Draft v0 · this is not a signed contract

Data processing agreement

When a business uses Hostly, that business is responsible for its customers’ data. Icaro Nutrition SCP is the data controller.

Parts

• Data controller: the business that holds the Hostly account.
• Data controller: Icaro Nutrition SCP, CIF ESJ67511840, Barcelona. Email: info@hostly.org.es.

Treatment

Messages from the Hostly web chat, venue profile, bookings (if enabled), and the visitor’s technical identifiers. Purpose: to provide the receptionist service, the inbox and the booking system. If a customer submits a complaint, Hostly sends a notification to the email address the business has provided in the dashboard (or to the one on the business listing). The administrator does not use this data to train their own models or to advertise to third parties.

Planned deputy heads

• OpenAI (GPT-5.6 Luna) — response generation; processing outside the EU.
• OpenRouter (GPT-5.6 Luna), Google (Gemini) — fallback option if OpenAI does not respond; data processing outside the EU.
• Hosting and database in the EU (Render, Frankfurt), including the team knowledge-base originals.
• Firebase Auth — authentication via the business dashboard.
• Cloudflare R2 — PDFs, DOCX files and photos from the profile (private EU bucket).
• Stripe — booking fee, if enabled by the tenant.
• Email provider (e.g. Resend) — booking confirmation, links to amend or cancel that appointment, a one-off code if the customer returns on another day, and notification of a complaint sent to the business’s email address.

Instructions and safety

The processor only handles the data for Hostly. One business is kept apart from another. Web and WhatsApp chats with customers are deleted automatically once they pass the period the business chooses (3, 6, 12 or 24 months; 12 by default). If there is a booking, the appointment and the billing details are kept and the chat text is cleared. From the Inbox the business exports or deletes one chat. Team-assistant questions are deleted on their own period of the same months, and the business can delete them at once. Documents are kept.

Signature

This text is for information purposes only. The acceptable DPA, once you sign up, will be posted in the dashboard and versioned. Until then, it is not considered signed.