Business contact data notice

Last updated: 15 August 2026

This notice explains a research-only workflow Host-Pilot may use to evaluate whether an independently operated short-term-rental business could benefit from Host-Pilot. The workflow is currently held behind an engineering and legal activation gate. Publishing this notice does not mean that automated research has been activated.

Controller and contact

Host-Pilot.ai, operated by Mouhad Lassoued (sole proprietorship), Buschallee 3, 13088 Berlin, Germany, is the controller. For access, correction, deletion, restriction, objection, or other privacy requests, use our contact form and write “Business contact data privacy request”.

Data and public sources

If the workflow is activated, we may record a deliberately published business email address, an exact Airbnb or Booking.com listing URL, the independent public page where both appeared, host and property facts visible on that page, estimated property count, website URL and observable website limitations, qualification scores and reason codes, and verification timestamps.

Evidence must come from an independent, public, non-gated business page that visibly contains both the business email and the listing link. The workflow must not automatically open, crawl, scrape, monitor, or copy Airbnb or Booking.com pages. It also excludes login-only social groups, private forums, search-result pages, data brokers, people-search services, guessed addresses, hotels, large operators, and businesses with more than ten properties.

Purpose, legal basis, and contact prohibition

The proposed purpose is limited internal market research, qualification, and creation of a temporary private product demonstration. The recorded legal basis is legitimate interests under Article 6(1)(f) GDPR, subject to the documented balancing assessment and approval by Host-Pilot’s responsible legal owner. Data will not be sold, added to a prospect mailing list, or used to send unsolicited marketing email. Reports may be delivered only to Host-Pilot’s own designated internal addresses.

Scoring and demonstrations

A score from 1 to 100 may prioritize small independent hosts, no direct website, or objectively weak direct-booking capabilities. The system hard-rejects large operators, hotels, more than ten properties, and evidence with less than 90% listing-to-email match confidence. A score is an internal research aid. It does not produce a legal or similarly significant decision about the person. A temporary demo may use the same generation engine as Host-Pilot’s customer product, but it is private, read-only, unclaimed, and expires after 30 days unless a person independently signs up and completes the paid onboarding flow.

Recipients, processors, and transfers

Access is restricted to authorized Host-Pilot administrators. Depending on the enabled workflow, service providers may include Supabase for database and private file storage, Vercel for application hosting, OpenAI for constrained public-source research or content generation, and Resend only for a private report sent to Host-Pilot’s internal recipients. Resend is not permitted to deliver messages to researched prospects. Where processing occurs outside the EEA, Host-Pilot uses the provider’s contractual transfer safeguards, including standard contractual clauses or an applicable adequacy mechanism, and reviews subprocessors before activation.

Retention and security

Candidate evidence, temporary demos, and associated personal data are scheduled for deletion after 30 days unless a shorter period is required or the person becomes a customer through their own action. Private report files have restricted access and short-lived links. Audit records may retain non-content security facts where necessary to demonstrate deletion and enforce suppression.

Your rights

You may request access, correction, deletion, restriction, or a copy of your data, and you may object to processing based on legitimate interests. An objection stops further research use unless a legally permitted overriding reason applies; there is no balancing test for direct marketing because this workflow prohibits direct marketing to researched prospects. You may also complain to a competent supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information.

Information where data was not obtained from you

This page is designed to provide the categories, sources, purposes, recipients, safeguards, retention, scoring information, and rights required when information was obtained from public sources. Before activation, Host-Pilot must document how and when Article 14 GDPR information will be provided in the actual workflow and record approval by the responsible legal owner. Host-Pilot does not treat publication of this page alone as automatic permission to begin processing.