01 Who we are
HostStacked ("HostStacked", "we", "our", "us") is a United Kingdom-based company that provides managed guest communication services for short-term rental operators.
For the purposes of UK data protection law, we are the data controller for the personal data we collect through this website (the "Site").
You can contact us at any time at support@hoststacked.com.
02 What this policy covers
This policy explains what personal data we collect through our Site, why, how we use it, who we share it with, and what rights you have under UK GDPR and the Data Protection Act 2018.
A separate Data Processing Agreement (DPA) governs our processing of guest data on behalf of clients of our managed service. That agreement is provided to each client during onboarding.
03 What we collect
3.1 Information you give us
When you use our demo request form, email us, or call us, we collect:
- Your name
- Your email address
- Your phone number (if you choose to provide it)
- Your company name and role
- The size of your property portfolio and the platforms you use (to tailor our response)
- The content of your enquiry and any subsequent communication
3.2 Information collected automatically
When you visit our Site, we may automatically collect limited technical information:
- Your IP address
- Browser type and version
- Pages visited and time spent
- Referral source
This is collected through standard server logs. It is used in aggregate and is not used to identify individual visitors.
04 Why we use it
We process your personal data for the following purposes:
- To respond to your enquiry and arrange a demo or consultation
- To send you information about our services, if you have requested it
- To operate, maintain, and improve our Site
- To comply with our legal obligations (for example, keeping basic business records for tax purposes)
- To establish, exercise, or defend legal claims
05 Our lawful basis for processing
Under UK GDPR we need a lawful basis for processing your personal data. We rely on:
- Legitimate interests — for responding to enquiries, improving our Site, and tailoring marketing communications to professional contacts. We have assessed that our legitimate interests do not override your rights and freedoms.
- Contract — where you have engaged us and processing is necessary to provide our services.
- Consent — where you have opted in to receive marketing communications; you can withdraw consent at any time.
- Legal obligation — for record-keeping required by law.
06 How long we keep it
We keep your personal data only as long as necessary for the purpose we collected it for:
- Demo request enquiries: 24 months after last contact, unless you become a client (in which case retention moves under the client relationship policy)
- Client communications and records: for the duration of the engagement and up to 6 years afterwards for tax and legal purposes
- Website analytics data: retained in aggregate form only
You can ask us to delete your data sooner — see section 9.
08 International transfers
Some of our service providers are based outside the United Kingdom, including in the United States and European Economic Area. Where personal data is transferred outside the UK, we rely on one of the following safeguards:
- Adequacy regulations issued by the UK government
- The UK International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses
- Supplementary technical and organisational measures where required
You can request a copy of the relevant safeguards by emailing support@hoststacked.com.
09 Your rights
Under UK GDPR you have the following rights:
- Access — to ask for a copy of the personal data we hold about you
- Rectification — to ask us to correct inaccurate data
- Erasure — to ask us to delete your data, where one of the grounds in Article 17 applies
- Restriction — to ask us to limit how we use your data
- Objection — to object to our processing, including for direct marketing
- Portability — to receive your data in a structured, commonly used format
- Withdraw consent — where processing is based on consent
To exercise any of these rights, email support@hoststacked.com. We will respond within one month.
You also have the right to complain to the Information Commissioner's Office (ICO), which regulates data protection in the UK. You can contact the ICO at ico.org.uk or on 0303 123 1113.
10 How we keep your data secure
We use reasonable technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, multi-factor authentication on administrative accounts, and staff confidentiality obligations. No system is perfectly secure, but we take these responsibilities seriously.
11 Cookies
Our Site uses cookies that are strictly necessary for basic functionality. We do not currently use non-essential cookies for marketing, profiling, or third-party advertising. If we add analytics or tracking in future, we will update this policy and add a cookie consent banner before any non-essential cookies are set.
12 Children
Our services are aimed at property managers and professionals. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us and we will delete it.
13 Changes to this policy
We may update this policy from time to time. The current version is always published here with the date it was last updated. Material changes affecting active clients will be communicated directly.
14 Contact
If you have any questions about this policy or our handling of your personal data, please get in touch: