Privacy Policy
Last updated ·
This policy explains what data we collect when you use Hostly, why, who we share it with, how long we keep it and what your rights are. It follows the Personal Data Protection Law of the Kingdom of Saudi Arabia and the E-Commerce Law.
1. Who we are and how to reach us
Hostly is a platform for managing short-stay rental units, for hosts in the Kingdom of Saudi Arabia. It is operated by the entity below, which is responsible for your personal data under this policy.
- Registered name
- SAS Expansion Est.
- Registered trademark
- Hostly H · TM-01-00-42730-26 · class 42
- hello@hostly.io
- Message us
- Support hours
- Sunday to Thursday, 9:00 to 18:00, Riyadh time
For any question or request about your data, write to hello@hostly.io or message us on WhatsApp. The same address is our data-protection contact.
2. Scope and roles
This policy covers the website hostly.io, the Hostly app at app.hostly.io, the team app, and your conversations with us.
We process data about three groups of people, and our role differs for each:
- Hosts (our customers): your account and subscription data. Here we are the controller; we decide why and how your data is processed.
- Guests: the names, mobile numbers, conversations and bookings that arrive from your channels or that you enter yourself. Here the host is the controller and we are the processor; we process them on the host's behalf and instructions, through the platform's features. A guest has no account with us, so their requests go to their host, and we help the host fulfil them.
- Team members: the cleaners and technicians a host adds. The host is the controller and we are the processor here too.
If you subscribe to the customer-support service, our team replies to your guests' messages on your behalf, in your name and under your instructions; you remain the controller of your guests' data.
3. The data we collect
We collect only what the platform needs to run. This is what we actually collect, by group.
Your account as a host:
- Name, mobile number, email and password (held by our authentication provider as an irreversible hash; we never see it).
- Your signup answers: the kind and number of units you run, the channels you take bookings from, and the invite code you used.
- Your plan and renewal date, and the billing details you enter for your invoice: legal name, VAT number, billing email and address.
- Your interface language, and the devices on which you turned phone notifications on (the push-service subscription address and the browser name).
- Your conversations with us on WhatsApp or email when you ask for support.
- Usage data: the pages you open and specific in-product events, session recordings with every text node and input field masked, and error reports that carry only your account id.
Channel and device connections:
- Airbnb and Booking.com: you authorise the connection on the platform's own page, through an authorised channel manager; we never receive your passwords.
- Gathern: the connection details you authorise us with to reach your account on the channel, stored encrypted; we never store your password.
- Smart locks: your account identifier with the lock provider and encrypted session tokens; the password is used once to sign in and is never stored. Door codes are created on your own account with the lock provider.
Guest data (processed on your behalf):
- Name, mobile number, email and country, stay dates and number of guests, amounts and payment status.
- Your full conversation with the guest (messages and attachments) as it arrives from Airbnb, Booking.com and Gathern, and the messages you send through Hostly.
- Your private notes about the guest, your classification and rating, guest-wallet entries, and the door codes issued for their stay.
Team members:
- Username, display name, mobile number, language, skills and assigned units.
- Job notes and their translations, and job photos (taken with the camera only).
Automatically:
- Your IP address and technical identifiers, to limit repeated attempts.
- Technical server logs, and the cookies described in section 10.
What we do not collect: we never collect anyone's national ID, residence permit or passport number, and we never hold bank-card numbers; once payments launch, the licensed payment provider holds them and they never pass through our servers.
4. Why we process it and the legal basis
We process data for the following purposes, each with its legal basis under the Personal Data Protection Law:
| Purpose | Legal basis |
|---|---|
| Providing the service: the calendar, sync, bookings, messages, reports, tasks and door codes | Performing our contract with you |
| Creating and securing your account and contacting you about the service | Performing the contract |
| Issuing invoices and keeping financial records | A legal obligation (tax and commerce laws) |
| Protecting the platform from abuse, limiting repeated attempts, tracking errors | Legitimate interest |
| Improving the product through usage analytics that carry no text | Legitimate interest |
| Phone notifications, and the optional channel and lock connections | Your consent, withdrawn from Settings |
| Processing guest and team-member data | The host's instructions as controller |
We do not trade in your data, do not use it for marketing on behalf of others, and make no automated decisions about guests; automatic pricing rules act on your own prices as you configure them.
The host is responsible for informing their guests and team members that their data is processed through Hostly, and for having obtained it lawfully.
5. Who receives the data
We disclose data, to the minimum necessary, to the categories of service providers the platform needs to run, including:
- Cloud hosting and database providers.
- Providers of connections to booking channels.
- The channels and lock providers you connect: your own accounts with them, under their own policies.
- Messaging and notification service providers.
- A machine-translation service for task notes, never guest conversations.
- Measurement and technical error-tracking tools.
- The payment provider licensed by the Saudi Central Bank, once payments launch.
We may also disclose data to the competent government authorities when the law requires it.
6. Transfers outside the Kingdom
Some data may be processed or stored with providers outside the Kingdom of Saudi Arabia, to the minimum necessary and under appropriate protection safeguards consistent with the Personal Data Protection Law and its regulations.
This includes the guest data we process on your behalf, and we update this policy on any material change to it.
7. Retention and deletion
We keep data for as long as your account exists, and then:
| Data | Period |
|---|---|
| Account, booking and conversation data, and job photos | 90 days after the account is closed (photos: 90 days after the job is finished), then deleted or anonymised |
| Invoices and financial records | The period the law requires |
| Technical logs and measurement data | Short periods, never more than 12 months |
To close your account, write to hello@hostly.io or message us on WhatsApp from the account settings; we carry out the request within 30 days.
8. How we protect it
- Encrypted connections end to end (TLS with HSTS), and encryption of stored data by the database provider.
- Access tokens for your channel and lock-vendor accounts are stored encrypted, and their passwords are never stored with us.
- The database accepts no connection from a browser; every read and write passes through our servers after your identity and ownership of the data are checked.
- Limits on repeated attempts at signup, verification codes and lock connections.
- Analytics that carry no text, and error reports that carry no personal data.
- Only a small number of authorised people whose work requires it can access data, under written confidentiality undertakings and with the least access the task needs.
If a breach affects your data, we notify the Saudi Data & AI Authority within 72 hours of becoming aware of it, and tell you without undue delay what happened and what we are doing about it.
9. Your rights
The Personal Data Protection Law gives you the following rights over your data:
- To know what we collect and why (this policy).
- To access your data and obtain a copy of it in a clear, machine-readable format.
- To correct your data; you can edit your name, mobile number and unit type directly in Settings.
- To delete your data, by closing your account.
- To withdraw consent: turn phone notifications off in Settings, disconnect a channel or a lock, or close the account.
- To object to processing based on legitimate interest.
- To complain to the Saudi Data & AI Authority.
To exercise any right, write to hello@hostly.io; we answer within 30 days. We charge nothing for this unless a request is repeated excessively. If you are a guest or a team member, your request goes to the host, and we help the host fulfil it.
11. Children
Hostly is a service for adult business owners (18 and over) who run rental units. It is not directed at children, and we do not knowingly collect their data.
12. Changes to this policy
When we change this policy we update the date at the top, and if the change is material we tell you in the app or by email at least 30 days before it takes effect. The version you accepted at signup is recorded on your account.
13. Complaints
If you have a complaint about your data, write to us first through the procedure in the Terms and Conditions; we acknowledge it within one working day and resolve it within 5 working days. You keep the right to complain to the Saudi Data & AI Authority.