Privacy Policy — Hostnest
Version 1.0-hardened-01 — 22/08/2026
Privacy Policy
Last updated: August 22, 2026
This Privacy Policy explains how personal data is processed in connection with the Hostnest platform, related services, and websites operated through it. Hostnest is software designed for hospitality businesses to manage stay requests, quotes, customer selection, availability confirmation, deposits, and bookings. It is not a full property management system, channel manager, OTA, or marketplace.
This Privacy Policy applies to visitors of the Hostnest corporate website, authorized users of hospitality businesses (Properties), and, where relevant, guests interacting with the public customer area generated by the operational workflow. For data processed by a Property as independent controller, data subjects should also consult the privacy notice provided by the relevant hospitality business.
1. Data controller and contact details
For personal data processed in connection with the Hostnest platform, the corporate website, technical support, and contractual relationships with Properties, the data controller is:
Sprint di Linguari Stefano
Largo Piave 11
28066 Galliate (NO)
Italy
VAT ID: 08001990962
PEC: sprint@mypec.eu
Email: info@hostnest.it
For any request relating to this Privacy Policy, the exercise of data subject rights, or security-related reports, you may contact the controller using the details above.
Possible DPO / privacy contact point: SUBJECT TO LEGAL VALIDATION — a Data Protection Officer (DPO) is not currently appointed. Hostnest will assess the obligation or opportunity of appointment in light of processing scale and supervisory authority guidance.
2. Roles in data processing
Depending on the operational flow and category of data subject, privacy roles are allocated as follows:
- Hostnest as controller for data relating to Property accounts, authorized backoffice users, platform configuration, technical and security logs, support communications, and data processed to deliver the service, invoice the management commission, and comply with legal obligations applicable to Hostnest.
- Property as controller for personal data of its guests, customers, and prospects collected and processed through Hostnest in connection with stay requests, quotes, bookings, the Property's contractual terms, and commercial or pre-contractual communications managed directly by the Property. In these cases Hostnest provides technical tools and does not independently determine the purposes and means of guest data processing, except as necessary to operate the service.
- Hostnest as processor on behalf of the Property, limited to processing performed under documented instructions from the Property and necessary to deliver the platform, as further detailed in the Data Processing Agreement (DPA) made available separately to contracting Properties.
- Stripe as independent controller for processing related to onboarding, verification, payment processing, refunds, fraud prevention, and regulatory obligations applicable to the payment service provider. Stripe acts as an independent controller under its own terms and privacy notices; Hostnest does not control Stripe's data processing decisions beyond what is technically required for integration.
When a Property uses Hostnest to process guest data, the Property is responsible for providing data subjects with a privacy notice compliant with its role as controller, including information about the use of Hostnest and involved subprocessors where required.
The table below summarizes main roles by data subject category:
| Data subject | Processing examples | Hostnest role |
|---|---|---|
| Property backoffice user | Account registration, login, property configuration | Controller |
| Guest / end customer | Stay request, quote selection, deposit payment | Processor (on Property's behalf) and/or limited independent controller for security logs |
| Marketing site visitor | Browsing institutional pages, language preference | Controller |
| Support contact | Support ticket, email to info@hostnest.it | Controller |
3. Sources of data
Personal data may come from:
- the data subject directly (account registration, form completion, messages, payment through Stripe Checkout);
- the Property or its authorized users (guest data entry, quote creation, operational notes);
- the system automatically (technical logs, timestamps, session identifiers, webhook events);
- Stripe, limited to technical payment identifiers and transaction status synchronized via webhooks;
- third parties only where explicitly enabled in future and informed in compliant manner (not active in V1).
4. Categories of data processed
Data categories depend on the data subject's role and features used. Based on the currently available product, they may include:
- Identity and contact data: name, surname, email address, phone number, company name where applicable, postal address, and billing details of the Property and authorized representatives.
- Account and authentication data: login credentials (passwords stored in hashed form), roles and permissions, language preferences, login sessions, technical authentication tokens, and strictly necessary cookies.
- Property operational data: trading name, address, room or unit configuration, public content, booking conditions, deposit settings, internal activity history, and operational notes not intended for public display.
- Request, quote, and booking data: stay dates, guest count, requested accommodation type, messages and content in conversations, commercial proposals, customer selection, availability status, deposit and balance amounts, and references to bookings and payments.
- Payment and transaction data: amounts, currency, payment status, technical checkout session identifiers, payment intents, linked Stripe account, Hostnest management commission, and transaction metadata. Hostnest does not store full card numbers: card entry takes place on Stripe-hosted checkout pages.
- Technical and security data: IP address, user agent, timestamps, access logs, webhook events, application error records, audit trails on quotes and bookings, and data necessary to prevent abuse and secure the platform.
- Communications: content of transactional emails sent by the system (for example quote notifications, payment requests, deposit receipts, or booking confirmations), and support requests sent to Hostnest.
- Legal acceptance data: accepted legal document version, timestamp, IP address, and technical metadata associated with acceptance of Terms, Privacy, Booking or Payment Conditions where required by the workflow.
