds no SOC 2, ISO 27001, HIPAA or PCI certification, and no security measure is absolute. Please tell us at info@answerbnb.com if you believe you have found a vulnerability or a problem.

12. Cookies and similar technologies

AnswerBnB uses only what is needed to run the service. It does not use advertising or analytics cookies, and it does not track visitors across other websites.

• Sign-in session cookie. When you sign in, our authentication provider sets a cookie that keeps you signed in. It is needed for the application to work and is removed when you sign out or clear it.
• Administrative-view cookie. Set only while an administrative or test-as-user session is active (at most two hours) and used to tell the server which session applies.
• Session storage. A small counter in your browser’s session storage limits automatic page reloads if a page file fails to load; it is cleared when the tab closes.
• Fonts. Pages load typefaces from Google’s servers, so Google receives your IP address and browser details when a page loads (see service providers).

Because these are needed for the service to work, we do not show a cookie banner. Browsing the public pages does not set a cookie of ours.

13. Your choices and requests

Depending on where you live you may have the right to ask for access to your information, to correct it, to delete it, to object to or restrict how it is used, or to receive a copy. Write to info@answerbnb.com and tell us what you would like. We may need to verify who you are, and for customer data we may direct you to the property manager who controls it, or ask them to confirm the request.

Account holders can update their details in the application and can disconnect a PMS, delete knowledge they added, and turn AI off at any time. If you are unhappy with an answer, tell us; you may also complain to the data protection authority where you live.

14. Children

AnswerBnB is a business service and is not directed to children. Account holders must be at least 18. Guest conversations can mention family members, including children, because that is part of travelling; we do not knowingly collect a child’s information for its own sake. If you think a child’s information has been provided to us, write to info@answerbnb.com and we will look into it.

15. Data processing agreements

AnswerBnB has prepared its own Data Processing Addendum and publishes it as a document prepared for execution. It is a draft for review: it is not effective for any customer until it has been accepted or executed in accordance with its terms, and some of its provisions remain subject to legal review. A business customer or integration partner that wants to execute it may write to info@answerbnb.com. Until an addendum has been signed by both parties, this policy is the description of how AnswerBnB processes customer data.

16. Changes to this policy

We will update this page when our practices or providers change, and change the effective date at the top. For a change that materially affects how customer data is handled we will also tell account owners by email or in the application. Earlier versions are available on request.

17. Contact

Answerbnb, Pakistan. Responsible person: Adnan Khan. Email: info@answerbnb.com.