Privacy policy

The data controller is Daniele De Bortoli, who runs Host Ghost AI as an individual. For any privacy question write to info@hostghost.app.

• Account: email, password (stored only as an encrypted hash, never in plain text), chosen plan and sign-up date.
• Analyses and properties: city, prices, minimum stay, period, listing link, names, prices and ratings of the competitors you enter, the analysis result and the names you give your properties.
• Subscription: payment happens on Stripe. We never see or store your card details: we only keep the Stripe customer ID, the subscription status and the renewal date.
• Price radar: your email and whether you want the weekly email.
• Feedback: the message, the rating and, only if you write them, your name and email.
• Contact form: name, email, topic and message, so we can reply to you.
• Technical data: an anonymous browser code (see the Cookies page) and your IP address, used only to prevent abuse (at most 10 analyses every 10 minutes) and deleted after 10 minutes. The hosting provider also keeps technical access logs.
• Technical errors: if a page or feature fails, we save the error message, the page and the browser type so we can fix it. We delete them after 90 days.

We do not use your data for advertising, we do not profile you and we never sell data.

• To provide the service (account, analyses, history, properties, price radar for subscribers): necessary for the contract (Art. 6(1)(b) GDPR).
• To handle payments and tax obligations: contract and legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR).
• For security and abuse prevention: legitimate interest (Art. 6(1)(f) GDPR).
• To read and reply to feedback and contact form messages: legitimate interest in improving the service, and your request.

To write the report, the analysis data (city, prices, period, listing link and competitor data) is sent to OpenAI's GPT-4o model through the Emergent service. We do not send your email or name. Please do not enter other people's personal data in the analysis fields.

We use providers that process data on our behalf (data processors), only as far as the service requires:

• Vercel: website hosting.
• MongoDB Atlas: database, with servers in Frankfurt (EU).
• Stripe: payments and subscriptions.
• Resend: sending service emails (price radar, password recovery, contact form messages).
• Zoho: the info@hostghost.app mailbox.
• OpenAI, through Emergent: generating the AI report.

Some of these providers are based or have servers outside the European Union (for example in the United States). In those cases transfers rely on the safeguards set by the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

• Account, analyses and properties: as long as the account exists. You can delete single analyses from your history at any time. If you ask us to close your account, we delete the data within 30 days.
• Login session: 30 days, then you log in again.
• Payment and billing data: as long as tax law requires (up to 10 years).
• IP address for the abuse limit: 10 minutes.
• Feedback: as long as needed to handle it. You can ask us to delete it at any time.

You can ask at any time to access, correct or delete your data, restrict its use, receive it in a readable format (portability) or object to its processing. Just write to info@hostghost.app: we reply within 30 days.

If you think your data is handled improperly you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority in your own country.

The service is meant for adult hosts and property managers. We do not knowingly collect data from anyone under 18.

If we change this policy we update the date at the top. For important changes we notify account holders by email.