The current product version does not include marketing analytics or third-party advertising profiling tools on the operational platform.
Special categories (Article 9 GDPR): Hostnest is not designed for systematic collection of sensitive data. If a data subject voluntarily enters such information in free-text messages, the Property and Hostnest (as processor) must process it only with adequate legal basis and supplementary measures — SUBJECT TO LEGAL VALIDATION case by case.
5. Purposes of processing
Personal data may be processed for the following purposes, depending on the role described above:
- Registration, authentication, and management of Property accounts and authorized collaborators.
- Delivery of Hostnest features: stay request management, multi-proposal quotes, public customer area, manual availability confirmation by the Property, booking creation, and deposit requests.
- Multi-property management (multi-Property), where contractually enabled, with logical segregation of data between businesses linked to the same account or group.
- Stripe Connect integration for linked account onboarding, payment enablement, deposit processing through hosted checkout, and payment status synchronization via webhooks.
- Sending transactional and service communications required for the operational workflow.
- Recording and proof of legal acceptances required in public flows (registration, booking, checkout).
- Technical support, incident handling, maintenance, improvement, and security of the platform.
- Compliance with legal, tax, accounting, and rights-protection obligations.
- Calculation, recording, and reporting of the Hostnest management commission on payments processed through the platform, where applicable.
Purposes not active today, possible in future (where activated and subject to notice/consent where required):
- Direct marketing or Hostnest newsletters toward Properties or backoffice users;
- Browsing analytics or behavioral measurement tools (Google Analytics, Matomo, or similar);
- Advertising profiling, retargeting, social pixels;
- Artificial intelligence features for automatic text generation, pricing, or guest responses.
Hostnest does not currently use the purposes listed above. If introduced, they will be described in an updated Privacy Policy and, where necessary, prior consent will be collected through a dedicated mechanism (consent gate / CMP).
6. Legal bases for processing
Legal bases for processing may include, depending on the specific case and applicable privacy role:
- Performance of a contract (Article 6(1)(b) GDPR) or steps prior to entering into a contract at the data subject's request, for delivering the Hostnest service and managing bookings and payments agreed between Property and guest.
- Compliance with a legal obligation (Article 6(1)(c) GDPR) to which the controller is subject, including tax, accounting, anti-money laundering where applicable, and statutory retention requirements.
- Legitimate interests (Article 6(1)(f) GDPR) of the controller or third parties, such as information security, fraud and abuse prevention, legal defense, technical service improvement, and ordinary customer relationship management — SUBJECT TO LEGAL VALIDATION of balancing against data subjects' fundamental rights and freedoms, especially for security logs and operational audit.
- Consent (Article 6(1)(a) GDPR), where required by applicable law, for example for specific communications not strictly necessary to perform the contract, future non-essential cookies, or optional processing.
As controller for guest data, each Property must independently identify and document the legal bases applicable to processing it determines, including any contractual or pre-contractual basis for managing stay requests.
Indicative purpose / legal basis matrix (Hostnest as controller) — SUBJECT TO LEGAL VALIDATION:
| Purpose | Proposed legal basis |
|---|---|
| Property account creation and management | Contract |
| Security logs and abuse prevention | Legitimate interest |
| System transactional emails | Contract / legitimate interest |
| Hostnest commission invoicing | Contract / legal obligation |
| Legal acceptance recording | Contract / legal obligation / legitimate interest |
| Technical cookies and language preference | Legitimate interest / technical necessity — TO BE VALIDATED |
7. Recipients and subprocessors
Data may be disclosed, strictly as necessary, to:
- Stripe, Inc. and affiliates, as payment service provider and independent controller, for Connect onboarding, payment processing, refunds, and payment service compliance.
- Hosting and infrastructure provider, for application hosting, databases, backups, and related services necessary to operate the platform.
- Transactional email provider, for delivery of service emails generated by the system.
The current product version does not use subprocessors for marketing analytics, retargeting, or advertising profiling. An updated list of technical subprocessors may be made available to contracting Properties and updated when relevant changes occur, subject to contractual and regulatory obligations.
Professional advisers, competent authorities, and parties acting under legal obligation or authority order may also access data within permitted limits.
Indicative technical subprocessor list (V1):
| Subprocessor | Purpose | Location / transfers |
|---|---|---|
| Stripe, Inc. | Payments, Connect onboarding, antifraud | EU/EEA and possible extra-EEA transfers — see Stripe policy |
| Hosting provider | App hosting, DB, backups | TO BE SPECIFIED AT CONTRACT STAGE |
| Transactional email provider | Service email delivery | TO BE SPECIFIED AT CONTRACT STAGE |
8. Transfers to third countries
Some providers, including Stripe and hosting or email providers, may process data outside the European Economic Area. In such cases transfers may rely on adequacy decisions, Standard Contractual Clauses approved by the European Commission, or other instruments provided under GDPR Chapter V, as reflected in agreements with those providers.
Hostnest selects providers offering adequate safeguards for international transfers. Upon reasonable Property request, Hostnest may provide summary information on main mechanisms applied without disclosing trade secrets or information that would compromise security.
