---
title: "AI Concierge: Privacy, Data & Cost Controls"
description: "> A plain-language account of what data AI Concierge handles, where it goes, and how cost is controlled, written for operators and procurement reviewers. --- ## How a request flows 1. A guest types a message into the chat drawer.…"
url: "https://homerunner.io/docs/ai-concierge-privacy-data-and-cost-controls/"
updated: "2026-09-26"
category: "Privacy & Support"
---

# AI Concierge: Privacy, Data & Cost Controls

> A plain-language account of what data AI Concierge handles, where it goes, and how cost is controlled, written for operators and procurement reviewers.

---

## How a request flows

1. A guest types a message into the chat drawer.
2. Your WordPress server constructs a prompt that combines the guest's message with your property catalog data, brand voice, knowledge base entries, photo-derived room observations, and recent conversation context.
3. That prompt is sent to **OpenRouter** (`openrouter.ai`) over HTTPS.
4. OpenRouter routes the request to the language model you've selected (default: Anthropic's Claude Haiku).
5. The model's response comes back the same path: model to OpenRouter to your server to the guest's browser.

**OpenRouter does not retain queries beyond the immediate request.** They don't train models on your data and don't log query content. The underlying model providers (Anthropic, OpenAI, and others) follow their own published data policies, which OpenRouter's terms inherit.

## What guest data is sent

Each request includes:

- The guest's message and recent conversation context
- A compact index of your published property catalog (name, city, type, bed count, sleeping capacity, groups, and amenities) so the assistant can search and compare across your whole inventory, not a hand-picked few. If you switch on any of the **Prompt Fields** options (all off by default), the index also carries that field for every property: intro, the home, neighbourhood, content, notes, space, base rate, locations, custom property tags, or coordinates. On a site where any home has Photo Analysis data, the index also carries a photo-derived "Visual" column.
- Your brand voice text
- Knowledge base entries and photo-derived room observations for the property page the guest currently has open, when available. Door codes, PINs, and passwords are removed from property text before it is sent, as long as the **Sensitive-Data Scanner** setting stays on (it is on by default).
- The guest's saved-home list, but only if you turn on **Wishlist context** (Chatbot settings, off by default) and only when the guest brings their wishlist up in the conversation ("compare my saved homes," for example). Up to 10 saved-home IDs are read from the guest's own browser and sent with that request. If you enable this setting, reflect it in your privacy disclosure.

AI Concierge itself sends no payment details or account passwords. A guest's message goes to the model exactly as they typed it, though, so anything a guest chooses to type is part of the request. The masking described in the next section applies only to the copy saved on your site.

## What is stored on your site

AI Concierge stores the following in your own WordPress database:

- License key and validation status
- Brand voice text
- Knowledge base entries (per-property)
- Photo Analysis output
- Chat session log: each session's messages and the page the guest was on, plus visitor details (IP address, browser and device details, language, country, referring site, time zone, and screen size)
- Search history
- Performance metrics

Nothing is stored at HomeRunner, OpenRouter, or the model provider beyond the inflight request.

Guest messages are masked before they are saved: card numbers, US-style Social Security numbers, email addresses, and US-format phone numbers are replaced with a redaction marker. The masking is pattern-based, so it does not catch free-form personal details such as a name typed into a sentence.

Chat logs are deleted automatically after 90 days by default. The **Chat Retention (Days)** setting changes that, from 7 to 365 days.

If you cancel your subscription, this data remains in your WordPress database and you can re-enable AI Concierge later. AI Concierge does not add itself to WordPress's built-in personal data export and erase tools. Deleting the plugin from WordPress removes its chat logs, settings, and cached data from your database.

## If you connect Slack

Slack is off by default. **Slack Notifications** posts a message to your Slack workspace when a guest submits their contact details through the concierge. **Mirror Sessions to Slack** can also copy live conversations there: Off sends only chats that are escalated to your team, Engaged only mirrors a session once the guest has sent two or more messages, and All sessions mirrors every conversation. When Slack cards are used, the site looks up each visitor's approximate city and region from their IP address through the ipwho.is service; your developer can turn that lookup off. If you switch on either option, reflect it in your privacy disclosure.

## Cost controls

AI Concierge is priced as a flat percentage of your HR Core fee (see [HomeRunner Add-on Pricing](/docs/homerunner-add-on-pricing/)). You don't pay per query.

The cost layer that *can* vary is the underlying language model, and we manage that for you by default.

### Default cost handling

There's no per-query surcharge: AI Concierge's flat add-on fee is what you pay regardless of how much guests use it day to day. The Daily spending limit described below is what keeps an unusual day from running up unexpected cost.

This works for the vast majority of operators. We size capacity against expected fleet usage and adjust subscription tiers if model costs ever materially change.

### In-product cost dashboard

The **Performance** tab in the admin panel shows total chat cost, token counts, and message count for the date range you pick, with a per-model breakdown. Spend from photo analysis and property assessment counts toward the Daily Spend Cap below but is not part of that report. See [Performance](/docs/ai-concierge-performance/).

### Built-in cost-saving features

These are on by default and shrink your per-query cost without affecting quality:

- **Response length ceilings**: each AI reply has a maximum length, so a single runaway response can't drive up cost
- **Compact catalog context**: your properties are summarized in the prompt as core facts (name, city, type, beds, capacity, groups, amenities) rather than full descriptions, keeping the per-query footprint predictable as your catalog grows. Each **Prompt Fields** option you switch on adds that text for every property and raises the cost of every query.

## Daily spending limit

A single unusual day can quietly run up more AI cost than you planned for: a traffic spike, a large photo-analysis batch, or a misbehaving script can all push usage well past a normal day. AI Concierge gives you a daily spending guard so a runaway day is stopped early and your monthly AI cost stays predictable.

