Privacy Policy
Which policy applies to you
This Privacy Policy does not apply where Tongo acts as a service provider and processes personal data on behalf of a hotel or hospitality customer — for example, where a hotel has deployed Stella for its guests. Our use of that data is governed by our agreement with that hotel, and that hotel's own privacy notice describes its practices. If you are unsure which applies, contact us at hello@letstongo.com and we will tell you.
1. Who we are and our role
1.1 Tongo Inc., a Delaware corporation with its principal place of business at 1401 South Lamar Boulevard, Austin, Texas 78704.
1.2 Our role depends on how you reached the Service.
| Scenario | Our role | Who decides how data is used |
|---|---|---|
| Stella embedded on a hotel's website or app | Service provider | The hotel |
| Hotel-initiated pre-arrival or in-stay messaging | Service provider | The hotel |
| Guest data supplied by a hotel's reservation or property management system | Service provider | The hotel |
| Stella on Tongo's own website or app | Business | Tongo |
| Tongo marketing and prospect data | Business | Tongo |
| Referral of a booking to a third-party provider | Referral record: Tongo. The provider is separate. | Both |
1.3 Where we act as a service provider, the hotel is responsible for its own privacy notice and for responding to your rights requests. We will assist and, where appropriate, forward your request. See Section 8.11.
2. What we collect
2.1 Conversational data. The full content of your messages and Stella's responses, including travel dates, party composition, preferences, budgets, occasions, and anything else you choose to share. Also timestamps, message metadata, and conversation identifiers.
2.2 Identifiers and contact data. Name, email address, mobile phone number, messaging platform identifier, reservation or confirmation number, loyalty identifier, and hotel or property association.
2.3 Stay and transaction data. Property, arrival and departure dates, room type, requests made, bookings referred through the Service, referral and commission attribution, and cancellation history. Received in part from the hotel's reservation or property management systems.
2.4 Device and technical data. IP address, device type and identifiers, browser type and version, operating system, language, referring URL, mobile carrier, and approximate location derived from IP address.
2.5 Usage data. Screens and pages viewed, session duration, click and tap events, message delivery and open events, and feature interactions. Collected through cookies and server logs. See Section 9.
2.6 Location. Approximate location derived from your IP address. Precise location only if you affirmatively grant device permission or state it in conversation. You may revoke device permission at any time.
2.7 Payments. Tongo is not the merchant of record and does not collect, process, or store payment card information. Payments for bookings are handled entirely by the third-party booking provider. Do not enter card numbers into the conversation. We apply automated detection to drop card-pattern data at the point of collection.
2.8 Data from third parties. Hotel partners (reservation and property management records, stay history), booking providers (confirmations, cancellations), messaging platforms (delivery status), and analytics providers.
2.9 Inferred data. Preference profiles and interest categories derived from your conversations, used to personalize recommendations during your stay. See Section 11.
2.10 Health-adjacent data — the Stay Vault. We do not request it, but the concierge context means you may volunteer allergies, dietary restrictions, mobility limitations, or accessibility needs. Where you do, that information is placed in the Stay Vault:
- Used only to fulfill your request during your stay;
- Never used to train, fine-tune, or improve any AI model, ours or a third party's;
- Never used to build preference profiles or segments;
- Never used for advertising, marketing, or cross-context behavioral advertising;
- Never shared with third parties for their own advertising or data-mining purposes;
- Never added to your guest profile in the hotel's systems;
- Shared with your hotel or a booking provider only as needed to fulfill the specific request;
- Deleted at the end of your stay.
Washington and Nevada residents should also see our Consumer Health Data Privacy Notice.
3. How we use data
3.1 Delivering the Service. Generating responses, answering questions, making referrals, coordinating with hotel staff and booking providers, and providing support.
3.2 Personalization. Tailoring recommendations to your stated and inferred preferences, party composition, budget, and stay context.
3.3 Sharing back to your hotel. We share your conversation content, stated preferences, requests, and booking activity with the hotel you are staying at or inquiring about — including by adding preferences to your guest profile in the hotel's own systems — so it can serve you better during and after your stay. This is a core function of the Service. The hotel's privacy notice governs its use of that information. Stay Vault information is not shared this way; see Section 2.10.
3.4 We do not currently use your conversations to train AI models.
We do not use your conversations to train, fine-tune, or improve artificial intelligence models. We contractually require our AI model providers not to use your data to train their own models.
If this changes, we will update this Policy, provide advance notice, and offer you a choice before doing so. Any such change will apply only to data collected after the change takes effect.
3.5 Quality assurance and safety. Named, access-controlled Tongo personnel may read individual conversations to detect failures, unsafe outputs, and quality problems, and to investigate abuse, fraud, and attempts to manipulate the system. This access is logged. Conversations reviewed for one property are not used to serve another.
3.6 Legal. Complying with law, enforcing our Terms, and establishing, exercising, or defending legal claims.
3.7 Analytics and reporting. Aggregate and de-identified reporting to hotel partners, product analytics, and revenue attribution. Where we de-identify information, we maintain it in de-identified form and do not attempt to reidentify it, except to verify that our de-identification process meets legal requirements.
4. Legal basis for processing
United States state privacy laws do not use a European-style lawful-basis model. We process personal information on the basis of notice at collection, purpose limitation, opt-in consent where required for sensitive personal information, and the opt-out rights described in Section 8. The Service is offered in the United States only.
5. Who we share data with
5.1 Your hotel. See Section 3.3.
5.2 Categories of recipients.
| Category | Purpose |
|---|---|
| AI and large language model providers | Generate responses |
| Cloud hosting and storage | Infrastructure |
| Messaging platforms, aggregators, and carriers | Deliver SMS, RCS, and WhatsApp messages |
| Booking providers | Fulfill referred bookings |
| Analytics and telemetry | Measure and improve the Service |
| CRM, support, and email | Operations |
| Professional advisers, auditors, insurers | Legal and financial |
A list of our service providers is available on request at hello@letstongo.com.
5.3 Legal and corporate. We may disclose data to comply with law or valid legal process; to enforce our Terms; to protect rights, safety, and property; and in connection with a merger, acquisition, financing, bankruptcy, or sale of assets.
5.4 Messaging consent data. We do not share, sell, rent, or otherwise provide your mobile phone number, text messaging originator opt-in data, or SMS consent information to any third parties or affiliates for their own marketing or promotional purposes. This information is shared only with the relevant hotel, with service providers who deliver messages on our behalf, and as required by law.
5.5 We do not sell or share your personal information. We do not sell personal information for monetary consideration, and we do not share it for cross-context behavioral advertising, as those terms are defined under California and other state privacy laws. We do not use advertising or retargeting technologies on the Service. If you have questions, contact hello@letstongo.com.
5.6 Sensitive information. We do not sell or share sensitive personal information, including Stay Vault information.
6. Where data is processed
Personal information is processed and stored in the United States. Certain service providers may process data in other regions.
7. How long we keep data
| Data | Retention period |
|---|---|
| Conversation content | 24 months from your last interaction, then deleted or de-identified |
| Stay Vault information | Deleted at the end of your stay |
| Booking and referral records | 7 years, for tax, accounting, and dispute purposes |
| Messaging consent records | 5 years |
| Device, log, and security data | 24 months |
| Marketing suppression list | Indefinite, to honor your opt-out |
| Support tickets | 24 months |
| Backups | 90 days, rolling |
Where we act as a service provider, retention follows the hotel's instructions. We may retain data longer where required by law or to establish or defend legal claims.
8. Your rights
8.1 Available to all users. Regardless of your state, we extend to all users the rights to access a copy of your data, correct inaccuracies, delete your data, receive it in a portable format, and opt out of marketing.
8.2 Correction and model outputs. We will make reasonable efforts to correct inaccurate information we hold about you. However, because of how AI models work, we cannot guarantee that Stella will never generate an inaccurate statement, including about you. Correcting stored data does not guarantee output accuracy.
8.3 California. You have the rights to know, delete, correct, opt out of sale and sharing, limit the use and disclosure of sensitive personal information, obtain information about automated decision-making, and not be discriminated against for exercising these rights. We honor Global Privacy Control signals.
8.4 Texas, Virginia, Colorado, Connecticut, and other states. Residents of states with comprehensive privacy laws have rights to access, correct, delete, port, and opt out of targeted advertising, sale, and certain profiling, along with the right to appeal a denied request.
8.5 Washington and Nevada. See our Consumer Health Data Privacy Notice for rights specific to consumer health data, including the right to withdraw consent and to have third parties delete data we disclosed to them.
