Your data and privacy

You are putting your guests’ details into somebody else’s software. This page is the operational answer to what that means — what is stored, who can reach it, and how to get it back out.

The legal document is the privacy policy. This page is how it works in practice.

Who controls it

Santara AI is a product of AirCierge AI LLC, registered in Wyoming, USA, with its operations team in Da Nang, Vietnam. Data questions and requests go to hello@santara.ai, or through support from inside the product, which arrives with your workspace attached.

Your host and guest data is not sold. Not to anyone, in any form.

What is held

Roughly, everything the product needs to run your day:

Kind	Examples
Property	Buildings, rooms, photos, house rules, wifi, door codes, access notes
Commercial	Rates, rate plans, availability, pricing rules, costs, owner statements
Reservation	Stays, dates, status, gross, room revenue and net payout
Guest	Name, contact details where the channel shares them, stay history, messages
Operational	Cleans, tickets, notes, who did what and when
Account	Your name, email, language, timezone, and a hash of your password

Passwords are stored as PBKDF2 hashes with 310,000 iterations, never as text. Nobody at Santara AI can read your password, and neither can we recover it — which is why a reset issues a new one rather than telling you the old one.

Who inside your workspace can see it

Not “everyone with a login”. Access is decided on three separate axes, and all three have to agree:

1. Capability — every screen and every API route asks for a named permission (stay.read, pricing.write, guest.message.send). Hiding a menu item is not the security; the route refuses a link somebody types by hand.
2. Scope — which buildings and rooms a person is attached to. A scoped member does not see the rest of your estate at all.
3. Data class — door codes, guest contact details and financial figures are each their own class, independent of the screen they appear on.

That third axis is the one people miss. It is why a cleaner can be told which building a job is in without being handed its door code, and why a manager can run the operation without seeing owner payouts. See Team and roles.

Nothing is shared between workspaces, ever. If you run two portfolios as two workspaces, they are two separate worlds even though you sign into both.

What the AI can see

The assistant answers using your workspace — that is the point of it — but under real limits:

• It uses your permissions, not its own. A cleaner asking about revenue is told they do not have access, not given a number.
• The workspace comes from your session, never from anything you or it can type. It cannot be argued into another workspace.
• It is read-only, with exactly one exception: it can draft a reply to a guest. It cannot send a message, change a price, alter a booking, take a listing live, or move money.

Guest messages, briefs and drafts are processed by a third-party AI model provider under contract, as the privacy policy describes. AI output can be wrong — briefs, drafts and pricing signals are all things you review before acting on. Nothing is sent to a guest without you pressing send.

What leaves your workspace

It goes to	What, and why
Airbnb / Booking.com	Availability, rates and restrictions out; bookings, guests, messages and reviews in — via our channel connectivity provider
AI model provider	The text needed to write a brief, draft a reply or score an opportunity
Stripe	Your card, for the subscription. Santara AI never sees the number
Stripe, your own account	Direct booking payments — see below
Email	Invitations, verification and reset codes, and anything you choose to send

Nothing else. There is no advertising network and no data broker in this list.

Money on your booking site

Payments from your direct booking site go into your own Stripe account, not ours. Santara AI never holds guest money and never takes a commission on a booking, on any channel.

Direct bookings carry 0% commission too.

Getting your data out

• Reports — every CSV on the report library is generated from live data at the moment you ask for it. Reservations, revenue, occupancy, upsells, costs and owner statements.
• Accounting — owner statements export per period and per property.
• Invoices — from Stripe’s own portal, via Managing payment.
• These docs — every page is also markdown, if you want the manual itself (Using these docs with AI tools).

For a full export beyond the reports — or a deletion request — email hello@santara.ai. Say which workspace.

What deleting actually deletes

Worth reading before you press anything, because the blast radius differs:

Action	What goes	What is untouched
Remove one listing	That room’s imported reservations, messages, guests and reviews	The listing on Airbnb or Booking.com
Disconnect an account	The same, for every listing on that connection; syncing stops	Everything on the channel’s side
Delete a property	The property and its rooms	Nothing is refunded for the current month
Remove a team member	Their access, immediately, on every device	Work they did stays attributed to them
Cancel the subscription	Nothing, until the paid period ends	Your channel listings keep running on the channel

Two of these surprise people:

• Removing a listing and re-importing it brings the history back on the next sync. It is not a destructive act in the way it sounds — the channel still has the data.
• Deleting a team member does not delete their work. Cleans they marked done and messages they sent stay in the record under their name. That is deliberate; an operational history that rewrites itself when somebody leaves is not a history.

Deleting a property that still has a connected listing is refused — disconnect its listings first, so the channel side is cleaned up rather than left pointing at a room that no longer exists.

If billing lapses

Your data does not vanish. An inactive subscription makes the workspace read-only — everything is still there, you simply cannot change it until billing is sorted. Syncing is what stops first. See If a payment fails.

Guest data is your responsibility too

Santara AI holds it; you decide who in your team can reach it. Two habits are worth building:

• Invite people properly rather than sharing a login. A shared login makes every access-control decision above meaningless, and destroys the record of who did what.
• Scope people to the buildings they work on. It costs nothing and it is the difference between a cleaner seeing one address and seeing your whole estate.