Privacy Policy

Guestlyhub ("we", "our", "us") is operated by Connectwork BV. We are committed to protecting your privacy and being transparent about how we handle your information. This Privacy Policy describes what data we collect, why we collect it, and how we use and protect it, on our website, in the web application and in the GuestlyHub mobile app.

Our role: for your own account data, Connectwork BV is the data controller. For the data of your guests and customers that you manage in Guestlyhub, you (the host or rental business) are the controller and we process that data on your behalf as a processor, only to provide the service.

1. Information We Collect

Account Information

When you create an account, we collect:

• Name, email address and, optionally, phone number
• Company or business name and billing details (address, VAT number)
• Password (stored securely using industry-standard hashing)
• Passkeys: only the public key is stored; the private key never leaves your device
• One-time codes for two-factor authentication, sent by email

Accommodation & Guest Data

To provide our vacation rental management services, we store the data you enter into the system or import from connected platforms:

• Accommodation details (names, descriptions, addresses, photos)
• Reservation and booking information
• Guest information (names, contact details such as email, phone number and address, check-in/out dates)
• Online check-in data: identity document details and photos of identity documents, as required for the guest registration that hosts must carry out by law
• Messages between you and your guests
• Invoices, quotes, payments and financial records, including your customers' bank details (IBAN) where you enter them

Usage Data

We automatically collect basic usage information to improve our service:

• Browser type and device information
• Pages visited and features used
• IP address (for security and rate limiting purposes)

Support & Communication

When you contact us through our support form or chatbot, we store the messages to provide assistance and improve our service.

Mobile App, Camera & Photos

The GuestlyHub mobile app for iOS and Android gives you access to the same account and data as the web application. The app uses the camera or your photo library only when you choose to take or select a photo, for example of a guest's identity document during check-in; that photo is uploaded to your account and nothing else is read from your photo library. The app does not access your contacts or your location.

Push Notifications

If you allow notifications, the app registers a device push token with our servers, delivered through Expo's push service and Apple or Google notification services, so we can alert you to new bookings, guest messages and completed check-ins. The token is linked to your account, is never used for advertising or tracking, and is removed when you log out, delete your account, or when it has not been used for 90 days. An overview of your notifications is kept in the app for 90 days.

Offline Mode

If you turn on offline access in the app, a copy of your daily overview, reservations and guest messages is stored on your device so you can consult it without a connection. This copy is protected with the device's data encryption, stays on your device and is deleted when you log out or turn offline access off. Replies you write while offline are kept on the device until they can be sent.

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Guestlyhub service
• Process your reservations, invoices, and guest communications
• Send you important account notifications (security, billing, service updates)
• Respond to your support requests
• Improve the platform based on usage patterns
• Prevent fraud and ensure security

We do not sell your data to third parties. We do not use your data for advertising purposes, and the mobile app does not track you across other apps or websites.

3. Data Storage & Security

Your data is stored on servers provided by Hetzner Online GmbH, located in Germany, within the European Union. Traffic to our website and application passes through Cloudflare's network for security and performance. We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing (bcrypt), passkeys and two-factor authentication
• Encryption of stored integration credentials and other selected sensitive data
• Nightly backups, kept for 30 days
• Access controls and authentication

4. Data Sharing

We only share data in the following circumstances:

• Service providers (sub-processors) who process data on our behalf, under data processing agreements:
  • Hetzner Online GmbH (Germany): hosting and storage
  • Cloudflare, Inc.: network security and content delivery
  • Expo (650 Industries, Inc.), Apple and Google: delivery of push notifications
  • Mollie B.V. (Netherlands): processing of subscription payments and, if you enable it, payments from your guests
  • Our email delivery provider, or your own mail server if you configure one, for emails sent on your behalf
  • Anthropic, PBC: only if you use the optional AI features (AI assistant, translation). The text you submit and the reservation or guest data needed to answer it are sent to Anthropic to generate the response. Under Anthropic's commercial terms this data is not used to train its models.
  • Google Ireland Ltd: website analytics, see Cookies (website only, not in the app)
• Integrations you enable: when you connect a channel manager (such as Smoobu) or calendar feeds of booking platforms, reservation data is exchanged with those services at your request
• Authorities: when you enable guest registration with the Spanish authorities (SES.Hospedajes), the required guest data is sent to the Spanish Ministry of the Interior on your behalf
• Legal requirements: When required by law, regulation, or legal process
• With your consent: When you explicitly authorize sharing

Every party we share data with is required to protect it at least as well as described in this policy. Where a provider is located outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

5. Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data ("right to be forgotten")
• Export your data in a portable format
• Restrict processing of your data
• Object to certain types of processing
• Withdraw consent at any time, for example by turning off notifications or offline access, disabling an integration or AI feature, or changing your cookie settings

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with a data protection authority. Guests who want to exercise their rights should contact the host they stayed with; we assist hosts in handling such requests.

Deleting your account: you can delete your account yourself at any time, in the web application or in the mobile app, under Profile → Delete account. Businesses of which you are the only administrator are deleted with it. Your personal data is erased within 30 days; invoices are kept for the period required by accounting law.

6. Cookies

Guestlyhub uses essential cookies required for the service to function (authentication, session management). We do not use advertising cookies. With your consent (via the cookie banner), Google Analytics sets first-party analytics cookies; without consent, only anonymized cookieless measurement pings are processed by Google (Google Ireland Ltd) on our behalf. You can change your choice at any time via the "Cookie settings" link in the footer.

7. Data Retention

• Account data: for as long as your account is active, and erased within 30 days after you delete it
• Guest and reservation data, including check-in data and identity documents: for as long as the host keeps the reservation or the account; the host decides how long this data is needed and must respect the legal retention periods of their country
• Notifications: 90 days; push tokens: removed after 90 days without use
• Backups: 30 days
• Invoices and financial records: for the period required by accounting law

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or through a notice in the application. Continued use of the service after changes constitutes acceptance of the updated policy.

9. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

Connectwork BV
Waselakehof 4, 9250 Waasmunster, Belgium
Company number: BE1001811050
Email: [email protected]
Website: guestlyhub.com