Privacy policy

How HostStackHQ collects, uses and protects personal data, and the choices you have. Last updated 31 October 2026.

Who we are

HostStackHQ is property management software for companies and owners in India that run BnBs, homestays and holiday flats. In this policy, “we” and “us” means HostStackHQ, and “company” means a business that uses HostStackHQ to run its properties.

We follow India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

Our role

For this website, trial requests and company accounts, we decide how your data is used. We are the data fiduciary.
For guests, cleaners and property owners, the company that runs the property decides what to collect and why. It is the data fiduciary and we process the data on its behalf, under its instructions. If you stayed at a property, contact the company you booked with first; we will help it answer you.

What we collect

Visitors to this website

This website sets no cookies and runs no analytics or advertising trackers. Like any website, our servers and our network provider see your IP address and browser details when you load a page, and keep them in short-lived security logs.

Trial requests

When you request a trial: your business name, your name, email, phone, city, how many properties you run, and any note you add.

Company users

Admins, managers, supervisors and property owners who sign in: name, email, phone, role, the properties assigned to them, a scrambled (hashed) copy of the password, two-step sign-in settings, and a record of sign-ins and changes for security.

Guests

Collected by the company you booked with: name, phone, email, booking dates and amounts, messages, feedback, and, with your consent, a government ID as Indian law requires of places that host guests, including the Form C details for foreign nationals. Card and bank details are entered on Razorpay’s payment page and never reach us.

Optional equipment at a property

A property may switch on door codes, guest WiFi, an occupancy report or noise alerts. Where it does: cameras cover the entrance only, never inside rooms, and their clips stay at the property; WiFi records device counts, never the websites you visit; noise is measured as a level, never recorded as audio. Signs at the property say which are in use.

How we use it

To run the service: bookings, calendars, guest messages, check-in details, cleaning jobs, invoices and owner reports.
To set up your trial, run your account, bill for it and answer your questions.
To keep the service secure and working: sign-in checks, fraud and abuse prevention, error reports and backups.
To meet legal duties, such as guest registration, Form C and tax records.

We do not sell personal data, use it for advertising, or share it with anyone for their own marketing.

Guests choose what they agree to, item by item (for example ID collection, door codes or WiFi), and can change their choices on their guest page until checkout. Withdrawing consent stops that use from then on; it may mean a service such as a door code is not available.

Who sees it

The company’s team, limited to the properties each person is assigned.
Property owners see their properties’ bookings, revenue and spending, but never guests’ names, phone numbers, IDs or door codes.
Service providers who process data for us under contract, only to run the service:
- Microsoft Azure: hosting and database, in the Central India region
- Cloudflare: network, security and email forwarding
- Brevo: sending email
- WhatsApp (Meta): guest messages
- Telegram: cleaners’ and staff jobs
- Razorpay: online payments, when a company takes them
- Google Fonts: the fonts on this website
Authorities, when the law requires it, such as police guest registration or a court order.

Where it is stored

Our servers and database are in India. Some providers above may process data briefly outside India, for example to deliver a message; they do not keep it for themselves.

How long we keep it

Guest details, IDs, feedback and consents: deleted 180 days after checkout.
Website booking requests that were declined: deleted after 3 days.
Cleaning photos: deleted 30 days after they were sent.
Messages with guests, and security logs: deleted after 90 days.
The audit record of changes and sign-ins (who did what and when, with no names or values): kept while the company’s account is open.
Trial requests: deleted a year after they arrive.
Invoices and accounts: kept as long as tax law requires.
Company accounts: kept while the account is open, and closed on request. The data in it is then deleted as described above, except what the law requires us to keep.
Encrypted backups keep deleted data for up to about two months, then it is gone from them too.

How we protect it

Guest IDs and door codes are encrypted at rest, and all traffic is encrypted in transit. Admins must use two-step sign-in, and any user can turn it on. Managers and supervisors see only the properties assigned to them, and property owners only their own. Changes to bookings and personal data are recorded in an audit log. Our logs record ids, not names or contact details. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.

Your rights

Under the DPDP Act you can ask to see the personal data held about you, have it corrected or completed, have it deleted, withdraw consent, and name someone to act for you if you die or cannot act. You can also complain to us, and then to the Data Protection Board of India.

Guests: ask the company you booked with first. Anyone else, or if you are not sure who to ask: write to us at the address below. We answer within 30 days.

Children

HostStackHQ is for businesses and adults. A child’s details reach us only when the adult who booked gives them for a stay.

Changes to this policy

We will post any change on this page with a new date, and tell companies by email about changes that matter.

Contact and grievances

For questions, requests or complaints about personal data, email support@hoststackhq.com.