Sell.
Η ομάδα πωλήσεών σας με τεχνητή νοημοσύνη, εργάζεται 24/7
Serve.
Επίπεδο Λειτουργιών & Φιλοξενίας
Scale.
Σουίτα Ανάπτυξης & Μάρκετινγκ
Και Περισσότερα
Από ό,τι Περιμένετε
Η ομάδα πωλήσεών σας με τεχνητή νοημοσύνη, εργάζεται 24/7
Επίπεδο Λειτουργιών & Φιλοξενίας
Σουίτα Ανάπτυξης & Μάρκετινγκ
Από ό,τι Περιμένετε
HotPilot LTD.
Last updated: 8 October 2026
This Privacy Policy describes how HotPilot LTD. ("HotPilot", "we", "us", "our"), a company incorporated in Bulgaria, UIC 208812339, with its registered seat at bl. 64, ent. В, fl. 3, ap. 44, Lev Tolstoy, Sofia, Bulgaria, collects, uses, shares, and protects personal data when you visit our website https://hotpilot.ai (the "Website"), use our software-as-a-service platform (the "Platform"), or otherwise interact with us. We respect your privacy and comply with the EU General Data Protection Regulation 2016/679 ("GDPR"), the Bulgarian Personal Data Protection Act, and other applicable data-protection laws.
HotPilot LTD. is the data controller of personal data that we process for our own purposes (described in Section 4 below). For personal data that our business clients (hotels, property managers, rentals — together "Clients") upload into the Platform about their guests and staff, the Client is the data controller and HotPilot acts as their data processor under our Data Processing Agreement (DPA).
We have designated a Data Protection Officer. You can reach them directly, on any matter relating to your personal data:
Data Protection Officer: Hristo Aleksandrov
Email: [email protected] · Telephone: +359 894 622 720
For requests about your data: [email protected]
To report a security concern: [email protected]
Postal address: Hot Pilot OOD (HotPilot Ltd), UIC 208812339, 64 Lev Tolstoy, ent. V, fl. 3, ap. 44, 1000 Sofia, Bulgaria
You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (https://www.cpdp.bg) or the supervisory authority of your country of residence.
Identifiers and device data: IP address, device type, browser, operating system, screen resolution, language, referrer URL.
Usage data: pages viewed, time on page, clicks, scroll depth, navigation patterns.
Cookies and similar technologies: see our Cookies Policy for details.
Information you submit voluntarily through forms: name, work email, phone, company, role, country, message content.
Account data: name, work email, role, profile picture, password hash, two-factor settings.
Activity logs: actions performed, timestamps, IP, device.
Communications: support tickets, in-product chat messages with us.
Business contact details collected during sales, demo, partnership or marketing activities.
Information from public sources, business directories, and B2B data providers, used for legitimate business outreach in accordance with applicable law.
When a Guest interacts with a Client through the Platform — e.g. by making a booking, chatting with the AI assistant, or receiving a marketing email — the Platform may process: name, contact details, language, booking details (dates, room type, special requests), Guest messages and AI conversation history, IP and device data, marketing preferences, and other information the Client chooses to record. HotPilot processes this data only as the Client's processor; Guests should consult the Client's own privacy notice for the controller relationship.
The chat on hotpilot.ai answers questions about HotPilot with an AI assistant. The assistant runs on Amazon Bedrock in the European Union; what you type is sent to the model to produce the answer and is not used to train it.
What we keep. The conversation (your messages, after card numbers, IBANs, passwords and identity-document numbers are replaced with "[redacted]"; the assistant's answers; which cards it showed you), a technical log of the AI calls behind those answers (the same text, deleted with the conversation or sooner), the page you started on, your country as reported by our network provider, and a keyed hash of your network address, which we use to stop abuse and to count visits in our own statistics. A conversation in which you send no form stores no IP address in the chat's records. If you send the demo or contact form, or confirm a demo from the email we send you, the IP address and browser of that request are written to our audit log with your request. If you have accepted marketing cookies and you book a demo, the IP address of that request, your browser, your email, the page you were on and the two Meta cookie values (_fbp and _fbc) are also kept with the conversation, encrypted, until the demo you confirm is reported to Meta or the unconfirmed request is cancelled or expires; a nightly clean-up removes anything that is left.
