This Privacy Policy describes how HotPilot LTD. ("HotPilot", "we", "us", "our"), a company incorporated in Bulgaria, UIC 208812339, with its registered seat at bl. 64, ent. В, fl. 3, ap. 44, Lev Tolstoy, Sofia, Bulgaria, collects, uses, shares, and protects personal data when you visit our website https://hotpilot.ai (the "Website"), use our software-as-a-service platform (the "Platform"), or otherwise interact with us. We respect your privacy and comply with the EU General Data Protection Regulation 2016/679 ("GDPR"), the Bulgarian Personal Data Protection Act, and other applicable data-protection laws.
1. Who is the Controller?
HotPilot LTD. is the data controller of personal data that we process for our own purposes (described in Section 4 below). For personal data that our business clients (hotels, property managers, rentals — together "Clients") upload into the Platform about their guests and staff, the Client is the data controller and HotPilot acts as their data processor under our Data Processing Agreement (DPA).
We have designated a Data Protection Officer. You can reach them directly, on any matter relating to your personal data:
Data Protection Officer: Hristo Aleksandrov
Email: [email protected] · Telephone: +359 894 622 720
For requests about your data: [email protected]
To report a security concern: [email protected]
Postal address: Hot Pilot OOD (HotPilot Ltd), UIC 208812339, 64 Lev Tolstoy, ent. V, fl. 3, ap. 44, 1000 Sofia, Bulgaria
You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (https://www.cpdp.bg) or the supervisory authority of your country of residence.
3. Categories of Personal Data We Collect
3.1 When you visit our Website
Identifiers and device data: IP address, device type, browser, operating system, screen resolution, language, referrer URL.
Usage data: pages viewed, time on page, clicks, scroll depth, navigation patterns.
Cookies and similar technologies: see our Cookies Policy for details.
Information you submit voluntarily through forms: name, work email, phone, company, role, country, message content.
Account data: name, work email, role, profile picture, password hash, two-factor settings.
Activity logs: actions performed, timestamps, IP, device.
Communications: support tickets, in-product chat messages with us.
Business contact details collected during sales, demo, partnership or marketing activities.
Information from public sources, business directories, and B2B data providers, used for legitimate business outreach in accordance with applicable law.
3.4 Personal data of Guests / End-Users (processed on behalf of Clients)
When a Guest interacts with a Client through the Platform — e.g. by making a booking, chatting with the AI assistant, or receiving a marketing email — the Platform may process: name, contact details, language, booking details (dates, room type, special requests), Guest messages and AI conversation history, IP and device data, marketing preferences, and other information the Client chooses to record. HotPilot processes this data only as the Client's processor; Guests should consult the Client's own privacy notice for the controller relationship.
4. Purposes and Legal Bases
We process personal data for the following purposes, on the following legal bases:
Providing the Services (account creation, authentication, support, billing) — performance of the contract with you or your employer (Art. 6(1)(b) GDPR), or legitimate interest in delivering the Services to your employer (Art. 6(1)(f)).
Operating, securing and improving the Platform (logging, monitoring, fraud prevention, abuse detection, debugging, capacity planning, product analytics) — legitimate interest in keeping the Services secure and improving them (Art. 6(1)(f)).
Communicating with prospects and clients (responding to enquiries, scheduling demos, sending service notices) — performance of pre-contractual measures (Art. 6(1)(b)) or legitimate interest in B2B outreach (Art. 6(1)(f)).
Direct marketing to existing clients about similar services — legitimate interest, with a clear opt-out (Art. 6(1)(f)). Marketing to non-clients — your consent (Art. 6(1)(a)).
Compliance with legal obligations (accounting, tax, anti-money-laundering, responding to lawful requests) — Art. 6(1)(c).
Establishing, exercising or defending legal claims — Art. 6(1)(f).
AI model improvement — we may use aggregated, de-identified data derived from usage of the Platform to evaluate and improve our AI Features. Personal data of Guests processed on behalf of Clients is not used to train third-party general-purpose AI models without the Client's instruction, and Guest content is not exposed to other Clients.
5. Cookies and Similar Technologies
We use cookies, pixels, local storage, and similar technologies as described in our Cookies Policy. Where required by law, non-essential cookies are only set after you give consent through our cookie banner.
6. Sharing of Personal Data
We share personal data with:
Service providers (sub-processors) — cloud infrastructure (e.g. Amazon Web Services), email and messaging providers (e.g. Postmark), analytics providers, customer-support tools, payment providers, AI/LLM infrastructure providers, and other vendors needed to deliver the Services. Sub-processors used in the Platform are listed at https://hotpilot.ai/subprocessors.
Our Clients — when you act as a Guest, your data is shared with the Client whose property you are booking with.
Professional advisors — accountants, auditors, lawyers, insurers under confidentiality.
Authorities — where required by law, court order, or to protect our rights, users, or the public.
Successors — in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality.
We do not sell personal data.
7. International Transfers
HotPilot is based in the EU, and we host most personal data within the European Economic Area (EEA). Some sub-processors may process data in countries outside the EEA, including the United States and the United Arab Emirates. Where this happens, we rely on appropriate safeguards under GDPR, such as the European Commission's Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms. You may request a copy of the relevant safeguards by contacting [email protected].
8. Retention
Account data: for the duration of the Client's contract plus up to 36 months for legal-defence purposes.
Booking and transaction records: 10 years (Bulgarian accounting and tax law) or as required locally.
Marketing leads: up to 24 months from last meaningful interaction, or earlier on opt-out.
Cookies and analytics data: as set out in the Cookies Policy.
AI conversation logs and audit logs: up to 24 months for security, fraud prevention and quality assurance, unless a longer retention is required by the Client's configuration or by law.
After these periods, data is deleted, anonymised, or kept under restricted processing for legal claims as permitted by law.
9. Your Rights under GDPR
Subject to applicable conditions and exceptions, you have the right to:
Access the personal data we hold about you;
Request rectification of inaccurate or incomplete data;
Request erasure ("right to be forgotten");
Restrict or object to certain processing, including direct marketing;
Receive your data in a portable format and have it transmitted to another controller;
Withdraw consent at any time, where processing is based on consent;
Not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, except where permitted by law;
Lodge a complaint with a supervisory authority.
To exercise your rights, contact [email protected]. We may need to verify your identity before processing your request and will respond within one (1) month, extendable by two further months for complex requests.
Note: where the request concerns data we process on behalf of a Client (e.g. Guest booking data), we will normally forward the request to that Client, who is the controller.
10. Security
We apply appropriate technical and organisational measures to protect personal data, including: encryption in transit (TLS 1.2+) and at rest, role-based access control, multi-factor authentication for staff, segregated environments, regular backups, vulnerability management, audit logging, and staff training. No system is perfectly secure; in the event of a personal-data breach, we will notify affected Clients and, where required, the supervisory authority within 72 hours of becoming aware.
11. Children
The Platform is not directed at children under 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us so we can delete it.
12. Automated Decisions and AI
The Platform includes AI Features (e.g. Guest assistants, dynamic pricing recommendations). Their outputs are advisory and are reviewed and applied by Clients (or by automation that the Client configures). HotPilot does not, on its own, make decisions producing legal or similarly significant effects on individuals based solely on automated processing, except where permitted by law.
13. Updates to this Policy
We may update this Privacy Policy from time to time. The version with the most recent "Last updated" date is the one in force. Material changes will be notified through the Website or by email.
HotPilot LTD.
Registered seat: bl. 64, ent. В, fl. 3, ap. 44, Lev Tolstoy, Sofia, Bulgaria
UIC: 208812339 | VAT ID: BG208812339
Privacy contact: [email protected] | Website: https://hotpilot.ai
Cookies Policy
HotPilot LTD. - Last updated: 20 May 2026
This Cookies Policy explains how HotPilot LTD. ("we", "us", "our") uses cookies and similar technologies on our website https://hotpilot.ai and on the booking and management interfaces of the HotPilot platform (the "Site"). It should be read together with our Privacy Policy.
1. What are cookies?
A cookie is a small text file placed on your device when you visit a website. Cookies allow the site to recognise your device, remember preferences, measure usage, and personalise content. We also use related technologies such as web beacons (pixels), local storage, session storage, and similar identifiers; this Policy refers to all of them as "cookies" for simplicity.
2. Categories of cookies we use
2.1 Strictly necessary
Required for the Site to work: authentication, session management, load balancing, security, fraud prevention, cookie-banner state. These cannot be turned off; if you block them, parts of the Site will not function.
2.2 Functional / preferences
Remember choices such as language, currency, region, and other interface preferences. Set on the basis of consent, where required by law.
Help us understand how visitors interact with the Site (pages viewed, time on page, scroll depth, conversion funnels) so we can improve it. Set on the basis of consent.
2.4 Marketing / advertising
Used to measure and optimise marketing campaigns, build retargeting audiences, attribute conversions, and personalise content. Set on the basis of consent.
3. Third parties and typical providers
Some cookies are set by third parties whose tools we embed. The exact providers may change; the cookie banner / preferences centre always reflects the current list. Examples include:
Analytics: Google Analytics 4
Marketing: Meta Pixel, Google Ads, Google Tag Manager, LinkedIn Insight Tag and more.
Booking-engine fraud prevention and payment redirects and more.
Third parties act as independent controllers for some processing. Please consult their own privacy and cookie statements.
4. Legal basis and consent
In line with the EU ePrivacy Directive (as transposed into Bulgarian law) and the GDPR:
Strictly necessary cookies are set on the basis of our legitimate interest in providing the Site you requested.
All other categories are set only after you give consent through our cookie banner. You can change your choices at any time via the "Cookie preferences" link in the footer.
5. How to manage cookies
Cookie preferences centre - accessible from the footer link "Cookie preferences".
Browser settings - most browsers let you delete or block cookies. Doing so may break parts of the Site.
Opt-out tools provided by some advertisers (e.g. https://www.youronlinechoices.eu).
6. Retention
Cookies have different lifetimes - some are deleted when you close your browser ("session cookies"), others remain for a defined period (typically up to 13 months for analytics cookies, in line with EDPB guidance). Detailed durations for each cookie are listed in our cookie preferences centre.
7. Changes
We may update this Policy when we add, remove, or change cookies. The "Last updated" date at the top reflects the current version.
Questions? [email protected]
