What we collect when you search, call or book, who it goes to, how long it is kept, and how to get it corrected or deleted.
Last updated 5 September 2026.
Spotbo, Inc., 1111B S Governors Ave STE 29027, Dover, DE 19904, United States, operates Callstayand is the controller of the personal data described here. For anything on this page, write to [email protected].
This policy covers callstay.com, theCallstayphone line, and the emails and text messages we send. It does not cover what a property does with your details once it holds your booking; the property is a separate controller with its own privacy notice.
| What | Examples | When |
|---|---|---|
| The stay you describe | Destination, dates, rooms, party size, budget, requirements such as parking, a kitchen, or step-free access | Searching the site, filling in the checkout, or telling the assistant |
| Contact and identity details | Name, email address, phone number, and the names of the other people travelling | Checkout, a booking by phone, creating an account |
| Booking records | Property, room, dates, price, cancellation terms, the supplier’s booking reference, the property’s confirmation number, changes, cancellations, refunds | When a booking is held, confirmed or changed |
| Payment references | The supplier’s transaction id, the amount and currency. Never your card number (section 6) | When you pay on the payment page |
| Call audio and transcripts | The recording of your call and its transcript, where you have been told the call is recorded | Calling the phone line |
| Calls and texts we make | The number called, when, whether it was answered, the text we sent, any voicemail we left, and a STOP or opt-out you sent | When we call or text you about a booking |
| Website assistant | Audio from your microphone while you use it, and the transcript | Using the assistant on the website |
| Blocked numbers | A phone number we have stopped answering, and why | Abuse or fraud on the line (section 5) |
| Caller memory | Your phone number matched to your name and the stays you asked about | Calling the phone line more than once (section 5) |
| Account data | Email address, password (hashed), sign-in sessions with browser type and IP address, email preferences | If you create an account |
| Unfinished bookings | The email address, stay and property from a checkout you started and did not complete | Typing an email address into the checkout |
| Messages with us | Emails you send us and our replies | Contacting us |
| Usage events | Pages viewed, clicks, searches, how long a page was open, how far it was scrolled, timing of our own requests, and any error the browser hit. Each visit carries a random id that lives in the tab and is gone when the tab closes; it is never a cookie and never joined to an account, name or email. We keep the country and the device type (phone, tablet, desktop), not the IP address or the browser fingerprint. | Visiting the site. We run this ourselves, on our own servers; no analytics company receives it. |
| Technical data | IP address, browser, device type, pages requested, approximate country from your IP address, referring page | Visiting the site, in server logs |
We do not collect government identification numbers, passport details, or any special category of data. If you tell the assistant something sensitive, for example a medical reason for a requirement, it is kept only as part of the call record and the booking requirement, and only for as long as those are.
Almost all of it comes from you. The rest comes from our booking supplier, Nuitee Travel Limited, which sends us the property’s confirmation number, check-in instructions, changes such as a relocation, and refund and cancellation notices for your booking; from the property, through the supplier; and from your browser and phone network, which supply the technical data and the number you are calling from. If someone books for you, your details come from them; if you book for someone else, you must have their permission and tell them about this policy.
| Purpose | Legal basis |
|---|---|
| Finding rooms, holding a rate, placing and confirming your booking, sending the confirmation, changes and cancellations, and helping you with the stay | Performing our contract with you, and the steps you ask for before it |
| Passing your details to the supplier and the property so the room can be held in your name | Performing our contract with you |
| Sending the pre-arrival reminder, the property’s confirmation number and check-in instructions | Performing our contract with you |
| One reminder about a booking you started and did not finish; a review request after your stay | Our legitimate interest in completing bookings and improving the service. You can object or unsubscribe at any time |
| Recording calls and keeping transcripts, to check what was agreed and to review quality | Your consent, given when you continue after the notice at the start of the call; and our legitimate interest in resolving disputes about a booking |
| Recognising your number when you call back | Our legitimate interest in not asking you the same questions twice. You can stop it at any time (section 5) |
| Calling and texting you about your booking, including with an automated or AI voice | Performing our contract with you, and the consent you give by providing the number, which you can withdraw at any time |
| Checking who we are speaking to before changing or discussing a booking | Our legitimate interest, and yours, in bookings not being changed by strangers |
| Keeping a list of numbers we no longer answer | Our legitimate interest in protecting the line and our staff from abuse and fraud |
| Running the site securely, preventing fraud and abuse, and keeping server logs | Our legitimate interest in a service that works and is not misused |
| Keeping booking and payment records | Our legal obligations, including tax and accounting |
| Telling our own team about a booking that needs attention | Our legitimate interest in running the service |
| Answering your emails and handling complaints and legal claims | Performing our contract; our legitimate interest in defending claims |
We do not use your data for advertising, we do not build profiles of you for marketing, and we do not sell it.
Calls toCallstayare answered by an AI assistant. You are told that at the start of the call, and you can ask for a person at any point. The assistant runs on speech and language models provided by ElevenLabs and Google (section7). Your words are sent to those providers to be understood and answered. They process them on our instructions and are not permitted to use them for their own purposes.
Calls are recorded for accuracy of the booking and for quality. You are told at the start of every call, before anything is recorded. Where your state or country requires everyone on a call to agree to recording, continuing after the notice is that agreement. If you would rather not be recorded, say so and the call continues without it. Recordings and transcripts are kept for 90 days and then deleted, unless a dispute about the booking is open, in which case the recording for that call is kept until the dispute is closed.