How long. A conversation in which you leave no contact details is deleted 30 days after its last message. If you ask for a demo or for us to contact you, the conversation is kept with your request for as long as we keep your details as a business contact (Section 8), because it is the record of what you were told. Usage statistics of the chat (which page it was opened on, which cards were shown and which topics it could not answer, with the keyed hash of your network address and none of your message text) are kept for 400 days; when a conversation is deleted or erased, they are detached from it, not deleted.
Demos and contact requests. When you book a demo or leave your details in the chat, we use your name, email, telephone and company to arrange the demo or to reply to you (steps prior to entering into a contract, Art. 6(1)(b) GDPR). A demo is booked only once you confirm it from the email we send you. We do not add you to any marketing list.
Spam protection. The chat's demo and contact forms use Google reCAPTCHA, which receives your IP address and how you interact with the form.
Voice. If you press Listen on a reply, or talk to the assistant by voice, the text of the assistant's reply is sent to ElevenLabs, in the United States (Section 7), to be read aloud; a reply can repeat what you wrote. When you talk by voice, your speech is turned into text by your own browser's speech recognition, which your browser's maker may provide, and we receive only that text, as if you had typed it, and never your voice. We keep the audio of a reply for up to 6 hours, so that it can be played again without being made again.
Advertising measurement. Only if you have accepted marketing cookies do we tell Meta that a contact request was made (a "Lead" event); when you confirm a demo, Meta receives with that event a SHA-256 hash of your email together with the IP address and browser of your booking request, the page you were on and the two Meta cookie values. Without that consent nothing about the chat is sent to any advertising provider.
Our legal basis for keeping conversations without contact details is our legitimate interest in answering your questions and improving those answers (Art. 6(1)(f) GDPR). You can object at any time by writing to [email protected], or simply by not using the chat.
We process personal data for the following purposes, on the following legal bases:
Providing the Services (account creation, authentication, support, billing) — performance of the contract with you or your employer (Art. 6(1)(b) GDPR), or legitimate interest in delivering the Services to your employer (Art. 6(1)(f)).
Operating, securing and improving the Platform (logging, monitoring, fraud prevention, abuse detection, debugging, capacity planning, product analytics) — legitimate interest in keeping the Services secure and improving them (Art. 6(1)(f)).
Communicating with prospects and clients (responding to enquiries, scheduling demos, sending service notices) — performance of pre-contractual measures (Art. 6(1)(b)) or legitimate interest in B2B outreach (Art. 6(1)(f)).
Direct marketing to existing clients about similar services — legitimate interest, with a clear opt-out (Art. 6(1)(f)). Marketing to non-clients — your consent (Art. 6(1)(a)).
Compliance with legal obligations (accounting, tax, anti-money-laundering, responding to lawful requests) — Art. 6(1)(c).
Establishing, exercising or defending legal claims — Art. 6(1)(f).
AI model improvement — we may use aggregated, de-identified data derived from usage of the Platform to evaluate and improve our AI Features. Personal data of Guests processed on behalf of Clients is not used to train third-party general-purpose AI models without the Client's instruction, and Guest content is not exposed to other Clients.
We use cookies, pixels, local storage, and similar technologies as described in our Cookies Policy. Where required by law, non-essential cookies are only set after you give consent through our cookie banner.
We share personal data with:
Service providers (sub-processors) — cloud infrastructure (e.g. Amazon Web Services), email and messaging providers (e.g. Postmark), analytics providers, customer-support tools, payment providers, AI/LLM infrastructure providers, and other vendors needed to deliver the Services. Sub-processors used in the Platform are listed at https://hotpilot.ai/subprocessors.
Our Clients — when you act as a Guest, your data is shared with the Client whose property you are booking with.
Professional advisors — accountants, auditors, lawyers, insurers under confidentiality.
Authorities — where required by law, court order, or to protect our rights, users, or the public.
Successors — in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality.
We do not sell personal data.
HotPilot is based in the EU, and we host most personal data within the European Economic Area (EEA). Some sub-processors may process data in countries outside the EEA, including the United States and the United Arab Emirates. Where this happens, we rely on appropriate safeguards under GDPR, such as the European Commission's Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms. You may request a copy of the relevant safeguards by contacting [email protected].
Account data: for the duration of the Client's contract plus up to 36 months for legal-defence purposes.
Booking and transaction records: 10 years (Bulgarian accounting and tax law) or as required locally.
Marketing leads: up to 24 months from last meaningful interaction, or earlier on opt-out.
Cookies and analytics data: as set out in the Cookies Policy.
AI conversation logs and audit logs: up to 24 months for security, fraud prevention and quality assurance, unless a longer retention is required by the Client's configuration or by law.
After these periods, data is deleted, anonymised, or kept under restricted processing for legal claims as permitted by law.
Subject to applicable conditions and exceptions, you have the right to:
Access the personal data we hold about you;
Request rectification of inaccurate or incomplete data;
Request erasure ("right to be forgotten");
Restrict or object to certain processing, including direct marketing;
Receive your data in a portable format and have it transmitted to another controller;
Withdraw consent at any time, where processing is based on consent;
Not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, except where permitted by law;
Lodge a complaint with a supervisory authority.
To exercise your rights, contact [email protected]. We may need to verify your identity before processing your request and will respond within one (1) month, extendable by two further months for complex requests.
Note: where the request concerns data we process on behalf of a Client (e.g. Guest booking data), we will normally forward the request to that Client, who is the controller.
We apply appropriate technical and organisational measures to protect personal data, including: encryption in transit (TLS 1.2+) and at rest, role-based access control, multi-factor authentication for staff, segregated environments, regular backups, vulnerability management, audit logging, and staff training. No system is perfectly secure; in the event of a personal-data breach, we will notify affected Clients and, where required, the supervisory authority within 72 hours of becoming aware.
The Platform is not directed at children under 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us so we can delete it.
The Platform includes AI Features (e.g. Guest assistants, dynamic pricing recommendations). Their outputs are advisory and are reviewed and applied by Clients (or by automation that the Client configures). HotPilot does not, on its own, make decisions producing legal or similarly significant effects on individuals based solely on automated processing, except where permitted by law.
We may update this Privacy Policy from time to time. The version with the most recent "Last updated" date is the one in force. Material changes will be notified through the Website or by email.
HotPilot LTD.
Registered seat: bl. 64, ent. В, fl. 3, ap. 44, Lev Tolstoy, Sofia, Bulgaria
UIC: 208812339 | VAT ID: BG208812339
Privacy contact: [email protected] | Website: https://hotpilot.ai
Cookies Policy
HotPilot LTD. - Last updated: 20 May 2026
This Cookies Policy explains how HotPilot LTD. ("we", "us", "our") uses cookies and similar technologies on our website https://hotpilot.ai and on the booking and management interfaces of the HotPilot platform (the "Site"). It should be read together with our Privacy Policy.
A cookie is a small text file placed on your device when you visit a website. Cookies allow the site to recognise your device, remember preferences, measure usage, and personalise content. We also use related technologies such as web beacons (pixels), local storage, session storage, and similar identifiers; this Policy refers to all of them as "cookies" for simplicity.
Required for the Site to work: authentication, session management, load balancing, security, fraud prevention, cookie-banner state. These cannot be turned off; if you block them, parts of the Site will not function.
Remember choices such as language, currency, region, and other interface preferences. Set on the basis of consent, where required by law.
Help us understand how visitors interact with the Site (pages viewed, time on page, scroll depth, conversion funnels) so we can improve it. Set on the basis of consent.
Used to measure and optimise marketing campaigns, build retargeting audiences, attribute conversions, and personalise content. Set on the basis of consent.
Some cookies are set by third parties whose tools we embed. The exact providers may change; the cookie banner / preferences centre always reflects the current list. Examples include:
Analytics: Google Analytics 4
Marketing: Meta Pixel, Google Ads, Google Tag Manager, LinkedIn Insight Tag and more.
Booking-engine fraud prevention and payment redirects and more.
Third parties act as independent controllers for some processing. Please consult their own privacy and cookie statements.
In line with the EU ePrivacy Directive (as transposed into Bulgarian law) and the GDPR:
Strictly necessary cookies are set on the basis of our legitimate interest in providing the Site you requested.
All other categories are set only after you give consent through our cookie banner. You can change your choices at any time via the "Cookie preferences" link in the footer.
Cookie preferences centre - accessible from the footer link "Cookie preferences".
Browser settings - most browsers let you delete or block cookies. Doing so may break parts of the Site.
Opt-out tools provided by some advertisers (e.g. https://www.youronlinechoices.eu).
Cookies have different lifetimes - some are deleted when you close your browser ("session cookies"), others remain for a defined period (typically up to 13 months for analytics cookies, in line with EDPB guidance). Detailed durations for each cookie are listed in our cookie preferences centre.
We may update this Policy when we add, remove, or change cookies. The "Last updated" date at the top reflects the current version.
Questions? [email protected]