8.6 Other states. Residents of states without a comprehensive privacy statute receive the rights described in Section 8.1.
8.7 How to exercise your rights. Email hello@letstongo.com, or write to us at the address in Section 13. We respond within 45 days, extendable by an additional 45 days with notice.
8.8 Verification. We will verify your identity proportionate to the sensitivity of the request. We may decline requests we cannot verify.
8.9 Authorized agents. Agents may submit requests with proof of authorization.
8.10 Appeals. If we deny your request, you may appeal by replying to our decision at hello@letstongo.com. If your appeal is denied, you may contact your state attorney general.
8.11 Hotel deployments. Where we act as a service provider, we will forward your request to the relevant hotel and assist it in responding. You may need to direct your request to the hotel.
9. Cookies and tracking technologies
9.1 What we use.
| Type | Purpose |
|---|---|
| Strictly necessary | Session management, security, load balancing |
| Functional | Language and preference settings |
| Analytics | Usage measurement and product improvement |
We do not use advertising, retargeting, or cross-context behavioral advertising technologies on the Service.
9.2 Your choices. Most browsers let you refuse or delete cookies. Some features may not function correctly without them.
9.3 Global Privacy Control. We treat GPC and similar browser signals as a valid opt-out.
9.4 Do Not Track. We do not respond to Do Not Track headers, which lack a common standard.
9.5 Messaging channels. SMS, MMS, RCS, iMessage, and WhatsApp do not use cookies. We collect delivery, read (where available), and interaction metadata. See our Messaging Terms.
10. Children's privacy
10.1 The Service is intended for individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn or have reason to suspect that a user is under 18, we will investigate and, if appropriate, delete the data.
10.2 COPPA. The Service is not directed to children under 13 and we do not knowingly collect their personal information. If we learn that we have, we will delete it promptly. Contact hello@letstongo.com.
10.3 Information about minors provided by adults. Adults may provide information about children traveling with them, such as ages, dietary or accessibility needs, and activity preferences. We process this only to fulfill the request, do not use it to build profiles, and delete it at the end of the stay. Health-adjacent information about a minor is placed in the Stay Vault.
11. AI-specific disclosures
11.1 You are interacting with AI. The Service is built on third-party large language models. Responses are machine-generated. Tongo and hotel personnel may review conversations for quality and safety.
11.2 Personalization. We use your stated and inferred preferences to personalize recommendations during your stay. To ask us to stop personalizing recommendations for you, contact hello@letstongo.com. Stay Vault information is never used for personalization beyond fulfilling your immediate request.
11.3 Automated decision-making. We do not use solely automated processing to make decisions producing legal or similarly significant effects concerning you. Recommendations, ranking, and content selection are automated, but are not decisions of that character, and you remain free to disregard them.
11.4 How recommendations are generated. From your stated preferences, conversation context, property and destination knowledge bases, availability, and commercial arrangements with booking providers and hotels. See Terms of Service Section 6.5.
11.5 Human involvement. You may request human involvement, express your point of view, and contest an outcome by contacting hello@letstongo.com or requesting escalation to hotel staff.
11.6 Training. We do not currently use your conversations to train AI models. See Section 3.4.
11.7 Accuracy. AI outputs may be inaccurate or fabricated. See Terms of Service Section 2.3 and Section 8.2 above.
12. Security
12.1 Controls. We use encryption in transit and at rest; role-based access control and least privilege; multi-factor authentication for administrative access; access logging for conversation review; monitoring; vulnerability management; secure development practices; vendor security due diligence; and employee confidentiality obligations.
12.2 Incident response. We maintain an incident response plan and will notify affected individuals and regulators as required by applicable law.
12.3 Your responsibility. Protect your device and account credentials. Do not submit sensitive information you do not want recorded.
12.4 No guarantee. No method of transmission or storage is completely secure. We cannot guarantee absolute security.
13. How to contact us
Email: hello@letstongo.com
Mail: Tongo Inc., Attn: Privacy, 1401 South Lamar Boulevard, Austin, Texas 78704
You may also contact your state attorney general. California residents may contact the California Privacy Protection Agency. Washington and Nevada residents should see our Consumer Health Data Privacy Notice.
14. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified at least 30 days in advance by email, in-product notice, or message on the relevant Channel. Updates will not diminish your rights with respect to data collected before the update takes effect. A change to how we use data for AI training will not be applied to previously collected data.