Privacy Policy

Hostmizer BV, trading as Hostmizer® (VAT BE1039958675, enterprise number 1039.958.675), explains below how personal data is used under the EU General Data Protection Regulation (GDPR) and Belgian data-protection law.

This policy covers website visitors, prospective hosts, hosts and guest data processed in connection with hosting services.

---

1. Who is responsible for your data

Hostmizer BV, registered office Doornstraat 76, 8200 Bruges, Belgium, is responsible for personal data used for its own accounts, enquiries, marketing and service administration. Contact hello@hostmizer.com or use our contact form for privacy requests.

For guest data used on a host's instructions, the host generally determines the purposes of processing and Hostmizer acts as a processor. Where Hostmizer determines a separate purpose, its role and legal basis must be assessed separately. The host agreement and its data-processing terms set out those responsibilities.

2. Data we process and its sources

• Account and contact data: name, email, phone, language, country, sign-in identifiers and account credentials. Passwords are handled by the authentication service rather than stored as readable passwords in our application.
• Property data: address, selected place identifier, coordinates, property characteristics, photos, descriptions, prices and availability, including information imported at your request or received from Guesty.
• Enquiries and free tools: property location, listing links, property characteristics, answers you submit, and contact details for estimates, audits, regulation checks and consultations.
• Meetings and communications: booking information, support messages, correspondence and related customer-relationship records.
• Service and transaction records: reservations, service fees and invoices, and payout information where needed for the services agreed with you.
• Guest information: reservation and contact details, messages, and verification information where relevant to the authorised hosting service.
• Website data: device/browser information, network information, pages and events, referral and campaign information, and cookie or storage identifiers. See our Cookie Policy.

Data comes from you, authorised hosts, booking platforms, Guesty, scheduling services and use of the Site.

3. Purposes and legal bases

Guest-data processing on a host's behalf follows the host's documented instructions and applicable processing agreement. A service request does not by itself authorise unrelated marketing.

4. Automated tools

The application updates customer-relationship categories from actions such as signup, booking a meeting and creating a listing. Hosting tools may also support pricing recommendations. The use of any solely automated decision with legal or similarly significant effects, and any required Article 22 safeguards, must be confirmed before such processing is introduced or described as compliant.

5. Recipients and providers

Data is shared only as relevant to the service or purpose:

• Lovable Cloud and its infrastructure providers: website, accounts, database, storage and managed email delivery; the app uses Cloudflare infrastructure.
• Guesty: property, channel and reservation operations.
• HubSpot: CRM records, lead submissions, listing records, meeting scheduling and visitor attribution.
• Calendly: consultation-booking information where the existing Calendly integration is used.
• Google Maps / Places: address-search input and selected-place requests to populate property addresses.
• Google Analytics, Google Tag Manager, Google Ads, Microsoft Clarity and Contentsquare: website measurement and interaction analysis.
• OpenAI Ads: advertising measurement through its pixel and server-side conversions service.
• Meta (Facebook / Instagram): with marketing consent, the Meta Pixel receives page views, lead submissions and account sign-ups (no contact details) for advertising measurement and ad optimisation.
• Authorised booking platforms: including Airbnb, Booking.com, Vrbo and Expedia, where used for your property.
• Advisers and authorities: where required for legal obligations or legal claims.

With marketing consent, Google Ads and OpenAI Ads may receive hashed contact information for conversion matching. Hashing does not make this data anonymous. Providers act as our processors under data-processing agreements, or as independent controllers under their own terms where stated in their policies.

We do not sell personal data.

6. International transfers

Provider processing may involve locations outside the European Economic Area. Transfers must have a valid Chapter V GDPR mechanism, such as an applicable adequacy decision or standard contractual clauses with any necessary additional measures. We rely on the EU-U.S. Data Privacy Framework where a provider is certified, and otherwise on the European Commission's standard contractual clauses included in the provider's data-processing agreement. A copy of the relevant safeguards can be requested through our privacy contact.

7. Processing guest data for hosts

Processing on a host's behalf requires an Article 28 GDPR agreement covering instructions, confidentiality, security, subprocessors, assistance with rights requests, breach notification and return or deletion of data. These terms form part of the host agreement.

8. Retention

We retain data only as long as necessary for the relevant purpose, applicable legal requirements and legal claims. Account and property information is needed while services remain active; reservation records may need to outlast account closure to settle existing bookings. Enquiry and marketing records must be reviewed when no longer needed, and marketing objections must be respected. Limited suppression records may be retained to avoid contacting someone who has opted out.

Our standard periods are:

• Account and property data: for the duration of the service and up to 2 years after closure, for settling bookings and claims.
• Prospect and enquiry data: up to 2 years after the last contact.
• Guest data processed for hosts: for the duration of the host agreement, then returned or deleted within 90 days, unless law requires longer.
• Invoices and accounting records: 10 years, as required by Belgian accounting and tax law.
• Analytics data: according to the configured provider retention, at most 14 months for Google Analytics.
• Backups: overwritten on the provider's rotation cycle.

Longer retention applies only where needed for an ongoing legal claim.

9. Security

Measures include authentication, access controls and encryption in transit. No service can guarantee absolute security. Where legally required, personal-data breaches are reported to the relevant authority and affected people. Access to personal data is limited to staff who need it.

10. Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability, object to processing, and withdraw consent without affecting prior lawful processing. Contact hello@hostmizer.com. We may request proportionate identity verification. The usual response period is one month; a lawful extension may apply with notice.

For guest data processed solely for a host, contact that host first; we assist as appropriate.

You may complain to the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels: www.dataprotectionauthority.be. You may also contact the authority competent for your habitual residence, workplace or the alleged infringement.

11. Children

Our hosting services are intended for adults. If you believe a child has supplied personal data, contact us so we can assess and address it.

12. Changes and tracking review

The date on this page identifies the latest revision. Material changes will be communicated where required. For details on cookies and how to change your choice, see the Cookie Policy.