If you have called before, the assistant may recognise the number you are calling from, greet you by name and skip questions you have already answered. That is your phone number matched against what you told us last time, nothing more. Say “don’t remember me” and we erase your name and history on the spot and stop recognising the number. We keep the number itself only so we know not to greet it; to have that removed as well, email [email protected].
We call and text the number on a booking about that booking: the payment link, the confirmation, a change the property makes, a relocation, a reminder before arrival, and a request for a review afterwards. Some of those calls may be placed automatically or spoken by an AI voice, and where we reach voicemail we may leave a message with the booking reference and our number, and nothing more. We do not make marketing calls, and we do not send marketing texts without your separate agreement. Reply STOP to any text, or tell us on a call or by email, and we stop; we keep a record of the opt-out so that we do not contact that number again. We do not record the calls we make unless you are told at the start.
Where the assistant is available on the website, your browser asks for permission to use your microphone. Audio is streamed to the providers named in section7while you speak and is not kept as audio; the transcript is kept for 90 days like a call transcript. Close the page and the microphone stops.
Before we change, cancel or discuss a booking on a call, we ask for details only the person who made it should know. We keep a note that the check was passed or failed, with the call record. We may stop answering a number that is abusive, fraudulent or repeatedly attempts to obtain someone else’s booking, and we keep that number, and the reason, for as long as the block stands.
The assistant does not make decisions about you that have legal or similarly significant effects. It does not decide what you pay, whether you may book, or what you are told about a rate; those come from the supplier and the property, and every booking is confirmed to you in writing for you to check.
We do not take card numbers by voice, and our assistant never hears one. On the payment page your card details go straight to our booking supplier’s payment provider.Spotbo, Inc.does not receive, see, store or log your card number, and it does not appear in any recording, transcript or email.
What we keep is the supplier’s transaction reference, the amount and the currency, so the payment can be matched to the booking and refunded if needed. The supplier, Nuitee Travel Limited, and its payment provider handle your card data under their own privacy notices and the card-industry security standard.
| Data | Kept for |
|---|---|
| Booking, payment reference and supplier records | Seven years after the stay, for tax, accounting and dispute purposes |
| Call recordings and transcripts | 90 days, then deleted; longer only while a dispute about that booking is open |
| Usage events | 180 days, then deleted. |
| Caller memory (your number, name and past requests) | Until you ask the assistant or us to forget you |
| Website assistant transcripts | 90 days |
| Records of calls and texts we made, and opt-outs | With the booking record; an opt-out for as long as we hold the number |
| Blocked numbers | For as long as the block stands; reviewed yearly |
| Unfinished bookings | 30 days from when you last touched the checkout |
| Quotes and payment links that were never paid | Twelve months |
| Account | Until you delete it or ask us to; sign-in sessions expire on their own |
| Emails with us | Three years from the last message |
| Server logs | Up to 30 days |
When a period ends the data is deleted or anonymised. Where we need to keep a record that you asked us to delete something, we keep only what proves the request was honoured.
We are a United States company and our records are stored in the United States. Our booking supplier is in Ireland, and the property you book is wherever you are staying. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred outside those areas to make the booking you asked for; that transfer is necessary to perform your contract, and where we use providers in the United States we rely on the EU-US Data Privacy Framework where the provider is certified and on standard contractual clauses otherwise.
Connections to the site are encrypted. Passwords are stored hashed. Access to records is limited to the people who need it, and payment links and account sessions are short-lived tokens. Card numbers never enter our systems, which is the single largest reduction in what an incident could expose. No system is perfectly secure; if we learn of a breach that puts you at risk, we will tell you and the authorities as the law requires.
Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it for a particular purpose, and object to our use of it where we rely on a legitimate interest. Email [email protected]. We will confirm who you are, usually by writing to the email address or calling the phone number on the record, and respond within 30 days. We do not charge for this and we will not treat you differently for asking. If we refuse a request we will say why, and you can ask us to reconsider.
We cannot delete a booking record while the stay is ahead of you or while we are required to keep it (section9), but we will delete everything else.
If you live in California, you have the rights above under the California Consumer Privacy Act, including the right to know the categories of personal information we collect, use and disclose, which are set out in sections2, 4 and 7; the right to delete; the right to correct; and the right not to be discriminated against for exercising them. We do not sell personal information or share it for cross-context behavioural advertising, so there is no opt-out to offer, and we do not use or disclose sensitive personal information for any purpose that would require a right to limit. You may use an authorised agent, who will need your written permission. Residents of Colorado, Connecticut, Virginia, Texas, Oregon and other states with similar laws have the same rights, and the right to appeal our decision by replying to it.
You have the rights above under the GDPR and equivalent law, plus the right to data portability, the right to withdraw consent at any time where we rely on it (which does not affect what was done before), and the right to complain to your data protection authority. We would rather you came to us first, but you do not have to.
Callstayis for adults. We do not knowingly collect personal data from anyone under 18, except the names of children travelling with an adult who books. If you believe a child has given us data directly, tell us and we will delete it.
If this policy changes materially we will say so on this page, change the date at the top, and email account holders. The policy in force when you booked applies to that booking’s data until the change takes effect.
Spotbo, Inc.
1111B S Governors Ave STE 29027, Dover, DE 19904, United States
[email protected] · (888) 789-8585