Data processing addendum

This page sums up the DPA terms from our privacy policy and terms.

When the DPA applies

When you upload or route Customer Content through Hosto, such as listing data, guest messages and reservation details from connected platforms, Hosto LLC processes that personal data as a processor for you. Our Data Processing Addendum (DPA) sets the terms.

Get a copy

Email legal@hosto.ai and we’ll send you the DPA.

Sub-processors

Hosto uses sub-processors to deliver the Service, such as cloud hosting, storage, analytics, logging, monitoring, email delivery, customer support tools, identity and access management, payments and security. We keep a list of them and give notice of material changes as the DPA requires. Ask for the current list at legal@hosto.ai.

International transfers

Storage and processing happen mainly in the United States. For transfers from the EEA, the UK or Switzerland, we rely on safeguards such as the European Commission’s Standard Contractual Clauses, with the UK addendum where it applies.

Security and breaches

We protect data with encryption in transit and at rest, access controls, least-privilege practices, vulnerability management and monitoring. If we learn of a personal data breach affecting your Customer Data, we tell you without undue delay.

Deletion

After your account ends, you have 30 days to export your data. We then start deleting active Customer Data within 45 days. Backups and system logs may persist for up to 90 days before they’re purged.