This policy explains what data HostFlow processes, from whom, why, on what legal basis, and with which providers — depending on whether you're a guest, a host/manager, or an owner.
1. Who processes your data
Active Network Global SL, Spanish tax ID B93372217, registered at C/ Decano Manuel Domínguez 12, 29140 Málaga, Spain ("HostFlow", "we"), decides why and how the personal data described in this document is processed.
Contact: hostflow@inbox-ia.com.
2. Who this document covers
This document covers three different profiles, because HostFlow processes their data differently:
- The guest: whoever stays at a property managed with HostFlow and uses the "Guest Pass".
- The host / manager: whoever has a business account on HostFlow.
- The owner (when the manager administers third-party properties): whoever gets read-only access.
3. What guest data we process, and why
3.1 For the Guest Pass to work
First name, last name, email and phone — the last two are optional for companions on the reservation (only required for the primary booker). Legal basis: performance of a contract or the host's legitimate interest in being able to contact you. No identity document or date of birth is requested for this part of the service.
3.2 To comply with traveler registration (legal obligation)
If your property is in Spain, the law (Royal Decree 933/2021) requires the host to report to the Spanish Ministry of the Interior, via SES.Hospedajes, for every guest over 14: first and last name, ID document type and number, date of birth, sex, nationality and declared address. For guests under 14, this data is provided by the accompanying adult. Legal basis: compliance with a legal obligation (GDPR art. 6.1.c).
What we never do with this data:
- We don't keep any photo or scan of your ID document beyond the time strictly needed to extract and verify the data: the image is discarded afterward, never archived.
- We don't keep a copy of the exact submission sent to the Ministry: only a hash that proves it wasn't altered, not the content.
3.3 Payments
If you pay for an additional service, your card is handled directly by Stripe, on its own page. HostFlow never sees or stores your card number — only the confirmation that payment went through. See stripe.com/privacy.
3.4 Messaging with your host
If your host texts you, the message is sent via an SMS messaging provider. If they use HostFlow's AI assistance to draft a reply, the content of your message is sent to our artificial intelligence provider only to generate a draft — the host decides whether to send it. Under that provider's current commercial terms, the content isn't used to train their models.
3.5 Third-party add-on services
These aren't active in production today. If one is activated, this policy will be updated before it goes live.
3.6 What your host sees
Your host can see your name, contact details, messages, and your registration status. They can't see your ID document number, date of birth, or declared address: that data only flows to the Ministry.
3.7 Kevin AI assistant (in your Pass and on WhatsApp)
You can talk to the assistant in your Pass chat or on WhatsApp. In both cases we process the content of your messages to reply to you, partly automatically using artificial intelligence. In the Pass chat the conversation is tied to your stay and we don't need your phone number. On WhatsApp we also process your phone number, and to recognise your stay we use the stay code included in the message when you open it from your Pass; those messages travel through WhatsApp Business (Meta). To draft the reply, messages are sent to our artificial intelligence provider, which under its current commercial terms doesn't use them to train its models. The assistant only uses the stay details you already see in your Pass; it never asks for ID documents or payment details, and never gives access codes or passwords in the conversation. In an emergency it tells you to call 112. Legal basis: performance of the contract for your stay.
4. What host / manager data we process
- Sign-up and access: name, email and password (always hashed).
- Billing: handled by Stripe; we never see your card number.
- Property management system (PMS) connection: credentials stored encrypted, used only for your own properties.
- Connected locks: you manage those credentials directly with the lock manufacturer; HostFlow never sees them. To issue and revoke each guest's code, we send the platform that manages the lock the stay's date window and a property reference — never the guest's name, email or phone.
- Language and session: see §9.
5. Legal basis for processing
- Contract performance: providing the service and managing your stay.
- Legal obligation: traveler registration and other applicable tax or commercial obligations.
- Legitimate interest: necessary operational communication and service improvement.
- Consent: when explicitly requested.
6. Who we share data with
HostFlow doesn't sell data to anyone. We share it only with who's necessary to provide the service:
- Stripe, Inc. — payments and subscriptions.
- An SMS messaging provider — SMS to the guest, when the host enables it.
- Meta Platforms Ireland Ltd. (WhatsApp Business) — messages with the WhatsApp assistant, if you write to it.
- Our artificial intelligence provider — AI reply drafting, only if the host uses that feature, and the assistant's replies (in the Pass and on WhatsApp).
- The platform that manages connected locks, when the property has one — only receives the stay's date window and a property reference.
- The property management system (PMS) the host connects on their own, where applicable.
- The Spanish Ministry of the Interior, via SES.Hospedajes — legal obligation.
- Public authorities, when the law requires it.
7. International transfers
Stripe and other providers we use (SMS messaging, artificial intelligence, connected-lock management) are based in the United States, and Meta (WhatsApp) may process data there. Transfers outside the European Economic Area happen under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, depending on each provider's current mechanism.
8. How long we keep your data
- Traveler registration data: 3 years from the end of the stay (RD 933/2021, art. 5).
- Guest Pass data: for as long as the relationship with the host lasts, plus the time needed to resolve any claim.
- Host account data: while the account is active, plus the applicable commercial/tax retention period (up to 6 years, Spanish Commercial Code).
- Conversations with the assistant (in the Pass and on WhatsApp): 90 days, deleted automatically. The WhatsApp stay code expires one day after your check-out.
After these periods, deletion is handled manually rather than automatically. If you wish your data to be deleted sooner, you may request it under the procedure described in section 11.
9. Cookies and local storage
The management console stores, in your own browser (never in a third-party cookie): your session and your chosen language. These are strictly necessary for the service to work (Spanish LSSI art. 22.2), so they don't require a separate consent notice.
This public website loads its typeface from Google Fonts and icons from a content delivery network (jsdelivr). Neither sets cookies, but both receive your IP address as part of the technical file request — the same minimal processing as any request to the internet.
10. Minors
The Guest Pass isn't aimed at minors acting on their own. Data for guests under 14 for traveler registration is provided by, and is the responsibility of, the adult who holds the reservation.
11. Your rights
You can request access to your data, correction, deletion (unless a legal obligation prevents it, such as traveler registration during its retention period), restriction of use, objection, or a portable copy. Write to hostflow@inbox-ia.com. If you're not satisfied with the response, you can file a complaint with the Spanish Data Protection Agency (AEPD).
12. Security
All communications travel encrypted (HTTPS). Third-party connection credentials are stored encrypted. Passwords are never stored in plain text.
13. Changes to this policy
If anything relevant changes, it will be announced here, with a new version date, before the change takes effect.