1. Who We Are

HostSuite is a property management platform operated by Hostsphere India Private Limited, a company incorporated in India. Our platform helps vacation rental managers and property operators manage bookings, guests, payments, and operations.

For privacy-related queries, contact us at info@hostizzy.com.

2. Data We Collect

We collect the following categories of information:

Account information — name, email address, phone number, and organisation details provided during registration.
Property data — property names, locations, room types, pricing, and availability calendars.
Guest data — full name, phone, email, ID documents (Aadhaar, passport, driving licence), date of birth, nationality, and emergency contacts collected during the guest check-in process.
Reservation data — booking dates, amounts, payment status, and booking source.
Financial data — invoice details, payment records, GST numbers, and (for property owners) bank account and UPI information for settlements.
Usage data — pages visited, actions taken within the platform, and device/browser information for analytics and debugging.

3. How We Use Your Data

To provide and improve the HostSuite platform and its features.
To generate GST-compliant invoices and financial reports.
To facilitate communication between property managers and their guests.
To process settlement payments to property owners.
To comply with applicable Indian laws and regulations.
To send transactional notifications (booking confirmations, payment receipts, etc.).

We do not sell your personal data to third parties or use it for advertising.

4. Data Sharing

We share data only in the following circumstances:

Within your organisation — data is shared with users you have invited to your HostSuite organisation, according to their assigned roles.
Service providers — we use Supabase (database and authentication), Resend (email), MSG91 (SMS), Meta (WhatsApp Business API), and OpenAI and Anthropic (AI providers that draft replies and answer the team's questions when you use those features) as sub-processors. Each operates under their own data processing agreements.
Legal obligations — we may disclose data if required by law, court order, or regulatory authority in India.

5. KYC Document Handling

Guest identity documents (Aadhaar, passport, driving licence) uploaded to HostSuite are stored securely in encrypted cloud storage. These documents are accessible only to authorised staff within your organisation.

KYC documents are retained for a maximum of 180 days after the guest's checkout date, after which they are permanently deleted from our systems unless you have a legal or regulatory obligation to retain them for longer.

6. The HostSuite Mobile App

The HostSuite app for Android (and, later, iPhone) is for the property team: owners, managers and staff who already have a HostSuite account. Guests do not use it. It works with the same account and the same data as the HostSuite website, and collects the following in addition:

Sign-in — you sign in with your HostSuite account (through Supabase). The app cannot create new accounts; your organisation's admin adds you on the website.
Push notification token — a token from Firebase Cloud Messaging (Google), stored with your account so we can send you notifications about bookings, messages and tasks. When you sign out, the app asks us to remove that phone's token; if the phone is offline, it is removed the next time a notification to it fails.
Crash reports — if the app crashes, Firebase Crashlytics (Google) receives a crash report that describes the error: device model, operating system version and app version, and the error itself. We do not use crash reports for anything but fixing crashes.
Location — only when you tap "My location" in a chat, and only that once. The app never tracks your location in the background.
Camera — only when you take a photo to send in a chat.
Microphone — only while you record a voice note to send in a chat.
Photos and files — only the ones you choose to attach to a chat. They are stored with ImageKit, our file storage provider.
Fingerprint or face unlock — if you turn on app lock, your phone checks it. Your biometric data never leaves your phone and we never receive it.

The app shows no ads, uses no advertising ID, and we do not sell your data. The services that process app data for us are Supabase (database and sign-in), Vercel (hosting), Google Firebase (notifications and crash reports), ImageKit (files), OpenAI and Anthropic (AI providers that draft replies and answer the team's questions when you use those features) and Meta (delivering WhatsApp and Instagram messages you send). We keep app data for as long as your account is active; to delete it, see our data deletion page. For questions about the app, email hostos@hostizzy.com.

7. Data Security

We use industry-standard security measures including encryption at rest and in transit, row-level security policies, and access controls to protect your data. However, no system is completely secure and we cannot guarantee absolute security.

8. Your Rights

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and associated data.
Object to processing of your data in certain circumstances.

To exercise any of these rights, email us at info@hostizzy.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice in the platform. Continued use of HostSuite after such changes constitutes acceptance of the updated policy.

10. Contact Information

Hostsphere India Private Limited
Email: info@hostizzy.com