HostDesk Privacy Policy

SuperHost Depot LLC, operating as HostDesk (“HostDesk,” “we,” “us,” or “our”), operates the HostDesk platform and related services at thehostdesk.com. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our platforms, products, and services.

By using our services, you agree to the practices described in this policy. If you do not agree, please discontinue use of our platforms.

1. Information We Collect

We collect information in the following ways:

1.1 Information You Provide

• Name, email address, mailing address, and phone number
• Account credentials and profile details
• Property information, photos, and listing content
• Payment and billing information (processed securely through third-party processors such as Stripe)
• Communications you send to us, including support requests
• Mobile phone number when you opt in to receive SMS notifications
• Approved Rule definitions, including your automation preferences, thresholds, and operating parameters, and any instructions or context you provide when modifying or approving rules

1.2 Information Collected Automatically

• IP address, browser type, operating system, and device identifiers
• Pages visited, time spent, and clickstream data
• Cookies and similar tracking technologies (see our Cookie Policy for details)

1.3 Information from Third Parties

• Identity verification and background check providers
• Booking platforms and channel managers (e.g., Airbnb, VRBO)
• Analytics tools such as Google Analytics and HubSpot

2. How We Use Your Information

We use your information to:

• Create and manage your account
• Provide and improve our platforms, tools, and AI features
• Process payments and manage billing
• Send transactional and operational notifications, including via SMS (see Section 5)
• Respond to support requests and communicate with you
• Analyze usage patterns to improve our services
• Comply with legal obligations and enforce our Terms and Conditions
• Detect fraud, abuse, and security risks
• Carry out automated actions on your behalf under Approved Rules you have set (see Terms and Conditions Section 8.3) and operate the Activity Ledger described in Terms Section 16.6

2.1 Automated Decision-Making

HostDesk uses automated systems, including AI-assisted rule engines, to evaluate booking and operational events and to carry out actions under Approved Rules (see Terms and Conditions Section 8.3). These systems may consider factors such as guest communication patterns, booking attributes, vendor availability, and historical action outcomes.

(a) Logic and significance. The general logic of these systems is described in our application documentation. Decisions made by these systems can have a significant effect on Hosts (for example, issuing credits, dispatching vendors, replenishing supplies) and on Guests (for example, issuing credits, communication content).

(b) Human review. Actions that fall outside an Approved Rule's confidence threshold are escalated to a human reviewer before execution. Hosts can review every action in the Activity Ledger described in Terms Section 16.6.

(c) Your rights. See Sections 8.1, 8.1.1, and 8.2 for jurisdiction-specific rights related to automated decision-making.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

• Service providers: We share information with trusted vendors who perform services on our behalf, such as payment processors, cloud hosting, analytics, and communication services. These vendors are contractually required to protect your data.
• Affiliated brands: We may share information across brands we operate or control, including TravelHere, to provide guidebooks, local recommendations, and related services.
• Vendors in our network: Certain operational information, such as property details and work order data, is shared with Vendors in the HostDesk Vendor Network as needed to complete services.
• Legal compliance: We may disclose information when required by law, court order, or to protect the rights, property, or safety of HostDesk, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. Cookies and Tracking Technologies

We use cookies and similar technologies on our platforms to enable authentication, remember your preferences, analyze site traffic, and improve user experience. For full details, including how to manage your cookie preferences, please review our Cookie Policy at thehostdesk.com/cookie-policy.

5. SMS Notifications and Text Messaging

HostDesk offers SMS (text message) notifications to keep registered users informed about their account activity, bookings, and platform updates. Our SMS service is powered by Twilio Inc., a third-party messaging provider. This section explains how we collect, use, and protect your mobile phone number in connection with SMS communications.

5.1 How We Collect Your Phone Number

We collect your mobile phone number when you voluntarily provide it during account registration, within your account settings, or through any opt-in form on our platform. You are never required to provide a phone number to use our core services.

5.2 Opt-In and Consent

By providing your mobile phone number and checking the consent box during registration or in your account settings, you expressly consent to receive SMS notifications from HostDesk / SuperHost Depot. Consent is not a condition of purchasing any product or service.

5.3 Types of Messages We Send

SMS messages we send are transactional and operational in nature. These may include:

• Booking confirmations and updates
• Guest inquiry alerts
• Check-in and check-out reminders
• Work order and vendor coordination notifications
• Platform account alerts (e.g., login activity, billing reminders)
• Responses to messages you initiate (e.g., HELP requests)

We do not send promotional or marketing SMS messages to users who have not separately opted in to marketing communications.

5.4 Message Frequency and Rates

Message frequency: Message frequency varies based on your account activity. You may receive multiple messages per day during active booking periods.

Message and data rates may apply. Standard carrier rates for SMS and data apply to all messages you receive from us.

Your mobile carrier may charge you for text messages received.

5.5 How to Opt Out

You may opt out of SMS notifications at any time using any of the following methods:

• Reply STOP to any SMS message you receive from us. You will receive one confirmation message, and no further messages will be sent.
• Update your notification preferences in your HostDesk account settings.
• Contact us at [email protected] or [email protected].

5.6 How to Get Help

For help, reply HELP to any SMS message from us, or contact our support team at [email protected]. You can also call us at +1 (626) 225-2406.

5.7 No Sharing of Phone Numbers for Marketing

Your mobile phone number will not be sold, rented, or shared with third parties for their own marketing purposes. Phone numbers are used solely to deliver the SMS notifications described in this section and to comply with legal obligations.

6. Data Retention

We retain your personal information only as long as necessary for the purposes described in this policy, or as required by law. The following retention periods apply: account and profile data is retained for 3 years after account closure; billing records and transaction data are retained for 7 years to meet legal and tax obligations; SMS consent records and opt-in/opt-out logs are retained for 5 years; support communications are retained for 3 years; and server and access logs are retained for 12 months. When retention periods expire, data is securely deleted or anonymized. You may request early deletion as described in Section 8, subject to any legal holds.

Activity Ledger entries (records of automated actions taken under Approved Rules) are retained for the duration of your account and for 7 years after it closes, after which they are deleted or anonymized in accordance with applicable law. Retention beyond this period applies only where legally required, for example tax records, litigation hold, or regulatory inquiry.

7. Data Security

We implement industry-standard technical and organizational safeguards to protect your information against unauthorized access, disclosure, alteration, and destruction. These include encryption of data in transit, access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Your Privacy Rights

8.1 California Residents: CCPA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, disclose, and sell
• Right to delete personal information we have collected from you
• Right to opt out of the sale or sharing of your personal information (note: we do not sell personal data)
• Right to non-discrimination for exercising your privacy rights
• Right to know about, and in some cases opt out of, automated decision-making that has a significant effect on you, including actions taken under Terms Section 8.3. Contact [email protected] to exercise this right.

To exercise these rights, contact us at [email protected]. We respond to verifiable requests within 30 days.

8.1.1 Other U.S. State Privacy Rights

If you are a resident of Colorado, Connecticut, Virginia, Texas, or Utah, you may have additional privacy rights under your state's law, including rights related to profiling and automated decision-making. Contact [email protected] for details.

8.2 EEA/UK Residents: GDPR Rights

If you are located in the European Economic Area or United Kingdom, you have rights under GDPR including:

• Right of access, rectification, erasure, and restriction of processing
• Right to data portability
• Right to withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal)
• Right to lodge a complaint with a supervisory authority
• Right under GDPR Article 22 not to be subject to a decision based solely on automated processing if it has a legal or similarly significant effect on you. Where you have set and approved an Approved Rule under Terms Section 8.3, that approval is the legal basis for processing under Article 22. You can request human review of any automated decision and challenge it through the Activity Ledger dispute process in Terms Section 16.6.

To exercise GDPR rights, contact us at [email protected]. We respond within 30 days.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will take steps to delete it.

10. Third-Party Links and Services

Our platforms may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through our platform.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy with a revised “Last Updated” date. For material changes, we will provide additional notice (such as via email or a platform notification). Your continued use of our services after changes take effect constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our data practices, please contact us: