Privacy Policy
Hostano

1. General information

The protection of your personal data is of particular concern to us. Hostano is a SaaS platform for managing holiday properties. We process personal data exclusively within the framework of statutory provisions, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

2. Controller

3. What data we process

Depending on how you use the platform, we process the following categories of data:

• Account data: Name, email address (provided via Google OAuth)
• Property data: Address, description, prices, booking rules
• Booking data: Booking period, number of guests, payment status
• Guest data: Name, email, phone, address, ID data (stored encrypted)
• Payment data: Payment status; card data is processed exclusively by Stripe and never stored on our servers

4. Legal basis for processing

• Performance of contract (Art. 6(1)(b) GDPR): provision of platform functions
• Consent (Art. 6(1)(a) GDPR): for optional features
• Legal obligation (Art. 6(1)(c) GDPR): e.g. registration requirements
• Legitimate interest (Art. 6(1)(f) GDPR): security and operation of the platform

5. Authentication (Google OAuth)

Login to Hostano is done via Google OAuth 2.0. Your name and email address are transmitted from Google to Hostano. No passwords are stored. Google's privacy policy can be found at: policies.google.com/privacy ↗

6. Payment processing (Stripe)

Payments are processed via Stripe, Inc. Card data is processed exclusively by Stripe and never reaches our servers. We only store payment status and Stripe reference IDs. Stripe's privacy policy can be found at: stripe.com/privacy ↗

7. Hosting & Infrastructure

The platform is operated on our own servers in Germany. We use Appwrite (self-hosted) as backend technology. All data remains on our servers and is not transferred to third countries.

8. Encryption of sensitive data

Particularly sensitive data such as ID and passport numbers are encrypted with AES-256 before storage. The encryption key is tenant-specific and is secured server-side with a master secret that is never stored in the database.

9. Data disclosure to third parties

Personal data is only disclosed to third parties if this is required by law (e.g. registration requirements with authorities), you have expressly consented, or this is necessary for the performance of the contract (e.g. Stripe for payments).

10. Retention period

Personal data is deleted as soon as the purpose of processing no longer applies and no statutory retention obligations exist. When an account is cancelled, all associated data is irrevocably deleted within 30 days.

11. Your rights

• Access (Art. 15 DSGVO)
• Rectification (Art. 16 DSGVO)
• Erasure (Art. 17 DSGVO)
• Restriction (Art. 18 DSGVO)
• Data portability (Art. 20 DSGVO)
• Objection (Art. 21 DSGVO)
• Withdrawal of consent (Art. 7 Abs. 3 DSGVO)

To exercise your rights, an informal message to the contact address above is sufficient.

12. Right to lodge a complaint

13. Currency and changes

This privacy policy is currently valid (as of June 2026). In the event of significant changes, registered users will be informed by email. The current version is always available at treichel-labs.app/datenschutz/hostano.