Privacy is not an appendix. It is a condition.

hosp. builds AI systems for hotels, restaurants and resorts. Those systems process guest data: names, stays, preferences, correspondence. We treat that data as the property of the house that entrusts it to us, never as raw material for anything else.

In practice that means: your data does not leave the agreed environment, is not reused anywhere and can be retrieved or deleted at any moment. Every agreement below can be verified and is on paper before we build.

Hosting within the EU is possible. For houses that ask for it, we set up the entire processing on servers within the European Union. That applies to the AI models themselves as well: they then run in a European cloud region, for example through AWS in Frankfurt or Paris. Your data is processed there, does not train the model and is not kept by the model provider after processing. Exactly which models and which regions a system uses is set out in the documentation for that system. Where we work with subcontractors, they are listed in the data processing agreement by name and country of establishment.

No model training on guest data. Your guests' data is not used to train or improve AI models. Not by us, and under our agreements with model providers not by them either.

A data processing agreement as standard. Every system comes with a data processing agreement under article 28 of the GDPR. It governs purpose limitation, security, subprocessors, the duty to report incidents and deletion afterwards.

Data minimisation. Every system is given access only to the data it needs for its task. A system that writes daily reports has no need to read guest profiles, and with us it cannot do so either.

The data remains the property of the house. When a collaboration ends, we hand over all data in a readable, transferable format and delete our copies, with proof of that deletion.

Transparency towards the guest. Where the law requires it, it is clear to the guest that an AI system is helping to write or to think things through. We decide with the house how that notice reads, in keeping with the tone of the brand.

Always human oversight of outgoing communication. Messages to guests are seen by a member of staff before they go out: human in the loop. That changes only once a house decides for itself to let a category of messages go, and the law allows it.

No prohibited or high-risk applications. We build no systems that fall under the prohibited practices of the EU AI Act and no applications in the high-risk categories of Annex III. Our systems support administration and communication; they take no decisions about people.

Documentation for every system. Every system we deliver comes with a dossier: purpose, data flows, models used, human checkpoints and logging. That way your house can show for itself, at an audit or when a guest asks, exactly how guest data is handled.

What you fill in. The scan asks for one thing: the address of your website. Nothing else is asked and there is no account. While the scan runs, your browser keeps one marker that lets us recognise automated abuse. It disappears the moment you close the tab.

Where the analysis runs. This website does not run the analysis itself. The address, the language of the page and your IP address go to our analysis service, which fetches your website, reads it and writes the report. The IP address is used only to limit the number of scans per visitor. That limit sits at the service, and this site also brakes a burst of requests itself: for that the server holds your IP address with a counter in its working memory, in a window of one hour, and throws it away at the first request after that hour. Beyond that this site records nothing: the address of your website and your IP address are held here in no file, in no database and in no log line. We share that service with our sister organisation Winvent.

The report is written by AI. The text you get back is produced automatically by an AI model. Nobody here reads it before you do, and that is stated at the field and under the report as well. The report is held briefly at the service, so the same website is not read twice in a row. The figures in it are an indication based on your website, not a calculation for your house.

If you leave your email address. Under the report you can ask to receive it by email. That address goes to the same service and stays there for 90 days at most. No automatic email goes out: Martin sends the report himself. You are not added to a list, your address is not shared, and an address that came in through hosp.nl does not travel to another brand.

What you can ask for. Which model the scan uses, the risk class it falls under and what is logged are set out in the AI register of that service. Ask us for it and we will send it. If you want your address or your report removed sooner than the period above, we do that on request.

This website places no cookies that require consent. We measure visits with Vercel Analytics, without cookies and without data that can be traced back to a person. No advertising tracking is running.

If you send us an email, we use your details only to reply. They are not shared and not added to any list.

We answer questions about privacy, the GDPR or the EU AI Act by email at martin.veltman@hospautomations.com. We reply within one working day.

Last updated: 15 August 2026