Privacy Policy

1. Introduction

Only Ventures LLC (d/b/a “Hostbase,” “we,” “us,” or “our”) provides a cloud-based property management platform for hotels and short-term rental operators. This Privacy Policy describes how we collect, use, disclose, and protect information when you use the Hostbase platform, including the dashboard, APIs, MCP integrations, and white-label deployments (collectively, the “Service”).

This Privacy Policy applies to:

• Hotels and operators who use the Hostbase platform to manage their properties (“Operators” or “you”)
• Team members who access the platform on behalf of an Operator
• Property owners who access landlord reporting portals
• Guests whose reservation, contact, and stay information is processed through the platform

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Account Information

When you register for the Service, we collect: name, email address, phone number, company or organization name, and billing information (processed and stored by Stripe; we do not store full payment card details).

2.2 Property and Operational Data

When you use the Service, we process: property details (name, address, room types, unit counts, amenities), rate configurations (weekday, weekend, off-peak rates, minimum and maximum rate boundaries), availability and restriction settings, reservation records (dates, room assignments, pricing, booking source, status), channel connections and sync history, dynamic pricing configurations and adjustment logs, promotional campaign settings and performance data, and revenue and analytics data.

2.3 Guest Data

Hostbase processes guest data on your behalf. You are the data controller for guest personal information; Hostbase acts as a data processor.

2.4 Technical and Usage Data

We automatically collect: IP addresses and device information (browser type, operating system), pages visited and features used within the Service, login timestamps and session duration, and error logs and performance data.

2.5 Third-Party Data

When you connect OTAs through the Service, we receive: booking and reservation data from OTAs via channel manager webhooks, guest messages from OTA messaging systems, and commission and revenue data from OTA booking records.

If you sign in with Google or Microsoft, we receive your account’s email address, name, and profile picture from that provider. Section 4.6 describes how we use Google account data and the limits that apply to it.

3. How We Use Your Information

We use information to:

Provide the Service. Process reservations, sync rates and availability to connected OTAs, calculate dynamic pricing, deliver guest messages, generate analytics and reports, and operate white-label deployments.

Process Payments. Bill your subscription, process refunds, and maintain billing records.

Communicate with You. Send transactional emails (booking notifications, sync status alerts, account updates), respond to support requests, and notify you of material changes to the Service or these policies.

Improve the Service. Analyze usage patterns (in aggregate) to improve features, fix bugs, and optimize performance. We do not use your individual property data or guest data to train AI models available to other customers.

Maintain Security. Detect and prevent unauthorized access, fraud, and abuse.

Comply with Legal Obligations. Respond to lawful requests from government authorities and comply with applicable laws and regulations.

4. How We Share Your Information

4.1 With Third-Party Service Providers

We share data with service providers that help us operate the Service:

Channex (channel management): Property data, rates, availability, restrictions, and booking data are transmitted to Channex for distribution to connected OTAs. Channex processes this data under their privacy policy and our data processing agreement.

Stripe (payment processing): Billing and payment information is processed by Stripe under their privacy policy. We do not store full payment card details.

Supabase (infrastructure): Your Data is stored in managed PostgreSQL databases hosted by Supabase, with encryption at rest and in transit.

AI Service Providers: Certain features may use AI models for pricing optimization and operational recommendations. Data sent to AI providers is limited to what is necessary for the specific feature and does not include guest personal information unless required for the feature you are using.

4.2 With Connected OTAs

When you connect your properties to OTAs, your property data, rates, availability, and restrictions are shared with those OTAs. Guest data received from OTAs is processed within the Service. Each OTA’s privacy policy governs how they handle your and your guests’ information.

4.3 What We Never Do

We never sell or rent your personal information or guest data to third parties. We never share your data with advertisers or marketers. We never use your property data, rates, or revenue information to benefit competing operators. We never access your account data except to provide support you have requested or to maintain the security of the Service.

4.4 Legal Requirements

We may disclose information when required by law, court order, subpoena, or government request, or when necessary to protect the rights, property, or safety of Hostbase, our users, or the public.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you of any such transfer and any changes to this Privacy Policy. Google user data is treated differently: as described in Section 4.6, we will not transfer it in a merger, acquisition, or sale of assets without your explicit prior consent.

4.6 Google Sign-In and Google User Data

Hostbase offers “Sign in with Google” as an optional way to access your account. When you use it, we request only the basic openid, email, and profile scopes. We receive only your Google account’s email address, name, and profile picture. We do not request access to your Gmail, Google Calendar, Google Drive, or any other Google service, and we cannot read them.

How we use it. We use this data for one purpose: to authenticate you and match you to your existing Hostbase workspace. We do not use it for any other feature.

How we store it. It is stored on your Hostbase user profile, in our Supabase infrastructure (Section 4.1). It is account data, so it follows the account-data retention period in Section 5: kept for the duration of your subscription and for 30 days after termination, then permanently deleted. You may request deletion at any time under Section 7.3.

How we share it. We share it with no third party other than the infrastructure providers named in Section 4.1 acting on our behalf. We do not sell it, we do not use it for advertising, and we do not use it to train generative AI or machine-learning models. The AI processing described in Section 4.1 does not receive Google user data. Notwithstanding Section 4.5, we will not transfer it in a merger, acquisition, or sale of assets without your explicit prior consent.

Hostbase’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Hostbase’s access to your Google account at any time at myaccount.google.com/permissions. Revoking access does not delete your Hostbase account; you can continue to sign in with your email address and password.

5. Data Retention

We retain different types of data for different periods:

Account data: Retained for the duration of your subscription and for 30 days after termination to allow for data export.

Reservation and booking records: Retained for the duration of your subscription plus 12 months after termination for compliance and dispute resolution purposes.

Analytics and reporting data: Retained for the duration of your subscription. Aggregated, anonymized analytics may be retained indefinitely.

Technical logs: Retained for 90 days for debugging and security monitoring purposes.

Billing records: Retained for 7 years as required by applicable tax and financial regulations.

After the applicable retention period, data is permanently deleted or irreversibly anonymized.

6. Data Security

We protect your information using: encryption in transit (TLS 1.3) for all data transmitted between your browser and our servers, encryption at rest for all stored data, row-level security (RLS) policies ensuring strict tenant isolation in multi-tenant deployments, role-based access controls limiting internal access to authorized personnel, regular security reviews of our infrastructure and codebase, and secure API authentication for all programmatic access.

While we implement robust security measures, no system is completely secure. If you believe your account has been compromised, contact us immediately at founders@hostbase.ai.

7. Your Rights and Choices

7.1 Access and Export

You may access and export Your Data at any time through the Service dashboard.

7.2 Correction

You may update or correct your account information and property data at any time through the Service.

7.3 Deletion

You may request deletion of your account and associated data by contacting us at founders@hostbase.ai. Certain data may be retained as described in Section 5 for legal and compliance purposes.

7.4 Guest Data Requests

If a guest contacts Hostbase directly with a data access, correction, or deletion request, we will direct them to the relevant Operator, as the Operator is the data controller for guest personal information. Operators are responsible for responding to guest data requests in accordance with applicable law.

8. International Data Transfers

Hostbase is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in the United States. By using the Service, you consent to such transfers. Where required by applicable law, we implement appropriate safeguards for international data transfers, including Standard Contractual Clauses.

9. European Privacy Rights (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation:

Legal basis for processing: We process Operator data based on contractual necessity (to provide the Service) and legitimate interests (to improve and secure the Service). Guest data is processed on behalf of the Operator under a data processing relationship.

Your rights include: access to your personal data, rectification of inaccurate data, erasure of your data (subject to legal retention requirements), restriction of processing, data portability, and the right to object to processing based on legitimate interests.

Data Protection Officer: For GDPR-related inquiries, contact founders@hostbase.ai.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, including the right to know what personal information is collected, the right to request deletion, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising your rights.

To make a CCPA request, email founders@hostbase.ai with “CCPA Request” in the subject line.

11. Children’s Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, contact us immediately at founders@hostbase.ai and we will promptly delete it.

12. Cookies and Tracking

The Service uses essential cookies required for authentication, session management, and security. We do not use third-party advertising cookies or tracking pixels. We may use analytics tools to understand aggregate usage patterns, but these do not track individual users across other websites.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and notify you via the email address associated with your account. Your continued use of the Service after a material change constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices:

Only Ventures LLC (d/b/a Hostbase)

Email: founders@hostbase.ai

Address:
30 N Gould St, STE R
Sheridan, WY 82801
United States

This Privacy Policy was last reviewed and updated on February 20, 2026.