Skip to main content
Legal Centre

Acceptable Use Policy

Version 2026-09-19 · effective 19 September 2026

Summary

This summary helps you find your way around. It is not part of the policy and does not replace the full text below.

  • This policy applies to everyone who uses Stayantra: hotels and their staff, guests, and developers and AI assistants using our APIs and agent interfaces.
  • Be honest: no fake listings, misleading prices or photos, fake reviews, or deceptive AI content.
  • Respect people: no discrimination, harassment, or use of someone's data without a lawful basis.
  • Message people only with their consent, and follow WhatsApp, email and SMS rules.
  • Do not attack, scrape, reverse engineer or overload the platform, and do not try to get around our limits or AI guardrails.
  • If you find a security issue, report it through our security policy instead of testing it yourself.
  • If you break these rules, we may warn you, remove content, or suspend or close an account. We tell you why, and you can appeal through our complaints process.

1. Who this policy applies to

1.1 This Acceptable Use Policy (the Policy) applies to everyone who uses any Stayantra service (the Services), including the Stayantra hotel system and Stayantra Connect, the Stayantra marketplace at marketplace.stayantra.com, the Stayantra Go app, per-hotel websites built on Stayantra, our AI assistant Exubee, our websites and documentation, and our public APIs and AI agent interfaces (including MCP, A2A and UCP endpoints).

1.2 It applies to hotels and their owners, managers and staff, to guests and other visitors, and to developers and to AI assistants or agents acting for someone (together, you). If you let an AI assistant act for you, you are responsible for what it does on the Services.

1.3 The Policy forms part of the terms you agreed with us, including the Hotel Subscription and Partner Agreement for hotels. The Stayantra company you deal with is [Pending: Nepal Stayantra company legal name] if you are a hotel in Nepal or a user whose habitual residence is Nepal, and [Pending: UK company legal name] for everyone else.

2. Illegal and harmful content and conduct

You must not use the Services to:

  1. break any law, or help anyone else to do so;
  2. list or offer accommodation or services that are illegal, unlicensed where a licence is required, unsafe, or that you have no right to offer;
  3. offer or arrange any illegal activity, including human trafficking, sexual exploitation, or the sale of illegal goods;
  4. publish content that is unlawful, defamatory, obscene, threatening, or that incites violence or hatred;
  5. infringe anyone's intellectual property, privacy or other rights, including by using photos you do not have permission to use;
  6. deal with any person, organisation or country in breach of sanctions imposed by the United Nations, the United Kingdom, the European Union or the United States; or
  7. launder money, commit fraud, or make or receive payments for anything other than a genuine booking or service.

3. Honesty and fair dealing

3.1 Listings and prices. Hotels must not misrepresent their property, rooms, facilities, location, star class, licences, or policies. Photos must show the real property as it is. Prices must include every mandatory tax, charge and fee, so the total is shown before a guest pays. Hotels must not add hidden charges or change the terms of a confirmed booking.

3.2 Impersonation. You must not pretend to be another person, hotel, business or Stayantra, or misrepresent your connection to them.

3.3 Reviews. Reviews must reflect a real stay by the person writing them. You must not:

  • write, buy, sell or arrange fake reviews, including reviews of your own hotel or of a competitor;
  • offer money, discounts, points or anything else in exchange for a review, or on condition that a review is positive;
  • pressure or threaten a guest about a review; or
  • suppress, hide or misrepresent genuine reviews, including negative ones. A hotel may ask us to remove a review only if it breaks our review guidelines, and we decide.

3.4 Rewards and referrals. You must not manipulate Stayantra Rewards or referral programmes, including by self-referral, fake accounts, fake bookings, or staff earning points at their own hotel.

3.5 Payments. You must not misuse any payment route, including by asking a guest to pay outside the route they chose in order to avoid a refund, or by confirming a direct payment you have not received.

4. Respect for people

You must not:

  1. discriminate against anyone on grounds the law protects, such as race, caste, ethnicity, national origin, religion, sex, gender identity, sexual orientation, disability, age or marital status, including in accepting or refusing bookings or setting prices;
  2. harass, threaten, abuse, stalk or intimidate any guest, staff member, hotel or Stayantra staff;
  3. use the Services to spy on people or to collect information about them beyond what is lawful and needed for their stay or their work; or
  4. share someone's private information without their consent or another lawful basis.

