Privacy policy
Last Updated: 4 November 2026
1. Who we are and contact
Hostex is provided by Ecoya Consulting Inc., 3207 Quesnel Drive, Vancouver, V6S 1Z7, British Columbia, Canada. For privacy questions or requests, email [email protected] with “Privacy” in the subject or write to that address. Please send only the information necessary for an initial request; further verification may be needed.
2. Our role
Ecoya determines the processing needed for its own account administration, subscription billing, website operation, business communications, security and legal purposes.
For guest and reservation information processed on a property operator's behalf, Hostex generally acts as processor on the operator's instructions under the processing terms in the Terms of Use or a separately accepted DPA. A separate DPA can be requested from [email protected]. A property manager may itself act for another controller, in which case Hostex may be a further processor. The operator decides its guest-data purposes and must supply its own privacy notice. Guests should normally send reservation-data requests to that operator; Hostex forwards relevant requests and provides the assistance required for its role.
3. Information we handle
Depending on your interaction and enabled services, information may include:
| Category | Examples and sources |
|---|---|
| Account and business information | Name, email, telephone, business details, account identifiers, user role, settings and authentication information supplied by you or your administrator |
| Subscription and billing | Plan, invoice, transaction reference, payment status and relevant payer information from you or a payment provider |
| Support and correspondence | Inquiries, messages, attachments and necessary troubleshooting information you provide |
| Technical and usage information | IP address, browser/device information, requests, feature activity, errors, security events and permitted cookie or similar identifiers |
| Guest and operational records held for customers | Guest contact details, reservation/stay/property information, messages, permitted documents, payment references and necessary integration data from the operator, guest, channel or authorized service |
| AI interactions | Inputs, context and outputs necessary for enabled AI features, subject to the applicable processing terms and feature controls |
Required information may be necessary to provide an account, complete a transaction, supply a feature or comply with law. We explain relevant requirements where appropriate. Customers should limit documents and sensitive information to what is lawful and necessary for their actual purpose.
4. Purposes and legal bases
For Ecoya's own processing where the GDPR or UK GDPR applies, the principal purposes and grounds are:
| Purpose | Relevant information | Legal ground, where applicable |
|---|---|---|
| Accounts and requested services | Account, settings and service information | Contract necessity for an individual contracting party; legitimate interests in administering a business account for its representatives |
| Subscription, invoicing and collection | Business contact and transaction records | Contract necessity where relevant; legitimate interests in administration; applicable accounting/tax obligations |
| Inquiries and support | Contact, correspondence and troubleshooting | Requested pre-contract steps or contract necessity where relevant; legitimate interests in responding and supporting business users |
| Security, reliability and service operation | Technical, authentication and proportionate activity records | Legitimate interests in maintaining and protecting the service; applicable legal duties |
| Product analysis and usability improvement | Minimized usage/diagnostic information | Legitimate interests where appropriate; consent for tracking where required |
| Optional promotional communications | Contact and preference information | Consent where required; otherwise a permitted marketing basis with an applicable opt-out |
| Legal obligations and claims | Information relevant to the duty or dispute | Applicable legal obligation or legitimate interests in legal claims |
Consent is obtained where required and may be withdrawn. Legitimate interests are assessed against effects on individuals. Under applicable Canadian law, we rely on meaningful consent or a permitted exception, considering the purpose, sensitivity and reasonable expectations. The operator identifies the grounds for guest information processed on its instructions; Hostex's account-management grounds do not replace them.
5. Recipients
Information is disclosed as needed for the identified purpose to authorized account users, appointed providers, customer-selected channels and integrations, professional advisers, competent authorities or a relevant business successor. Required legal disclosures and business-transaction due diligence are subject to applicable restrictions and safeguards.
Providers may handle limited personal data necessary for their task, such as hosting records, delivering a message or processing a payment. Provider categories include hosting, communications delivery, customer support and development services, payments, document processing, AI/translation and notification services. The provider register and relevant entity/role information are available on request from [email protected]. A customer-selected provider may also process information under its own terms and notice. Hostex does not sell guest records or authorize unrelated marketing use of personal data processed on customers' behalf.
6. Locations and transfers
Hostex uses Cloudflare for databases, files and backups, with storage in the United States and Canada. Support and development personnel operate in Canada and China. Access to personal information is limited to authorized service-related purposes and the information necessary for the assigned work. Providers' network, operational and support processing and customer-enabled destinations may involve other countries, as relevant to the service and recipient.
For restricted transfers, the applicable recipient and flow must have a valid basis, such as an applicable adequacy decision or appropriate contractual safeguards. Canada's recognition has a defined scope and does not automatically cover all onward processing. Applicable contractual safeguards may include EU SCCs, Swiss adaptations and the UK Addendum. Information and copies of applicable safeguards are available on request. Necessary transfer assessments and additional safeguards apply to the actual flow. Foreign law may allow authorities to require access to information.
Contact our privacy address for information about relevant processing countries or a copy of applicable safeguards, subject to necessary confidentiality protections. Personnel access is governed by authorization and the service purpose.
7. AI
Enabled AI and translation functions may process the input and limited context necessary for their task through relevant AI and translation providers, including OpenAI API services. Section 9 of the Terms of Use explains permitted use and review responsibilities; provider details are available on request.
Hostex does not use Customer Personal Data to train general-purpose models and engages AI providers on terms consistent with that restriction. Model inference, authorized operational/safety processing and retention are separate from training. Personal-data processing remains subject to the applicable processing terms and transfer safeguards; a feature's availability does not dispense with them.
8. Cookies and similar technologies
Technologies may support authentication, security, sessions and preferences. Optional analytics, personalization or marketing technologies, where used, are subject to the information and consent requirements applicable to their actual purpose. Where consent is required, it is requested before activation, with relevant provider, purpose and lifetime information and a way to change or withdraw the choice. You may also contact support for assistance. Browsing alone is not consent to nonessential tracking.
Operators are responsible for additional technologies they enable on their booking sites. Browser/device settings may provide further controls.
9. Retention
Information is kept for its specified purpose, contractual instructions and applicable legal requirements, then deleted or anonymized. The main criteria are:
| Information | Retention criterion |
|---|---|
| Guest and operational records held for customers | Service duration and lawful instructions, followed by return/deletion under the applicable processing terms |
| Business accounts | Needed during the relationship and for completion, security, dispute or legally required administrative purposes |
| Subscription and tax evidence | Necessary records for the applicable accounting/tax period; Canadian tax records are generally required for six years after the last relevant tax year, with exceptions where law requires a different period |
| Support, diagnostics and security | Time necessary to resolve the matter, operate/protect the service and meet a documented legal or dispute need |
| Consent/preferences | Limited evidence needed to demonstrate or respect the applicable choice and meet legal requirements |
| Residual backups | Established rotation/deletion schedules, with affected data protected and beyond ordinary use pending removal |
The applicable processing terms contain the contractual post-termination return/deletion arrangement; statutory erasure and response requirements may require earlier action. Closure and cancellation are separate from completion of erasure. An account email is retained only where needed for the remaining lawful purpose; billing requirements do not justify keeping unrelated guest records. Privacy or deletion requests may be sent through support and handled manually.
10. Security
We use safeguards appropriate to the information and risks, including platform transmission encryption, encryption at rest, access authorization and access records. Additional information may be provided through an appropriate confidential inquiry process.
11. Rights and choices
Depending on applicable law, you may request access/copies, correction, deletion, restriction, portability, information about processing or review of relevant automated decisions. You may object where the law provides, withdraw consent and opt out of direct marketing. Requests may require proportionate verification and are handled within applicable deadlines. Where the GDPR applies, the normal response period is one month, subject to its permitted exceptions/extensions.
You may complain to the competent authority, including the Office of the Privacy Commissioner of Canada or an applicable provincial authority, your EEA data protection authority, the UK ICO or the Swiss FDPIC as relevant.
Where a US state privacy law applies, use [email protected] for the rights, authorized-agent process, opt-out or appeal it provides. An appeal may be identified as “Privacy appeal”. We honor applicable non-discrimination and preference-signal requirements. Rights and exceptions depend on the relevant law and processing.
12. Children and decision-making
Hostex business accounts are intended for adults. Operators may lawfully supply necessary information about accompanying children for their accommodation purpose. AI assistance and optional screening integrations do not themselves authorize unlawful profiling or consequential automated decisions. The relevant operator must provide required notices and safeguards for its decisions.
13. Updates
We publish the current version and provide notice or obtain consent where required for a material change in processing. For privacy questions, contact [email protected].