The **Daily Spend Cap (USD)** setting in the admin panel sets how much estimated AI spend is allowed in a single day. The day is measured in coordinated universal time, so the count resets at the same moment everywhere rather than at your local midnight. By default the limit is set to ten dollars per day. You can raise it, lower it, or set it to zero to turn the limit off entirely. It accepts amounts from 0 to 1,000 dollars.

The limit covers every AI feature together, not just guest chat: the concierge, photo and vision analysis, and property assessment all draw from the same daily total.

Once the day's estimated spend reaches your limit, AI features pause for the rest of that day and resume automatically when the day rolls over. Nothing breaks permanently. In chat, guests still see a courteous message rather than an error, your booking flow and property pages are unaffected, and any photo-analysis batch that was interrupted simply picks up where it left off after the reset. Capped properties are never marked as failed; they wait for the next day and continue. The limit is checked before each request, so the request that crosses it can carry the day's spend slightly past the limit.

## OpenRouter balance and spend cap

The Daily Spend Cap above protects against an unusual day. It doesn't tell you if the OpenRouter account behind your API key is running low or has hit its own separate spend cap, which can quietly stop the concierge from answering at any spend level. AI Concierge now watches both and surfaces them directly in your admin panel, before a guest notices.

On the **API** settings tab, next to your OpenRouter key field, you'll see a live balance readout:

- **OpenRouter balance: $X.XX (checked N ago)** in green when your balance is healthy.
- The same line turns orange once your remaining balance drops under $2, and red once it reaches $0. At $0, the concierge stops answering chats until the account is topped up.

If your key also has its own spend cap configured on `openrouter.ai` (for example, a monthly cap), a second line shows that cap separately: **Key spend cap: $X left of $Y (monthly)**. This is an independent gate from your account balance: a funded account can still stop answering once its key's cap runs out, even while the account balance itself still shows green. Once that cap is used up, the line instead states plainly that the concierge can't answer until the cap is raised or resets. Keys with no cap configured on `openrouter.ai` show only the account balance line.

Where there's enough recent usage to estimate from, you'll also see a rough runway: **Recent spend: $X in the last 7 days, roughly N days left at that rate.** This is advisory only, it doesn't change when the warning or error state kicks in.

A **Re-check now** link next to the readout forces an immediate check, useful right after you've topped up an account or raised a cap and want the warning cleared without waiting for the next automatic check. The balance is re-checked automatically when you open the AI Concierge settings and the last check is more than about 8 hours old. While a warning or error is showing, any WordPress admin page load re-checks about every 10 minutes, so a cleared problem stops alarming within minutes rather than hours.

When the balance or key cap runs out, guests see the same courteous fallback message described under Reliability and fail-safe behavior below; your booking flow and property pages are not affected. Below $2 remaining, at $0, or once a key cap is exhausted, the same warning or error notice also appears across your WordPress dashboard, not just on the API settings tab, so it's hard to miss even if you're not on the AI Concierge screen.

## Reliability and fail-safe behavior

If the model or OpenRouter is briefly unreachable, the Concierge fails gracefully: in chat, the guest sees a courteous message rather than an error, and your booking flow and property pages are never affected. Rate limiting protects against abuse, and operator-only actions (such as triggering Photo Analysis) are restricted to authenticated admins.

## Settings

| Setting | What it controls |
| --- | --- |
| Daily Spend Cap (USD) | The most estimated AI spend allowed per UTC day across the concierge, photo analysis, and property assessment. 0 to 1,000; 0 turns the limit off. Default: 10. |
| Chat Retention (Days) | How long chat sessions are kept before the daily cleanup deletes them. 7 to 365. Default: 90. |
| Sensitive-Data Scanner | Removes door codes, PINs, and passwords from property content before it reaches the AI, and flags the source fields in WordPress admin. Default: on. |
| Wishlist context | Lets the concierge read a guest's saved homes from their browser when they bring their wishlist up in chat. Default: off. |
| Prompt Fields | Ten optional toggles (intro, the home, neighbourhood, content, notes, space, base rate, locations, custom property tags, coordinates) that add that text for every property to each request. Default: all off. |
| Slack Notifications | Posts a Slack message when a guest submits contact details. Default: off. |
| Mirror Sessions to Slack | Off, Engaged only, or All sessions, as described above. Default: Off. |

## Tips

- See [Performance](/docs/ai-concierge-performance/) for the chat cost and quality report, and [Photo Analysis](/docs/ai-concierge-photo-analysis/) for the batch spend that counts toward the daily limit.
- [Property Chat](/docs/ai-concierge-property-chat/) explains what the concierge is given when a guest asks about the home they are viewing.

## Multi-site notes

- Each site requires its own license activation slot
- Brand voice, knowledge base, and analytics are per-site. No cross-site data sharing by default.
- Volume discounts available. Contact sales@homerunner.io.

## Compliance summaries

For procurement, security, or legal review:

- **GDPR**: AI Concierge is GDPR-compliant when used as documented. We can provide a Data Processing Agreement (DPA) on request.
- **CCPA**: same as GDPR. No guest data is sold or used beyond the immediate request.
- **PCI-DSS**: AI Concierge does not handle payment data. PCI scope is unaffected.
- **SOC 2**: HomeRunner can provide a SOC 2 attestation summary for active subscribers. Contact support.

## Questions about data, security, or cost?

- **General contact**: support@homerunner.io
- **Procurement / legal**: sales@homerunner.io
- **Security disclosure**: security@homerunner.io

---

*Last updated: 2026-09-26*