Privacy policy

This policy describes personal data processed by the Hostvia application at hostvia.me. It covers hosts, team logins, and guests who submit a booking inquiry. It is based on the data the application actually collects and the providers the code uses.

This policy does not claim a particular compliance certification. Rights and legal bases below apply where the relevant law gives them to you.

The operator of Hostvia decides why account, property, and inquiry data are processed. The operator has confirmed that there is no registered company. Privacy requests go to hello@hostvia.me, which is the confirmed support and privacy address.

Depending on how you use Hostvia, the service processes:

• Host account. Full name, email address, and the password you set at registration. Email confirmation and password reset are sent through the authentication provider.
• Public host profile. Username, business name, description, contact email, phone, location, map link, logo, cover image, and social links you choose to publish.
• Properties. Names, addresses, descriptions, capacity, amenities, house rules, prices, photos, and whether a listing is public.
• Calendars. iCal links you add, sync status, and reservation records imported from those calendars or entered manually. Imported titles can include guest names supplied by the other platform. Manual bookings can include a title, phone number, dates, source, and price.
• Booking inquiries. Guest name, email, phone, stay dates, guest count, optional message, and the property the inquiry concerns.
• Team access. Username, login email, display name, permissions, and the password set for that login.
• Saved messages. Titles and text you store for reuse with guests.
• Push notifications. If you enable them, the browser push endpoint, keys, and user agent.
• Subscription records. Stripe customer and subscription identifiers, plan status, period end, and whether cancellation is scheduled at the period end.

Host sign-in uses Supabase Authentication. The host account password is handled there. Hostvia's own tables do not keep a second copy of that host password.

Team-login passwords are stored so the property owner can view and reset them on the team-access page. Team logins cannot reset that password by email.

A short-lived cookie is set while a host password reset is in progress. Session cookies keep you signed in.

Hosts submit property, calendar, pricing, profile, message, and team data in the dashboard. Guests submit inquiry fields on the public booking page. Those inquiries are stored in Hostvia and shown in the host dashboard. The host and guest continue the conversation from there. Hostvia does not send booking inquiries through Telegram.

If inquiry email is configured, the same inquiry can also be emailed to the host's contact address, or to the host account email when no contact address is set. That email is sent through Resend. Browser push, when the host has allowed it, sends a short alert to the host's device.

Photos and logos are stored in Supabase Storage so they can be shown on the booking page.

Paid plans use Stripe Checkout and Stripe's billing portal. Both are Stripe-hosted pages. Hostvia receives subscription status from Stripe webhooks and from billing sync, and stores the identifiers and status described above.

The Hostvia database does not have a payment-card field, and Hostvia pages do not ask you to enter a card number. Card details are collected by Stripe. Stripe may also hold your name, email, payment method, invoices, and tax information under Stripe's own terms. This policy does not restate Stripe's policy.

The application uses:

• Authentication cookies from Supabase, so a signed-in session can continue.
• A password-recovery cookie that lasts about 15 minutes during a host password reset.
• A cookie that records when the site is opened as an installed app, so the installed-app layout can be applied. It can last up to one year.
• Local storage for interface state, such as the last calendar sync time, a dismissed setup checklist, and a dismissed install prompt.
• Google Analytics, which is loaded in the browser and may set analytics cookies and collect usage data such as pages visited.
• Vercel Analytics, which is enabled to measure visits to the site.

The public site does not include a separate cookie-choices banner. Browser controls can block cookies. Blocking authentication cookies will prevent sign-in. An internal admin sign-in, which is not part of the host or guest product, uses its own cookie.

Data is used to:

• Create and secure accounts, including email confirmation and password reset.
• Provide the dashboard, calendars, booking page, inquiries, and team access.
• Send inquiry alerts you have enabled.
• Bill for Pro and apply the Free or Pro property limit.
• Respond to support, privacy, and billing requests.
• Measure site use and protect the service from abuse.

Where a data-protection law requires a legal basis, the relevant bases are: performing the service you asked for; legitimate interests in keeping the service secure and understanding how the public site is used, where that basis is available and your interests do not override it; consent, including the browser permission for push notifications and any consent an analytics provider requires; and a legal obligation where one applies to a billing or disclosure request.

These providers are used by the application. They process data only as needed for the role described:

• Supabase — authentication, database, and file storage.
• Vercel — hosting and Vercel Analytics.
• Stripe — subscription checkout, billing portal, invoices, and webhook updates. Used for Hostvia plans, not for guest stay payments.
• Google Analytics — site measurement in the browser.
• Resend — booking-inquiry email to the host, when that email feature is configured. The inquiry itself remains in the Hostvia dashboard.
• Airbnb, Booking.com, or another calendar host — Hostvia fetches the iCal URL the host supplies. Those platforms receive whatever their own export link records.

Hosts are responsible for guest information they export or copy out of Hostvia, and for the contact details they publish on their booking page.

Supabase, Vercel, Stripe, Google, and Resend can process data in countries other than the country where you live, including the United States and other countries where those companies operate. The application code does not set or publish a single data-region choice. Transfer tools those providers offer, such as contracts, are described in their own documentation. This policy does not claim a specific transfer mechanism beyond the providers listed here.

Account, property, calendar, inquiry, message, and subscription records are kept while the account exists and the feature needs them. The application does not publish a fixed retention period in days or years.

You can edit or remove properties, calendar links, inquiries you control, saved messages, public profile fields, and team logins in the dashboard. Removing a team login deletes that team user. There is no self-serve control that deletes the whole host account. Email hello@hostvia.me to ask for account deletion. Say which account email to delete.

A guest can email the same address to ask about an inquiry. Include the name, email, and approximate date used on the form so the record can be found. The host also holds that inquiry in their dashboard.

Stripe may keep billing records under Stripe's rules after a subscription ends. Deleting a Hostvia account does not, by itself, erase Stripe's copy of invoices.

Host data in the database is protected with row-level access rules so that an account is limited to its own records, and team logins are limited to the host that created them. Stripe webhooks are checked with a signature before subscription status is updated. Traffic is served over the hosting provider's HTTPS setup. Payment card entry happens on Stripe's pages.

These measures reduce risk. They are not a guarantee that unauthorized access, loss, or a service incident will never happen.

Where applicable law gives you these rights, you can ask to access, correct, or delete personal data, to restrict or object to certain processing, and to receive a copy of data you provided. You can also complain to a data-protection authority in your country. The competent authority is not named here because the operator's establishment has not been published.

Send the request to hello@hostvia.me. Use the account email if you have an account, and describe what you want changed or deleted. Identity may need to be confirmed before the request is completed. The response will follow the timing required by the law that applies. Some records may be kept when the law requires it, including billing records held by Stripe.

Hostvia is a tool for people operating accommodation. It is not directed at children, and host registration does not ask for a date of birth. The inquiry form also does not ask for age. If you believe a child's information was submitted, email hello@hostvia.me with enough detail to find the record.

Updates are posted on this page with a new effective date. A change that materially affects how account data is used will be accompanied by a reasonable effort to email registered hosts.

Privacy inquiries: hello@hostvia.me.