Privacy Policy

1. Data Controller

HostIQ AI is the Controller of the personal data collected through the website and the platform. For any request or to exercise your rights, write to us at info@host-iqai.com.

2. Scope

HostIQ AI operates globally. This notice is drafted in compliance with the main international regulatory frameworks, including:

• EU/EEA: Regulation (EU) 2016/679 (GDPR)
• United Kingdom: UK GDPR and Data Protection Act 2018
• Switzerland: Federal Act on Data Protection (FADP / nFADP)
• California (USA): CCPA as amended by the CPRA
• Other US states: VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), TDPSA (Texas)
• Brazil: Lei Geral de Proteção de Dados (LGPD)
• Canada: PIPEDA and equivalent provincial laws
• Australia: Privacy Act 1988 and Australian Privacy Principles
• Japan: Act on the Protection of Personal Information (APPI)

3. Data we collect

• Registration data: name, email, password (encrypted).
• Billing data: company name, address, tax/VAT/EIN, processed via Stripe.
• Usage data: access logs, pages visited, IP address, user agent, device identifiers.
• Property data: listings, messages and guest information you link to the Service.

4. Purposes and legal bases

We process your data to: (a) provide the Service — performance of contract (GDPR art. 6.1.b); (b) tax, accounting and legal obligations — legal duty (art. 6.1.c); (c) security, fraud prevention and product improvement — legitimate interest (art. 6.1.f); (d) direct marketing — consent (art. 6.1.a). For California residents and other US states, the corresponding business purposes under the relevant laws apply.

5. Sharing with third parties (Sub-processors)

Data may be processed by providers acting as Processors / Service Providers:

• Supabase — database hosting and authentication (USA / EU)
• Cloudflare — CDN, hosting and protection (global)
• Stripe — payments and fraud prevention (USA / Ireland)
• Meta Platforms — marketing tracking pixel (USA / Ireland)
• AI providers (e.g. OpenAI, Anthropic, Google) — AI assistant features

We do not sell your personal data to third parties under CCPA/CPRA and other US privacy laws. Sharing for cross-context advertising (e.g. Meta Pixel) occurs only after opt-in where required by law.

6. International data transfers

Some providers are located outside the EEA/UK/Switzerland. Transfers are based on: European Commission Standard Contractual Clauses (SCCs), UK International Data Transfer Addendum, Swiss FADP addendum or adequacy decisions (e.g. EU-US Data Privacy Framework, where applicable).

7. Data retention

Account data is retained for the duration of the contractual relationship and up to 24 months after termination. Billing data is retained for the period required by local tax laws (typically 5 to 10 years). Technical logs are retained for up to 12 months.

8. Your rights

Depending on the applicable jurisdiction, you have the right to:

• Access, rectification, deletion (right to know / delete / correct)
• Restriction and objection to processing
• Data portability
• Withdraw consent at any time
• Opt-out of sale/sharing and targeted advertising (CCPA/CPRA and equivalent US laws)
• Non-discrimination for exercising your rights
• Complaint to the competent supervisory authority (Italian Garante, UK ICO, French CNIL, US state attorneys general, Brazil ANPD, Canada OPC, etc.)

To exercise your rights write to info@host-iqai.com. We will reply within the timeframes set by applicable law (30 days GDPR, 45 days CCPA, etc.).

9. Minors

The Service is not intended for children under 16 (13 in the USA under COPPA). We do not knowingly collect data from minors without parental/guardian consent.

10. Changes

We may update this Privacy Policy. Material changes will be notified by email or through the Service. The "Last updated" date at the top indicates the current version.