9. Retention periods
TECHNICAL PROPOSAL SUBJECT TO LEGAL VALIDATION. The retention periods below are an operational proposal and must be confirmed by legal counsel in light of civil, tax, and sector-specific obligations applicable to each controller.
| Data category | Proposed period | Notes |
|---|---|---|
| Active Property accounts | Duration of contractual relationship | Until account deletion, subject to further obligations |
| Requests, quotes, bookings, payments | Relationship duration + up to 10 years | Indicative post-termination proposal; Property controller may apply different periods |
| Technical and security logs | Up to 12 months | Extendable for incident investigation |
| Support communications | Up to 24 months | From ticket closure |
| Legal acceptances (ConsentAcceptance) | Relationship duration + evidential period | SUBJECT TO LEGAL VALIDATION — proposal up to 10 years |
| Hostnest accounting and tax records | As required by law | Generally up to 10 years |
| Backups | According to technical cycles | See Backup section; progressive overwrite deletion |
After applicable periods expire, data will be deleted, anonymized, or rendered inaccessible, except where further retention is required for legal defense or compliance.
10. Backup and continuity
Hostnest performs periodic backups of databases and application configuration to ensure operational continuity and recovery in case of incident. Backups may contain personal data processed on behalf of Properties and are protected with security measures consistent with the production environment.
Backups are retained for a limited technical period and rotated according to internal policy — exact period TO BE VALIDATED in relation to operational RTO/RPO and deletion obligations. Definitive deletion of data in the active system may require an additional backup overwrite cycle.
Upon relationship termination, the Property may request data export under the DPA before definitive deletion.
11. Security
Hostnest implements appropriate technical and organizational measures to protect personal data, including indicatively:
- authentication and role-based access control in the backoffice;
- logical isolation between Properties (tenant isolation);
- password hashing and HTTPS communications;
- Stripe hosted checkout for payments without storing full card data;
- webhook signature verification and anti-tampering controls on payment flows;
- audit logging of relevant quote and booking activities;
- periodic backups and tested recovery procedures;
- error monitoring and security incident handling.
No security measure can guarantee absolute protection; users should safeguard credentials, use strong passwords, and promptly report unauthorized access to info@hostnest.it.
If a personal data breach affects data processed on behalf of a Property, Hostnest will notify the Property without undue delay under the DPA so it can meet authority and data subject obligations.
12. Automated decision-making and profiling
Hostnest does not currently make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the data subject under Article 22 GDPR.
If Hostnest introduces relevant automated logic in future (for example guest scoring or dynamic pricing based on profiles), such processing will be described in an updated Privacy Policy with logic, significance, and consequences, and activated only where permitted by law.
13. Minors
Hostnest is not intended for independent registration by persons under 18 for Property accounts. Backoffice users must have legal capacity and Property authorization.
Minor guest data may be processed in the booking flow if entered by an adult (parent, guardian, or companion) or by the Property. The Property is responsible for verifying legal requirements, parental consent, and specific notices where applicable — SUBJECT TO LEGAL VALIDATION in relation to consumer law and rules on minors.
Hostnest does not knowingly collect data directly from minors without involvement of a responsible adult in the current product workflow.
14. Data subject rights
Under Regulation (EU) 2016/679 (GDPR) and applicable national law, data subjects may exercise, where applicable, the following rights:
- Access — obtain confirmation of processing and a copy of data;
- Rectification — correct inaccurate or incomplete data;
- Erasure — request deletion in cases provided by law;
- Restriction — restrict processing in cases provided by law;
- Portability — receive data in structured format, where applicable;
- Objection — object to processing based on legitimate interest, unless overriding legitimate grounds apply;
- Withdrawal of consent — where processing is consent-based, without affecting prior lawful processing.
For data processed by Hostnest as controller, requests may be sent to info@hostnest.it or PEC sprint@mypec.eu, indicating the data subject's identity and right exercised. Hostnest responds within legal time limits (generally one month, extendable).
For data processed by a Property as controller, data subjects should contact the relevant hospitality business directly; Hostnest, as processor, will assist the Property within DPA limits.
Data subjects may lodge a complaint with the Italian Data Protection Authority (Garante) (www.garanteprivacy.it) or the supervisory authority of the Member State where they habitually reside or work.
15. Cookies and similar technologies
Use of cookies and similar technologies on Hostnest sites is described in the separate Cookie Policy. In summary, the current product version uses only necessary technical cookies; third-party analytics or marketing cookies are not active.
16. Changes to this Privacy Policy
This Privacy Policy may be updated to reflect product changes, regulatory developments, or guidance from supervisory authorities. The updated version will be published on the website with the date of last update and, where managed by the system, version identifier.
Where substantial changes affect ongoing processing, information measures required by law will be adopted (website notice, email to registered accounts where appropriate). For consent-based processing, new consent will be requested where necessary.
Contracting Properties will be informed of relevant updates affecting processing performed on their behalf so they can update their guest notices.