Privacy Policy

Hostivate ("we", "our", "us") is a property management software service for Airbnb hosts, operated by Merakomedia (India). Our registered contact email is privacy@hostivate.com.

• Account data: name, email address, phone number, and hashed password when you sign up.
• Property data: property names, addresses, descriptions, and settings you enter.
• Booking data: check-in and check-out dates, guest names, guest email and phone, booking source, and booking status.
• Guest data: names, email addresses, and phone numbers of guests associated with your bookings.
• Payment data: Stripe handles all payment card processing. We store only your Stripe customer ID and subscription status — never raw card numbers.
• Usage data: pages visited, features used, and error logs (for debugging and product improvement).
• Airbnb data: listing details and booking data received via the Airbnb API on your behalf (see Section 4).

• Provide property management features: calendar, bookings, automations, guest messaging, cleaner coordination.
• Send transactional emails (booking confirmations, automation results, billing receipts) via Resend.
• Process payments and manage your subscription via Stripe.
• Improve the product through aggregated, anonymised analytics.
• Comply with legal obligations.

We do not sell your data, use it for advertising, or share it with third parties beyond what is necessary to operate the service.

When you connect your Airbnb account, we receive listing information and booking data from Airbnb via their official API. This data is used solely to provide host management services within Hostivate. We do not sell, share, or use Airbnb data for advertising or any purpose unrelated to the service you requested. Airbnb data is stored in our database and is subject to the same deletion policy as all other account data (see Section 7).

We share data only with the following sub-processors, each bound by data processing agreements:

• Railway — hosting and PostgreSQL database (servers in the US).
• Stripe — payment processing.
• Resend — transactional email delivery.
• Airbnb — listing and booking data source (your connected account).

We protect your data with industry-standard measures including: HTTPS/TLS encryption in transit; bcrypt-hashed passwords; HTTP security headers (HSTS, CSP, X-Content-Type-Options); rate limiting on sensitive endpoints; and access controls limiting who on our team can access production data. No system is perfectly secure — if you suspect a breach, please email privacy@hostivate.com immediately.

We retain your data for as long as your account is active. When you delete your account:

• All personal data, properties, bookings, and Airbnb data are permanently deleted within 30 days.
• Anonymised aggregate statistics (e.g. total booking counts) may be retained for internal analytics.
• You can request account deletion at any time from Settings → Danger zone, or by emailing us.

Depending on your jurisdiction, you have the right to:

• Access — request a copy of the data we hold about you.
• Correction — update inaccurate data (most data can be edited directly in Settings).
• Deletion — request deletion of your account and all associated data.
• Portability — receive your data in a machine-readable format.
• Objection — object to certain processing activities.

To exercise any right, email privacy@hostivate.com. We will respond within 30 days.

We use a single session cookie (HttpOnly, Secure) for authentication. We do not use advertising or tracking cookies.

This policy is governed by the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (India). Where applicable, we also comply with the GDPR (EU/UK) and the California Consumer Privacy Act (CCPA).

We may update this policy from time to time. We will notify you by email or in-app notice at least 14 days before material changes take effect.

Questions or concerns? Email us at privacy@hostivate.com.