AI Disclosures

Last updated: 21 May 2026

1. You are interacting with an AI

When a guest messages a HostPal-enabled property via WhatsApp, Telegram, or any supported channel, replies are generated by a large language model (LLM) on behalf of the host. The bot will identify itself as an AI concierge at the start of every new conversation. This page provides the standing transparency information required by Article 50(1) of the EU AI Act.

1a. Provider and deployer roles

Under the EU AI Act, HostPal is the "provider" of the AI system: we design and operate it. The host is the "deployer": they decide whether to enable AI replies on their property and configure how it behaves. The Art. 50(1) disclosure described here is shipped on by default for every property; hosts may disable it per-property in their dashboard. Disabling the disclosure is a deployer choice and does not exempt the host from disclosure obligations under applicable law. The toggle change is recorded in our audit log (timestamp, IP, user identity) and the host is asked to confirm responsibility before the change is applied. The host's acceptance of our Terms includes a representation that they will comply with applicable AI-disclosure law in their jurisdiction.

2. What the AI does

The Service uses large language models served by third-party providers (currently OpenRouter routing to OpenAI, Anthropic, and Google models — listed in our Privacy Policy). The bot reads guest messages, retrieves relevant information from the host's knowledge base and active reservation data, and generates a reply. Routing decisions, model identities, and prompt strategies are operational details that may change without notice as we improve the Service.

3. Automated processing — your right to human review

The Service includes automated processing in two places relevant to GDPR Article 13(2)(f) and Article 22 transparency: (a) reply generation — an LLM drafts the bot's response from your message; and (b) routing & escalation classification — automated logic decides whether to pass a conversation to the host, treat a message as an emergency, or apply a host-configured restriction. These decisions do not produce legal or similarly-significant effects on a guest in the Article 22(1) sense (they are routing choices within a consumer messaging flow), but you nonetheless retain the right to human review: ask in chat or email [email protected] and we will route your conversation to a human host. Hosts can also flip any conversation to HUMAN mode from their inbox to disable automated reply.

4. What the AI may get wrong

By using the Service, hosts and guests acknowledge that LLM-generated content:

• May contain inaccurate, outdated, or fabricated information ("hallucinations"), notwithstanding the grounding measures we apply.
• May misclassify a guest's intent and produce a response inappropriate to the actual question.
• May fail to escalate a situation that the host would have escalated manually.
• May be manipulated by adversarial inputs (prompt injection, social engineering) despite our defences.
• May respond with latency of seconds to minutes (and rarely, longer during provider incidents).

5. Host responsibilities

If you are a host, you are responsible for:

• Reviewing bot replies in your inbox at a cadence appropriate to your risk tolerance.
• Configuring escalation rules appropriate to the property and your guests.
• Using AI_ASSIST or HUMAN mode for situations where automated reply is not appropriate (legal disputes, refund negotiations, high-value damage claims).
• Curating the knowledge base to be accurate and complete — gaps cause the AI to defer or, in adversarial cases, to confabulate.
• Not relying on the Service for emergencies. The AI bot can route an emergency notification to your configured contact, but the Service is not a monitored 24/7 emergency response line. Guests in life-threatening situations should be told to dial local emergency services.

6. Guest expectations

If you are a guest interacting with a HostPal-enabled property:

• Replies are AI-generated. The bot will identify itself at the start of the conversation.
• Reply latency varies. Critical matters should be raised by phone to the host's emergency contact, not over chat.
• You can ask to speak to a human at any time. The bot will pass the conversation to the host.
• In any life-threatening situation, contact local emergency services first. The bot is not a substitute.

7. Training data

HostPal does not use guest message content to train any model. Our LLM provider sub-processors (OpenRouter, OpenAI, Anthropic, Google) operate under their own contractual no-train commitments for API traffic. We do not sell or share message contents for advertising or model improvement.

8. Risk classification

HostPal's chatbot falls within the "limited-risk AI system" category under the EU AI Act and is subject to the transparency obligations of Article 50(1). It is not classified as a high-risk system. We will re-classify and update this page if regulatory guidance or our use cases change.

9. Questions or complaints

If you believe an AI-generated reply caused a problem, contact [email protected]. You also have the right to lodge a complaint with your supervisory authority (in the EU/EEA) or the relevant data-protection regulator in your jurisdiction.