HostelWho is responsible for your data
The data controller is KohCiao Studio di Casasco Matteo, Via Alessandro Cerruti 16, 15050 Avolasca, Alessandria, Italy, P.IVA 02820820062. You can reach us at support@hostelkeep.com.
This policy covers the HostelKeep app on Android, iOS and the web at app.hostelkeep.com. For the hostelkeep.com website, including cookies and analytics, see our website privacy and cookie policy.
When a hostel uses HostelKeep to manage its own staff, the hostel decides who has an account and what is recorded about their work. For that data the hostel is the controller of its employees' data, and we act as its processor.
Information we collect
- Account information. Owners and manager-side staff sign in with their own email address, which is also used for password resets. Housekeepers and maintenance workers don't need an email address: their manager creates their account with a username, and the app generates an internal, non-working address for them. We also store the display name, the hostel code (or codes, for owners with more than one property), the role, the team (housekeeping or maintenance) and, for staff, the permission role the owner gave them.
- App preferences. Small settings stored with your account, such as whether you have seen the welcome tutorial, when you last cleared your notifications, and whether you asked to hear more about HostelKeep Pro.
- Profile and hostel photos. Optional: a profile photo, and a logo for the hostel.
- Room and cleaning data. Rooms, floors and beds, room assignments, cleaning states, notes written by managers and housekeepers, extra time recorded, and extra-room requests.
- Room photos. A housekeeper asking for an extra room may attach a photo of it so the manager can decide.
- Maintenance reports and tasks. Problems reported by staff (title, description, room or area, priority), the people assigned to fix them, due dates, checklists, status changes with their times, comments, and photos of the problem and of the repair.
- Daily history. For hostels on a paid plan, a daily snapshot of the work done, so managers can review and export it.
- Push notification tokens. If you allow notifications, a device token so the app can alert you about cleaning events. For technical reasons this token is visible to other members of your own hostel. It identifies a device, not a person, and cannot be used to read any of your data.
- Crash and error reports. When the app crashes or hits an error, it sends a technical report: the error and where in the code it happened, the device model, operating system and app version, your role and your hostel code. Email addresses are removed from these reports before they leave your device, and we do not record your name, username or IP address, screenshots or recordings of the screen.
- Subscription and billing details. For paying hostels: the contact details you give us when you subscribe, and the invoices we issue. Subscriptions are arranged by email and paid by bank transfer, so we never see or store card details.
HostelKeep does not track your location, does not show advertising, and does not profile you.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating accounts, signing you in, and sending the welcome email with your hostel code | Performance of a contract |
| Assigning rooms, tracking cleaning, notes and extra requests | Performance of a contract; legitimate interest of the hostel in organising its work |
| Reporting, assigning and tracking maintenance work | Performance of a contract; legitimate interest of the hostel in organising its work |
| Crash and error reports, to find and fix faults in the app | Legitimate interest in keeping the app working |
| Push notifications about cleaning events | Consent, which you can withdraw at any time in your device settings |
| Daily history and reports | Legitimate interest of the hostel in keeping a record of completed work |
| Subscriptions and support | Performance of a contract |
| Issuing invoices and keeping tax records | Legal obligation |
| Keeping the service secure and fixing faults | Legitimate interest |
Who processes your data for us
We don't sell your data or share it for advertising. Inside the app, your data is only visible to members of your own hostel. These providers help us run the service:
| Provider | What it handles |
|---|---|
| Google (Firebase Authentication, Cloud Firestore, Firebase Hosting) | Accounts, all app data, and hosting of the web app |
| Expo (push notification service) | Delivering push notifications, together with Apple's and Google's own push services |
| Cloudflare (Workers) | Checking that a welcome-email request comes from a signed-in manager, then passing it on |
| Resend | Sending the welcome email: your email address, name, hostel name and hostel code |
| Functional Software, Inc. (Sentry), EU data region | Storing crash and error reports, as described in section 2 |
Each provider acts as our processor under a data processing agreement and may only use the data to provide its service to us. Some of these providers are based outside the European Economic Area, mainly in the United States. Those transfers are covered by the EU-US Data Privacy Framework where the provider is certified under it, and otherwise by the European Commission's Standard Contractual Clauses.
How your data is stored and protected
Data is stored in Google Cloud Firestore. Traffic between the app and our services is encrypted with HTTPS. Server-side security rules decide what each account can do: an account can only read and write its own hostel's data, housekeepers can only change the rooms assigned to them, and manager-side staff can only do what the role given to them by the owner allows. Passwords are handled by Firebase Authentication and are never visible to us.
How long we keep it
- Account data: for as long as the account exists.
- Rooms and cleaning history: for as long as the hostel exists.
- Photos attached to extra-room requests: deleted as soon as the request is approved or rejected, and in any case when the request is removed.
- Maintenance tasks and comments: until a manager deletes the task, and in any case when the hostel is deleted. Maintenance photos: deleted 30 days after the task is finished or archived; you are warned 7 days before and can save them first.
- Notifications: until a manager deletes them.
- Crash and error reports: deleted automatically by Sentry after at most 90 days.
- Used hostel codes: a record that a code was issued, with no personal data attached, is kept after a hostel is deleted so the same code is never given to another property.
- Welcome email logs at Resend: kept by Resend for a limited period to confirm delivery, then deleted.
- Invoices and payment records: for as long as Italian tax law requires, currently ten years.
Deleting your account
You can permanently delete your account in the app: tap your avatar, open Account and choose Delete account. Step-by-step instructions are on our account deletion page.
Housekeepers, maintenance workers and manager-side staff: your account and personal data are removed immediately. The hostel itself is unaffected.
Owners: deleting your account also deletes your hostels, their rooms, all cleaning history, and every housekeeper and staff account in them. An owner with more than one property can delete a single hostel instead and keep the account.
If you can't access the app, email support@hostelkeep.com from the address on your account, or include your hostel code and username. We delete the account within 30 days.
Payment records we must keep by law are retained after deletion, as described in section 6.
Your rights
Under the GDPR you can ask us for a copy of your data, and ask us to correct it, delete it, restrict or object to how we use it, or give it to you in a portable format. Where we rely on consent, you can withdraw it at any time. Write to support@hostelkeep.com; we answer within 30 days.
If you work for a hostel, requests about your work records may need to be handled by your employer, and we will pass them on.
You also have the right to complain to a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).
Children
HostelKeep is a workplace tool for hostel staff. It is not directed at children, and we do not knowingly collect data from anyone under 16.
Changes to this policy
When we update this policy, the new version is published on this page with a new date. Significant changes are also announced in the app.
Questions about this policy or your data: support@hostelkeep.com.