Legal

Terms of Service

These terms govern access to the Hostrail platform, including the public site, booking experience, commerce API, MCP endpoint, and documentation.

Platform Use

Public discovery surfaces may be fetched without an execution credential. Protected API and MCP calls require a valid agent credential or OAuth access token issued for the platform.

End users must not be asked to paste platform bearer tokens into chat. Integrators are responsible for storing connector credentials securely.

Booking Execution

Quote output is the current source of truth for price, taxes, fees, and cancellation terms. A hold reserves availability only for its stated TTL window. Booking confirmation may require delegated traveler context and payment authorization.

Booking confirmation and cancellation are consequential actions and require explicit traveler consent before execution.

Integration Responsibilities

Keep agent credentials and OAuth client secrets in secure server-side storage. Do not expose operator credentials in prompts, browser source, or client-side logs. Respect rate limits, idempotency rules, and published error remediation guidance.

Contact

For commercial, operational, or legal questions, contact api-support@hostrail.dev.

Read the Privacy Policy.