Privacy policy.

Account: your name, email address, and a hashed password. If you sign in with Google we receive your name and email from Google, never your password.

Listings: when you connect, we import your listing titles, descriptions, amenities, property details, address, currency, and photos, plus your calendar availability and nightly prices, and your guest reviews.

Pricing: the settings you choose (floor, base, ceiling, strategy), the prices we calculate and write, and a daily performance snapshot so we can show you whether the service is working.

WhatsApp, if you connect it: the phone number you verify and the messages exchanged with the assistant, kept so the conversation has memory and so you have a record of changes made by chat.

To price your listings, which is the service you signed up for. Listing content and reviews drive the audit and the comparisons; calendar data tells us how your demand is running; account data identifies you. We do not build advertising profiles.

We use a small number of processors, each for one job:

Supabase stores the database and handles sign-in. Vercel hosts and serves the application. Hospitable is the connection to your channel and the route our price updates travel. AirROI supplies anonymous market data about comparable listings near you. OpenRouter processes listing text for the audit and runs the WhatsApp assistant. Meta delivers WhatsApp messages if you enable that. Lemon Squeezy handles payment if you subscribe, and we never see your card details.

Guest personal data is minimised. We store the reviewer name shown publicly on the review and nothing else about your guests. We do not import guest contact details, and we never message your guests.

Every row in our database belongs to one customer and access is enforced at the database level, not only in application code, so one host cannot read another host's listings, prices or messages.

For as long as your account exists. When you delete your account we remove your listings, pricing settings, history and messages. Anonymous market data about comparable properties is not personal to you and may be retained in cache.

You can disconnect a channel at any time from Settings, which stops all reading and writing immediately. You can ask for a copy of your data or ask us to delete it by emailing us, and we will action it.

Connections travel over encrypted links, access tokens are held server side and never exposed to your browser, and incoming webhooks are cryptographically verified before we act on them.

For any privacy question or request, email hello@hostomat.io and we will respond.