5. Messaging and marketing

5.1 Consent first. You may send marketing or promotional messages by email, SMS, WhatsApp or any other channel only to people who have given the consent the law requires, and you must honour every opt-out promptly. Service messages about a booking must be genuinely about that booking.

5.2 WhatsApp. Hotels must send WhatsApp messages only to guests who have opted in, only through their own WhatsApp Business account, and in line with the WhatsApp Business policies and Meta's terms. Guest WhatsApp templates are off by default, and turning them on is the hotel's responsibility.

5.3 Email and SMS. You must follow the email and SMS rules that apply to you, such as the UK Privacy and Electronic Communications Regulations, the EU ePrivacy rules and the US CAN-SPAM Act. Include accurate sender information and a working way to unsubscribe.

5.4 No spam. You must not send unsolicited bulk messages, chain messages, or messages with misleading subject lines or sender details, and you must not use the Services to collect contact details for spam.

6. Personal data

6.1 You may upload, import or enter personal data only where you have a lawful basis for it and have given the people concerned the notice the law requires. Do not upload data you are not entitled to use, such as a contact list bought from a third party without consent.

6.2 Identity documents. Hotels may collect guests' identity documents only as the law requires or allows for check-in and guest registration. You must not use ID documents or the data read from them for any other purpose, such as marketing, profiling or sharing with third parties other than authorities that the law requires you to report to.

6.3 Guest web profiling. Hotels that use the guest web profiling feature must use it only to personalise a guest's stay, must have a lawful basis, must tell guests about it, and must stop for any guest who objects.

6.4 Sensitive data. Record information about health, accessibility, religion or other sensitive matters only with the person's explicit consent or another basis the law allows, and only where it is needed to serve them.

7. AI features

You must not:

  1. use Exubee or any AI feature to create deceptive content, including fake reviews, fake guest messages, misleading photos of a property, or content presented as written by a named person when it was not;
  2. create deepfakes or any realistic image, audio or video of a real person without their consent, or sexual or abusive content of any kind;
  3. try to manipulate our AI through prompt injection, jailbreaks or hidden instructions, for example in documents, messages, reviews, listing text or web pages, to make it ignore its rules, reveal other people's data or system instructions, or take actions it should not;
  4. try to get around AI guardrails, Co-Pilot approval, graduation rules, spending caps, or the kill switch;
  5. use AI outputs as the only basis for a decision that has legal or similarly significant effects on a person, such as refusing a booking, setting a price for a person based on their personal characteristics, or employment decisions about staff, without meaningful human review, or to make any decision that is unlawful or discriminatory;
  6. hide from guests that they are talking to AI, or stop them from reaching a person when they ask;
  7. publish images, video or other media that were generated or edited with AI, including with Stayantra's tools, without any label the law or the platform you publish on requires (for example Meta's "AI info" label). The caption line Stayantra adds when you publish its AI images to Facebook or Instagram through Stayantra does not replace these labels; or
  8. use the Services to build or train a competing AI model, or extract our prompts, model configuration or other parts of Exubee.

8. Security and platform integrity

You must not:

  1. access or try to access any account, data or system you are not authorised to use, including another hotel's data;
  2. probe, scan or test the security of the Services without our written permission. If you believe you have found a vulnerability, report it under our security policy and do not exploit it;
  3. introduce malware, viruses, or any harmful code;
  4. use the Services or our infrastructure for cryptocurrency mining or any unrelated computing;
  5. interfere with or overload the Services, including by denial-of-service attacks or excessive automated requests;
  6. get around rate limits, access controls, usage caps or technical restrictions, for example by rotating keys, accounts or IP addresses;
  7. scrape, crawl or harvest data from the Services by automated means, except through our documented APIs and agent interfaces within their limits, or as allowed for search engines by our robots.txt file;
  8. copy, modify, decompile, disassemble or reverse engineer any part of the Services, except to the extent the law allows despite this restriction; or
  9. create accounts by automated means or under false information, or share, sell or rent accounts.

9. Rules for developers, APIs and AI agents

If you use our public APIs or AI agent interfaces, or build an assistant that uses them, you must also follow these rules:

  1. Authentication. Use only the authentication methods we document, including the API keys or OAuth connections we issue. Keep credentials secret and do not put them in public code or client-side apps.
  2. No sharing of credentials. A key or connection is for the person, hotel or application it was issued to. Do not share, sell or transfer it. Tell us at info@stayantra.com at once if a key may be compromised; we may revoke it.
  3. Rate limits. Stay within the rate limits and quotas we set or publish. Do not try to exceed them by using several keys or accounts.
  4. Act only with authority. An AI agent may search and book only for a person who has asked it to, and hotel staff tools may act only within the permissions of the staff member who connected them.
  5. Show the full picture before booking. Before completing a booking for a guest, show the guest the hotel's name, the total price including taxes and fees, and the cancellation policy, and get the guest's confirmation.
  6. Attribution and accuracy. When you display hotel information, prices or availability from Stayantra, say that it comes from Stayantra and the hotel, keep any "Sponsored" label, and do not change the information in a misleading way.
  7. Caching. Do not store prices or availability for longer than our documentation or response headers allow. Always check live price and availability before booking. Do not build a copy of our catalogue or database.
  8. Personal data. Use guest data you receive through our interfaces only to complete the guest's request, protect it, and delete it when you no longer need it.
  9. Disclose that you are AI. An AI agent must not pretend to be a person when dealing with hotels or guests through the Services.

We may change our APIs and agent interfaces, and we may limit or revoke access that breaks these rules or puts the Services at risk.

10. Enforcement

10.1 What we may do. If we reasonably believe you have broken this Policy, we may do one or more of these, proportionate to the seriousness of the breach:

  • warn you;
  • remove or restrict access to content, including a listing, review, message or post;
  • limit features, for example demote AI to Co-Pilot, pause messaging, or reduce API limits;
  • suspend your account, listing or API access; or
  • close your account or end your contract with us.

We may also report illegal activity to the police or other authorities, and cooperate with them as the law requires.

10.2 Statement of reasons. When we remove content or restrict, suspend or close an account, we will tell you, at the latest when the action takes effect, what we did, which rule or law it is based on, the facts we relied on, whether automated tools were used, and how to challenge the decision. We may not give reasons where the law prevents it or where doing so would put someone at risk.

10.3 Hotels. For hotels, restrictions and removals of a listing also follow the notice periods in the Hotel Subscription and Partner Agreement.

10.4 Appeals. You can challenge any decision through our complaints process. It is free. We acknowledge every complaint and give it a reference number within 1 business day (and never later than 48 hours), a person reviews it, and we send you a written, reasoned decision within 15 days. If we got it wrong, we will reverse the decision without undue delay. You also keep any right you have to go to a court, a regulator or an out-of-court dispute settlement body.

10.5 Repeat misuse. We may suspend, for a reasonable period and after a warning, people who repeatedly post clearly illegal content or repeatedly make clearly unfounded reports or complaints.

11. Reporting violations

11.1 If you see content or conduct on the Services that you believe is illegal or breaks this Policy, report it by email to info@stayantra.com. To help us act quickly, include:

  • where the content is (for example, the link or hotel name);
  • why you believe it is illegal or breaks this Policy;
  • your name and email, unless you are reporting certain serious offences, such as child sexual abuse, where you may report anonymously; and
  • a statement that you believe in good faith that your report is accurate and complete.

11.2 We will confirm receipt, review the report diligently and objectively, and tell you what we decided and how you can challenge that decision.

11.3 Report security vulnerabilities to info@stayantra.com, following our security policy. Report privacy concerns to info@stayantra.com.

11.4 If someone is in immediate danger, contact the local emergency services first.

12. Changes to this Policy

We may update this Policy. We will publish the new version with its effective date, and give hotels at least 30 days' notice of material changes except where the law or a security risk requires a faster change. The version in force when you acted is the one that applies to what you did.

13. Contact

Questions about this Policy: email info@stayantra.com. General help: email info@stayantra.com.