Privacy Policy

Account information: When you sign up, we collect your email address and password (hashed). During onboarding you may provide your business name, property details, and timezone.

Property & booking data: Information you enter about your properties, rooms, pricing, availability, and guest bookings — including guest names, email addresses, phone numbers, and stay dates.

Payment information: We use Stripe to process subscription payments. We do not store your full card number. Stripe's privacy policy applies to payment data.

Usage data: Pages visited, features used, and actions taken within the platform, collected to improve the service.

Guest data: When a guest books through your Hovestly booking page, we collect their name, email, phone number, and stay dates on your behalf. You are the data controller for your guests' data.

• To provide, operate, and maintain the Hovestly platform
• To process bookings and send confirmation emails to guests
• To send you transactional emails (account alerts, billing receipts)
• To send you product updates and marketing emails (you can opt out at any time)
• To enforce our Terms of Service and comply with legal obligations
• To improve and develop new features based on usage patterns

We do not sell your personal data. We share information only with:

• Service providers: Supabase (database), Vercel (hosting), Stripe (payments), Resend (email). Each is bound by their own privacy policies and our data processing agreements.
• Law enforcement: If required by law, court order, or to protect the rights and safety of Hovestly or others.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

We retain your account and property data for as long as your account is active. If you cancel your subscription, we retain your data for 90 days to allow reactivation, after which it is deleted. Guest booking records may be retained longer as required by applicable tax and legal regulations.

We use strictly necessary cookies for authentication (session tokens). We do not use third-party advertising cookies. We may use analytics tools (e.g., Vercel Analytics) to understand aggregate usage — this data is anonymised and not linked to individual users.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Object to or restrict processing
• Data portability (receive your data in a machine-readable format)

To exercise these rights, email us at privacy@hovestly.com. We will respond within 30 days.

We use industry-standard measures to protect your data: TLS encryption in transit, AES-256 encryption at rest (Supabase), row-level security policies, and regular security reviews. No system is 100% secure — if you believe your account has been compromised, contact us immediately.

Hovestly is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

Hovestly operates globally. Your data may be processed in countries other than your own (including the United States). We rely on Standard Contractual Clauses and equivalent mechanisms for cross-border data transfers where required.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our platform. Continued use of Hovestly after the effective date constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or how we handle your data, please contact us: