We keep this short and plain. This policy explains what FlowStay collects, why we collect it, and the choices you have. If anything here is unclear, write to us and we will answer directly.
Last updated: August 16, 2026
FlowStay ("we," "us") builds AI systems for hospitality businesses. This policy covers this marketing website and the forms and demos reachable from it, and it also covers the guest service calls and text messages FlowStay handles for guests of hotels and resorts that use FlowStay. When you contact us, request a demo, call a FlowStay concierge line, or exchange text messages with us, you are sharing information with FlowStay.
When you fill in a form, book a demo, or email us, we collect the contact details you provide: typically your name, work email, company, and whatever message you send. You choose what to share.
If you call a property served by FlowStay or exchange texts with us, we collect your phone number, the contents of the request you make, the messages sent and received, and a record of your consent to be texted, including when and how you gave it. Where a call is recorded or transcribed to log that consent and fulfill your request, we collect that recording or transcript too.
When you visit the site, we collect standard usage data: pages viewed, referring links, approximate location, and basic device and browser characteristics. This helps us understand what is useful and where the site can be better.
We use the information to respond to your enquiries, arrange and run demos, operate and improve the site, and keep the service secure. We do not sell your personal information. We do not use it for advertising networks.
If you give us your mobile number, either by telling a FlowStay agent during a call or by texting a FlowStay concierge number, we use it to send you text messages from FlowStay about your request and your stay. We collect your mobile number, the messages exchanged, and a record of your consent, including when and how it was given.
Your mobile information will not be sold or shared with third parties for promotional or marketing purposes. No mobile information collected for text messaging, including your phone number and your consent to be messaged, is sold, rented, or shared with third parties or affiliates for their own marketing.
We do disclose your number to two kinds of party, and only so that the messages can actually work: the licensed messaging providers and carriers that transmit the messages for us, and the property where you are staying, whose staff fulfill your request. These parties act on our instructions or the property's, not for their own marketing.
All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Reply STOP to any message to opt out, or HELP for help. You can also opt out by telling our agent on a call, by asking in your own words in a reply, or by emailing us. Message and data rates may apply, and message frequency varies with your requests. The full terms for this program are on our Terms page.
We use privacy-friendly, cookieless analytics. Our product analytics (PostHog) runs in memory-only mode, so it does not set tracking cookies on your browser, and we use Microsoft Clarity for aggregate usability insight. We rely on these tools to see how the site performs in aggregate, not to build advertising profiles.
To protect the platform and the people who use it, FlowStay processes device and network signals, including a device fingerprint, IP address, and coarse, city-level geolocation, for security, fraud prevention, and abuse detection. We process these signals on a legitimate-interest basis: they help us detect and prevent fraudulent bookings, credential abuse, and other platform abuse, and they let us investigate incidents when they occur.
The device signal may also include network and TLS characteristics of the connection, such as a TLS or JA3 fingerprint, which help us tell automated and evasive traffic apart from ordinary visitors. To assess the connection itself, we may share the IP address with a third-party security and fraud-prevention provider that acts as a sub-processor. That provider helps us classify the connection type, for example whether it is a VPN, proxy, or hosting network, and identify the network operator (ISP and ASN). We use those results only to weigh the risk of a request.
For security and abuse investigation, session recordings may be reviewed in connection with the device signal on a legitimate-interest basis. This is separate from the aggregate, non-identifying analytics described above: it applies only when we are looking into a specific security or abuse concern, not to ordinary reporting.
These signals are used for security and integrity purposes, not for advertising. We retain them only as long as necessary for those purposes and then remove or de-identify them. Where the law provides you rights over this processing, the choices described below apply.
This security and abuse-prevention processing rests on legitimate interest, and it is necessary to protect the service. For that reason it is not switched off by an analytics opt-out or a Do Not Track signal. Those choices continue to govern the aggregate analytics described above, but they do not disable the processing we rely on to keep the platform safe.
Depending on where you live, you may have the right to access, correct, or delete your personal information, to object to certain processing, or to ask us to restrict it. You can also ask us what we hold about you. To exercise any of these, contact us using the details below and we will respond within a reasonable time. You can opt out of analytics by using your browser's privacy controls or a Do Not Track signal, which we honor where technically feasible.
Questions about this policy or your data can go to hello@flowstay.ai. We read every message and reply directly.