1. About Hospass
Hospass is a host-funded hospitality service built at AI Garage. It helps organizations create events, issue personal guest passes, set spending limits, connect fulfillment providers, and coordinate orders. This policy explains how Hospass ("we", "us", or "our") handles personal information when you use app.hospass.com and related services.
Questions and privacy requests can be sent to hey@hospass.com.
2. Information we collect
Account and profile information
We collect information used to create and secure your account, such as your email address, name, profile image, authentication method, and account identifiers. If you sign in with Google, Google provides the basic profile information you authorize.
Organization and event information
Hosts may provide organization details, team-member and guest contact information, event names and times, venue addresses, budgets, ordering rules, approvals, and related records.
Pass, preference, and order information
We may process pass activity, meal preferences, conversations with Nomi, restaurant and menu selections, approval decisions, order status, fulfillment information, and records needed to operate or report on an event.
Provider and integration information
When an authorized host connects a third-party provider such as Swiggy, we process authorization tokens, provider account references, saved-address information, menu and availability results, and order-related responses needed to provide the requested integration. We do not collect card credentials through Google sign-in.
Technical and usage information
We may collect IP address, browser and device information, timestamps, security logs, error diagnostics, cookie and session data, and aggregated product-performance or usage information.
3. Google user data
Google sign-in gives Hospass access only to the basic identity scopes requested on the consent screen: your Google account identifier, name, email address, profile image, and email-verification status. We use this information to authenticate you, maintain your Hospass profile, protect your account, and show the correct identity inside the service.
Hospass does not request access to Gmail messages, Google Drive files, contacts, calendars, or other Google product content. We do not sell Google user data or use it for advertising. We share it only with service providers acting on our behalf, when needed to provide a feature you request, or when required by law. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
4. How we use information
- Authenticate users, maintain sessions, and protect accounts.
- Create organizations, events, guest passes, budgets, approvals, and reports.
- Provide Nomi guidance and fulfill user-requested provider workflows.
- Send authentication codes, invitations, operational notices, and support responses.
- Monitor reliability, prevent abuse, troubleshoot problems, and improve the service.
- Comply with applicable law and enforce our terms.
5. How information is shared
We may disclose information in the following limited circumstances:
- Hosts, organizations, and guests: information is shared between event participants as needed to issue passes, approve requests, fulfill orders, and provide event records.
- Fulfillment providers: addresses, preferences, selections, and order information may be sent to connected providers such as Swiggy when an authorized user requests the relevant workflow.
- Infrastructure providers: we use suppliers including Supabase for authentication and data services, Google for sign-in, Resend for authentication email, and Vercel for hosting, analytics, and performance monitoring.
- Legal and safety: we may disclose information when reasonably necessary to comply with law, protect users, investigate abuse, or defend legal rights.
- Business changes: information may transfer as part of a merger, financing, reorganization, acquisition, or sale, subject to appropriate safeguards.
We do not sell personal information.
6. Cookies and analytics
Hospass uses essential cookies to maintain secure sign-in sessions, remember necessary application state, and complete provider authorization flows. We also use Vercel Web Analytics and Speed Insights to understand aggregate usage and application performance. Browser controls can restrict cookies, but blocking essential cookies may prevent authentication or other core features from working.
7. Retention and deletion
We retain account information while your account is active and retain event, order, approval, security, and audit records for as long as reasonably necessary to operate Hospass, meet host reporting needs, resolve disputes, prevent fraud, and comply with legal obligations. Retention periods may vary by record type. Backups may retain deleted information for a limited period before routine expiry.
Signed-in users can review and delete their account from Security & sessions. Before deletion, an organization owner must transfer the workspace to a verified active member or, when no eligible successor exists, archive it. Account deletion removes active memberships, revokes pending invitations you authored, revokes personal provider accounts and event bindings, cryptographically erases provider credentials, deletes solely owned personal Storage objects, soft-deletes the authentication account, and redacts direct profile identifiers.
Hospass retains organization-owned and operational evidence that cannot safely be removed with one person: events, passes, orders, approvals, budget-ledger entries, reports and organization report files, and security or audit records. These records remain associated with an anonymized profile identifier so organizations can keep financial, operational, fraud-prevention, dispute, and compliance history. They no longer contain the deleted profile's email, phone, name, avatar, or provider credentials. Backups may retain prior data for a limited period before routine expiry.
If an account-deletion request stops after access has been removed but before all cleanup finishes, contact hey@hospass.com from the email previously used for Hospass. Do not send one-time codes, invitation links, provider tokens, or internal identifiers. We will resume the existing request. You can also revoke Google access through your Google Account's third-party connections page; revoking Google access alone does not delete Hospass records.
8. Security and international processing
We use reasonable administrative, technical, and organizational safeguards intended to protect personal information. No internet service can guarantee absolute security. Hospass and its service providers may process information in countries other than the one where you live, subject to applicable safeguards.
9. Children
Hospass is not directed to children and children may not independently create host accounts. Organizations using Hospass for programs involving minors are responsible for having appropriate authority and obtaining any consent required before providing a minor's information or issuing a pass.
10. Changes to this policy
We may update this policy as Hospass evolves. We will publish the revised version here and update the date above. We will provide additional notice when a material change requires it.