Privacy Policy
Last updated: 4 November 2026
1. Data Controller
The platform is operated by TDPK Digital Group s.r.o. The operator is the controller for account, billing and service-usage data. Accommodation providers are the controllers of their guests’ personal data; Hostivio processes those data on their instructions as a processor. Contact: [email protected]
2. Data We Process
We process the following categories of personal data: identification data (first name, last name, email), login credentials, billing information, guest data of the accommodation (to the extent necessary to fulfil legal obligations), and technical data about your use of the service (IP address, browser type, login records). When Inbox is used, we also process message content and metadata, translations, reply drafts, attachments and related booking and property information. Messages may come from guests, accommodation providers or connected booking and communication channels.
3. Purpose of Processing
We process personal data for the following purposes: providing and improving our service, fulfilling legal obligations (reporting guests under Act No. 326/1999 Coll.), invoicing and subscription management, communication with Users, and technical support. Inbox manages guest communications; depending on the features enabled, it uses AI for message classification, translation, reply drafting and automated communication.
4. Legal Basis for Processing
Processing is based on: performance of a contract (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c) GDPR), the legitimate interest of Hostivio (Art. 6(1)(f) GDPR), and the User's consent where required. The accommodation provider, as controller, determines the purpose and appropriate legal basis for processing guest messages in Inbox. Enabling AI is not guest consent. A controller relying on legitimate interests in efficient guest communication must assess necessity and balance those interests against guests’ rights; the availability of AI alone does not establish this legal basis.
5. Sharing Data with Third Parties
We use Clerk (authentication), Stripe (payments) and Cloudflare (CDN and protection) to provide the service. Depending on the AI features enabled and routing selected, relevant messages and context may also be processed by Anthropic (Claude), OpenRouter and model providers available through OpenRouter. Connected communication channels process messages under their own terms. We also disclose data to government authorities where required by law. Information about the specific recipients and contractual processing terms for the features you use is available at [email protected].
6. Data Retention
We retain personal data for the duration of the contractual relationship and thereafter for the period required by applicable law (typically 5–10 years for billing records). After this period, the data is securely deleted. Inbox is configured to retain message content, translations, attachments and related reply drafts for 24 months after checkout for a linked stay, or after the last message for conversations without a booking. A booking conversation without a linked stay first requires the relevant stay to be identified. Detailed AI processing and usage records are retained for at least 13 months for billing verification; message content and accounting documents have separate retention rules. AI providers’ retention periods depend on the service and contractual settings; processing does not automatically mean zero data retention. Details for a specific feature are available on request.
7. Reuse of Data for Repeat Check-ins
If a guest checks in again at the same accommodation using a travel-document number matching a previous stay at that accommodation, we reuse the personal data provided at that prior stay (name, date of birth, nationality, document number, visa number, home address, and email) to pre-fill the new check-in form. The signature is never reused and must be provided again for each stay. Matching is limited to prior stays at the same accommodation and uses the travel-document number as the key. This processing is based on performance of the accommodation contract (Art. 6(1)(b) GDPR) and our legitimate interest in an efficient check-in (Art. 6(1)(f) GDPR). Pre-filled data can be reviewed and corrected before submission, and this reuse does not extend the retention period set out in Section 6.
8. Your Rights
You have the right to access your data, to have it corrected or erased ("right to be forgotten"), to restrict processing, to data portability, and to object. These rights apply subject to GDPR conditions. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. You can exercise these rights at [email protected]. For messages and stay data, contact the accommodation provider as controller first; Hostivio assists that provider with handling requests. You also have the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.gov.cz).
9. Security
We use encrypted transmission and access controls. External services, including AI, may involve processing or access outside the European Economic Area. Such transfers require an appropriate GDPR mechanism, such as an applicable adequacy decision or standard contractual clauses with the necessary assessment and supplementary measures. Information about processing countries and applicable safeguards, including how to obtain a copy, is available at [email protected].
10. AI Replies and Human Review
AI can produce inaccurate or inappropriate outputs. In draft mode, the accommodation provider reviews replies before sending; when automation is enabled, some replies may be sent automatically. Contact the accommodation provider directly for help from a person. Direct guest interaction with AI must be clearly identified no later than the first interaction; this policy does not replace a notice in the communication channel. An automated reply is not itself the same as a solely automated decision with legal or similarly significant effects under Article 22 GDPR.
11. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes by email. The date of the most recent update is shown at the top of this document.
Your rights and obligations when using the Hostivio platform are governed by our terms of service.