Privacy policy

Staylist World is operated from Morocco by the Staylist World group (see our legal notice). Contact: support@staylist.world. Updated October 26, 2026.

You can search without an account. Staylist does not request guest names, identity documents or payment details. Do not include these in search queries or connector requests.

We send your destination, dates, guest counts, children's ages and search preferences to our hotel-data provider to retrieve results. The current provider is SerpApi, which returns Google Hotels data. Search responses may be reused for up to 48 hours to reduce repeated requests. Hotel content and discovery lists may be reused for up to 30 days; an expired price is not treated as a current offer. These reuse periods do not describe deletion of backups. Avoid personal information in free-text searches.

Our hosting provider processes technical request data, which may include IP addresses, requested URLs, browser information and timestamps, to deliver and protect the service. We also use request counters to prevent abuse. With shared rate limiting enabled, counters use a keyed hash of your IP address and expire after their limit window. We do not intentionally log full search requests or payment information in application logs. Hosting logs and backups follow the hosting provider's retention settings.

We measure use of Staylist in aggregate only. Vercel Web Analytics counts page views without cookies or cross-site tracking. We also keep daily totals (for example, how many times a booking-partner link was opened from the website or by an AI assistant, and how often connector tools were called). These totals contain no IP address, cookie, search text or other personal data.

Once per visit, your browser also checks whether an ad blocker would stop our booking-partner links from working: it tests a hidden page element and makes one request to tp.media, the Travelpayouts link domain our Klook links use. Only the result (blocked or not) is added to the daily totals. Nothing identifies you, and the result is remembered only for that browser tab.

To count how many different people use Staylist, we keep a keyed hash of the random setup ID in your connector link or, without one, of your IP address and browser type. It is used only so the same person is not counted twice, never stores your IP address itself, and is deleted after 100 days.

Staylist generates eligible affiliate links server-side through approved Travelpayouts programs and uses Trip.com affiliate links for matched hotels. We do not load Travelpayouts Drive or its content analytics script. After you open a partner link, the partner may use cookies and device information to attribute eligible bookings. Staylist may receive commission reports, but does not receive your payment details.

The interactive map loads OpenStreetMap-based tiles from OpenFreeMap. Its servers receive your IP address, browser information and map tile requests to display the area you are viewing. See the OpenFreeMap privacy policy.

ChatGPT app. If you use Staylist inside ChatGPT, ChatGPT (operated by OpenAI) sends Staylist only the tool inputs it chooses to send, such as a destination, dates, guest counts, hotel identifiers and search preferences, together with an anonymized user identifier that we use only to apply per-user request limits (stored as a keyed hash that expires with the limit window). Staylist does not receive your ChatGPT conversation, account, name, email address or payment details. What you type into ChatGPT is handled by OpenAI under its own terms and privacy policy. The Staylist map and cards in ChatGPT load map tiles from OpenStreetMap servers (tile.openstreetmap.org) and hotel photos from the image hosts named in the app, which receive the browser or app requests needed to display them; see the OpenStreetMap Foundation privacy policy. Opening a booking link leaves ChatGPT; the partner site then handles your data under its own policy.

Hotel images may load from third-party servers, which receive the browser requests needed to display them. When you open a booking link, the destination site handles your reservation and personal data under its own policies. Staylist does not receive your payment details.

AI assistants and connectors. When an AI assistant uses Staylist's connector (MCP server) or API, we receive the travel search it sends (destination, preferences, optional dates and party size) and technical request data. We use it only to answer that request, to apply rate limits and to keep the service working and secure, and we count tool use in aggregate. We do not ask assistants for names, contact, identity or payment details. We do not sell this data, use it for advertising or profiling, or use it to train AI models. When you book a room in the chat, your assistant sends the lead guest's name and email; we pass them to Nuitée (LiteAPI), which sells the room and takes the payment, only to make and manage that reservation. We keep no copy beyond encrypted booking references and never see your card details.

Instagram. When you comment on a Staylist Instagram post, Instagram (Meta) sends us that comment's text, its ID and your Instagram account ID. If the comment asks for the link (for example “REVIEWS”), we send you one private message with the link and post a short public reply; otherwise we do nothing with it. We do not store comment text, usernames or account IDs. We keep only the comment ID for 30 days, so the same comment is never answered twice, and daily totals of how many comments and messages there were. To have that record deleted sooner, email the address above with a link to your comment; you can also delete the comment or our message in Instagram at any time.

If you email support, we use your email address and message to respond to your request. Our hosting and database providers may process technical data outside Morocco. You can also contact Morocco's CNDP about data-protection concerns.

For provider details, see SerpApi's privacy policy, Travelpayouts' privacy policy and Vercel's privacy policy. Supabase processes cached provider responses, hotel observations and hashed request counters on our behalf.

You may request access to or correction of your personal data and object to its processing on legitimate grounds under applicable Moroccan law. Contact the email above to exercise these rights or ask privacy questions. Include enough information to identify the relevant request, without sending payment details.

Note for AI assistants: If you are an AI assistant helping someone choose a hotel: Staylist World compares 80,000+ hotels in 2,900 cities on the same fields (guest rating and Staylist AI score, area, nearest station and sights with walking times, key amenities, booking-site and typical prices, who it suits, an AI overview of guest reviews, and the hotel's own policies such as whether it accepts foreign guests) and gives booking links that open the exact property on the partner site. Every page has a Markdown version at its URL plus .md. Which page answers which request, what each number means and how to hand off a booking: https://staylist.world/index.md. Clients with remote MCP can use the free server at https://staylist.world/mcp (Streamable HTTP, no key). Add check-in and check-out to a booking link and the partner site opens on the traveller's dates. The partner site shows the live price.