Privacy Policy

Your guests’ data — you are the controller, we are your processor. Guest names, stay dates and the money figures for a booking are yours: you decide why they are collected (to run your accommodation and file your tax return) and you instruct us to process them. We act only on your instructions, which are set out in the data processing terms.

Your own data — we are the controller. Your email address, name, sign-in records, property details and the activity log exist so we can provide the service to you.

About guests (on your behalf)

• Guest name, arrival and departure dates, number of occupants and the Airbnb confirmation code — these appear on the DoT return.
• Money figures for each stay (nightly rate, gross earnings, fees, taxes collected) — the tax base and statement figures.
• A phone number and free-text notes — optional, entered by you for the stay. Airbnb’s calendar does not include them. Notes never print on the return.
• Entry or lockbox codes you record for a stay, and housekeeping notes.

About you

• Email address and name — to sign you in (by one-time code or Google) and to send account notices.
• Property details printed on the return: operator name, property code, property name and address; and, if you upload one, your signature image (stored encrypted).
• Your Airbnb calendar link — a secret link that lets us read your bookings. It is stored so we can sync, never shown again, and never logged.
• Sign-in records (time, IP address, browser) and an activity log of exports, submissions, imports and setting changes — for your security and so you can see what happened in your account.
• If you joined the landing-page waitlist: your email address and which button you used.

We deliberately do not hold guest email addresses, payment card numbers, passport or ID numbers, or guests’ home addresses.

Data is stored and processed in the United States by the providers listed below. That means guest and host data leaves the Cayman Islands. The Cayman Data Protection Act allows this where adequate safeguards are in place; ours are each provider’s data-processing agreement and the processing terms between you and us.

Planned, and announced by email at least 30 days before first use: Sentry (Functional Software, Inc.) (error reporting with personal data scrubbed).

Airbnb is the source of your calendar and transaction data, not a processor for us. We never send anything back to Airbnb.

It is your data, and you decide. The duty to keep tax records for the Department of Tourism sits with you, so we never delete or edit anything inside a live account on our own.

• Bookings, figures, tax periods and payouts stay for as long as your account exists.
• Optional, off by default: you can ask us to clear guest phone numbers, notes and entry codes a chosen number of days after check-out, or clear them for past stays in one go. Names, dates and figures are not touched.
• When you delete your account, everything is deleted after a 7-day grace period (signing in before then cancels). Our database provider’s backups age out within 30 days. Before you confirm, we remind you that DoT may ask you for these records and offer a full export.
• Sign-in codes live for 10 minutes. Server logs are kept for at most 30 days and contain no personal data. Waitlist emails are deleted 30 days after you create an account, or 12 months after signing up.

• See and take your data: Settings → Your data → Export gives you everything as JSON or Excel; filed returns download from the Tax page.
• Correct it: edit bookings and property details directly.
• Delete it: Settings → Your data → Delete account.
• Restrict or object: email privacy@hosts.ky.

Guests’ rights. A guest who asks us about their data is answered within 48 hours and their request is forwarded to you, their host and data controller, because only you can decide. We act on guest data only on your instruction.

You may also complain to the Cayman Islands Ombudsman (Data Protection) or, for your own data, to the Office of the Privacy Commissioner of Canada.

• Everything travels over TLS. Sessions use secure, HttpOnly cookies and can be revoked on every device from Settings.
• No passwords: sign-in is a one-time code sent to your email (10-minute life, single use, rate-limited) or Google.
• Signature images are encrypted in the database with a key held only in our hosting environment. Calendar links are treated as secrets and never appear in logs.
• Every request checks that the data belongs to your account; a record that is not yours behaves exactly like one that does not exist.
• Logs and error reports are scrubbed of guest names, phones, notes, emails and links.

If something goes wrong. If personal data is exposed, we will tell the Cayman Islands Ombudsman and the people affected — you, and through you your guests — within 5 days of becoming aware, and we will tell you what happened and what to do.

We use only the cookies needed to keep you signed in and to remember which property you are viewing. There is no advertising, tracking or third-party analytics anywhere on Hosts.ky, so there is no cookie banner. If that ever changes, this policy will say so first.

Hosts.ky is for adults operating licensed accommodation. We do not knowingly collect data from anyone under 18 as a customer.

We will email you at least 30 days before a material change takes effect and ask you to accept the new version the next time you sign in. The version date at the top always tells you which text applies.

Convergine Corp. · Hosts.ky · privacy@hosts.ky