Privacy Policy

01Overview

This Privacy Policy explains how Hostor ("Hostor", "we", "us") collects, uses, shares and protects personal information when you visit our website, create an account, or use the Hostor AI receptionist on a website that has installed it.

We have written it in plain language on purpose. If anything here is unclear, ask us before you agree to it.

02Who we are

Hostor is the entity responsible for this website and the Hostor service. Our registered address is [Registered business address], and you can reach us at support@pointr.com for any privacy question, including requests to exercise your rights.

03Information we collect

We collect four broad categories of information.

• Account information — name, work email, company name, password credentials, billing contact and, for paid plans, payment details processed by our payment provider. We do not store full card numbers.
• Content you provide for training — the website URLs, pages, help articles, documents and FAQs you connect so your assistant can answer from them, plus any custom instructions, greetings or brand settings you configure.
• Conversation data — messages exchanged between a website visitor and your assistant, along with any details the visitor chooses to share, such as name, email, phone number or enquiry details, and technical metadata like timestamp, page URL, approximate location derived from IP, browser and language.
• Usage and device data — log data, IP address, device and browser type, referring pages, feature usage and diagnostic information we use to keep the service running and secure.

We do not intentionally collect special categories of personal data (such as health, biometric or financial account data) and we ask that you do not configure your assistant to solicit it.

04How we use information

We use personal information to:

• Provide the service — index your content, generate answers, capture leads, book meetings and route conversations to your team.
• Maintain and improve reliability, accuracy and safety, including debugging, abuse prevention and quality review of failed or flagged answers.
• Handle billing, plan limits, renewals and account administration.
• Communicate with you about service changes, security notices and support requests.
• Send product and marketing messages where you have opted in, with an unsubscribe link in every message.
• Comply with legal obligations and enforce our Terms of Service.

05Legal bases for processing

Where the GDPR or similar laws apply, we rely on the following legal bases:

• Performance of a contract — to deliver the service you signed up for and to bill you for it.
• Legitimate interests — to secure the service, prevent abuse, understand usage and improve the product, balanced against your rights.
• Consent — for optional cookies and marketing communications, which you can withdraw at any time.
• Legal obligation — where we must retain or disclose information to comply with the law.

06AI processing and subprocessors

To generate answers, your content and the visitor's message are sent to third-party large language model providers acting as our subprocessors under contract. These providers process the data only to return a response to us and are contractually prohibited from using it to train their own models.

We also rely on subprocessors for hosting, storage, analytics, email delivery and payment processing. A current list of subprocessors is available on request, and we will give notice before adding a new one that materially affects the processing of your data.

07If you install Hostor on your website

When you deploy the assistant, you decide what data it collects from your visitors. That makes you responsible for the lawful basis of that collection. In particular you must:

• Disclose in your own privacy policy that an AI assistant is used and that conversations are recorded and processed.
• Obtain any consent your jurisdiction requires before collecting personal data or setting non-essential cookies.
• Only connect content you have the right to use, and avoid configuring the assistant to request sensitive personal data.
• Respond to your visitors' data rights requests, with our assistance where the data sits in our systems.

08When we share information

We share personal information only in these situations:

• With the website owner — conversations and leads captured by an assistant are shared with the customer who operates it.
• With subprocessors and service providers, bound by contract and permitted to use the data only to provide services to us.
• With integrations you enable — for example your CRM, calendar or messaging tool, at your direction.
• For legal reasons — where we reasonably believe disclosure is required by law, or is necessary to protect rights, safety or the integrity of the service.
• In a business transfer — if we are involved in a merger, acquisition or sale of assets, with notice to affected users.

09International data transfers

We and our subprocessors may process data in countries other than your own. Where we transfer personal data out of the EEA, UK or other regions with transfer restrictions, we use an approved safeguard such as Standard Contractual Clauses together with additional technical and organisational measures.

10Data retention

We keep personal information only as long as it is needed for the purposes described here.

• Account data — for the life of your account and for a limited period afterwards to meet tax, accounting and legal obligations.
• Conversation transcripts and leads — for the retention window configured on your plan, or until you delete them.
• Training content — until you disconnect the source or delete your knowledge base.
• Logs and diagnostics — for a short rolling period, then deleted or aggregated.

On account closure we delete or anonymise personal data within a reasonable period, except where retention is legally required.

11Security

We protect data in transit with TLS and at rest with industry-standard encryption. We apply least-privilege access controls, log administrative access, and review our security practices regularly.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulator as required by law and without undue delay.

12Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy of it.
• Correct information that is inaccurate or incomplete.
• Delete your personal information, subject to legal retention requirements.
• Restrict or object to certain processing, including direct marketing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.
• Lodge a complaint with your local data protection authority.

To exercise any of these, email support@pointr.com. We will respond within the period required by applicable law. If your data was collected by an assistant on someone else's website, we will direct your request to that website owner, who controls it.

13Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to keep the service secure. With your consent we also use analytics cookies to understand how the site and product are used.

The chat widget stores a small identifier on the visitor's device so a conversation survives a page refresh. You can clear cookies through your browser settings, though some features may stop working.

14Children's privacy

The service is intended for businesses and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

15Changes to this policy

We may update this policy as the product and the law evolve. We will update the date at the top of this page, and for material changes we will notify account holders by email or in-product before the change takes effect.