HostDesk Privacy Policy

Superhost Depot, Inc. dba HostDesk (“HostDesk,” “we,” “us,” or “our”), operates the HostDesk platform and related services at thehostdesk.com. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our platforms, products, and services.

By using our services, you agree to the practices described in this policy. If you do not agree, please discontinue use of our platforms.

1. Information We Collect

We collect information in the following ways:

1.1 Information You Provide

• Name, email address, mailing address, and phone number
• Account credentials and profile details
• Property information, photos, and listing content
• Payment and billing information (processed securely through third-party processors such as Stripe)
• Communications you send to us, including support requests
• Mobile phone number when you opt in to receive SMS notifications
• Approved Rule definitions, including your automation preferences, thresholds, and operating parameters, and any instructions or context you provide when modifying or approving rules

1.2 Information Collected Automatically

• IP address, browser type, operating system, and device identifiers
• Pages visited, time spent, and clickstream data
• Cookies and similar tracking technologies (see our Cookie Policy for details)

1.3 Information from Third Parties

• Identity verification and background check providers
• Booking platforms and channel managers (e.g., Airbnb, VRBO)
• Analytics tools such as Google Analytics and HubSpot

1.4 Phone Calls

We record and transcribe calls. We use recordings and transcripts to answer you, improve our service and train our own AI. We aim to delete call recordings and their transcripts within 12 months. We are rolling out automatic deletion; until it is fully in place, some copies, including copies held by our phone service provider, may be kept longer. To ask us to delete a recording or transcript sooner, contact us. We may keep a recording longer if we need it for a dispute or claim, to meet a legal requirement, or to protect the security of our services. Deleted recordings can take up to 30 more days to clear from our backups. Call recordings on our Koli phone lines are not yet deleted automatically, and some copies are not yet covered by our cleanup: notes and comments in our internal task tracker, the email notifications our team receives about new requests, and internal activity logs that record when we contacted you. We are extending our cleanup to those internal copies by mid-November 2026. Our service providers (Twilio, which uses Google for speech, and our AI model providers) process calls on our behalf. You can ask us to delete your recording or transcript by emailing privacy@thehostdesk.com. A deletion request also removes the data from future training sets.

1.5 Website Chat (Ask Koli)

Ask Koli, the AI assistant on thehostdesk.com, answers questions automatically. To answer, we send your chat messages to our AI model providers, which process them on our behalf. If you share your name, email or phone number in the chat, we create a follow-up request with those details, the page you were on and your IP address, so a person on our team can reach you. We keep these hand-off records only as long as we need them to respond to you and for our normal business records. Some copies are not yet covered by our cleanup: notes and comments in our internal task tracker, the email notifications our team receives about new requests, and internal activity logs that record when we contacted you. We are extending our cleanup to these by mid-November 2026. You can ask us to delete them at any time using the contact details in the Contact Us section. Contact details you give in website chat are not consent to receive text messages. Please do not share door codes, passwords or payment details in the chat. To ask us to delete your chat hand-off record, you can also email privacy@thehostdesk.com.

2. How We Use Your Information

We use your information to:

• Create and manage your account
• Provide and improve our platforms, tools, and AI features
• Process payments and manage billing
• Send transactional and operational notifications, including via SMS (see Section 5)
• Respond to support requests and communicate with you
• Analyze usage patterns to improve our services
• Comply with legal obligations and enforce our Terms and Conditions
• Detect fraud, abuse, and security risks
• Carry out automated actions on your behalf under Approved Rules you have set (see Terms and Conditions Section 8.3) and operate the Activity Ledger described in Terms Section 16.6

2.1 Automated Decision-Making

HostDesk uses automated systems, including AI-assisted rule engines, to evaluate booking and operational events and to carry out actions under Approved Rules (see Terms and Conditions Section 8.3). These systems may consider factors such as guest communication patterns, booking attributes, vendor availability, and historical action outcomes.

(a) Logic and significance. The general logic of these systems is described in our application documentation. Decisions made by these systems can have a significant effect on Hosts (for example, issuing credits, dispatching vendors, replenishing supplies) and on Guests (for example, issuing credits, communication content).

(b) Human review. Actions that fall outside an Approved Rule's confidence threshold are escalated to a human reviewer before execution. Hosts can review every action in the Activity Ledger described in Terms Section 16.6.

(c) Your rights. See Sections 8.1, 8.1.1, and 8.2 for jurisdiction-specific rights related to automated decision-making.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

• Service providers: We share information with trusted vendors who perform services on our behalf, such as payment processors, cloud hosting, analytics, and communication services. These vendors are contractually required to protect your data.
• Affiliated companies: We may share limited information with companies we control, only to provide guidebooks, local recommendations, and related services you request. This never includes mobile phone numbers or text messaging opt-in data and consent.
• Vendors in our network: Certain operational information, such as property details and work order data, is shared with Vendors in the HostDesk Vendor Network as needed to complete services.
• Job details for your vendor: When you book a job, HostDesk shares the job details your vendor needs (such as the property address, access instructions, timing, checklists and guest first names) with Cloverlink LLC, our affiliated vendor platform, and the vendor assigned to your job, only to arrange, perform and pay for that job. We don't sell this information.
• Legal compliance: We may disclose information when required by law, court order, or to protect the rights, property, or safety of HostDesk, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Text messaging data. Mobile information will not be shared with third parties or affiliates for marketing/promotional purposes. All of the categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties or affiliates.

4. Cookies and Tracking Technologies

We use cookies and similar technologies on our platforms to enable authentication, remember your preferences, analyze site traffic, and improve user experience. For full details, including how to manage your cookie preferences, please review our Cookie Policy at thehostdesk.com/cookie-policy. Analytics cookies stay off until you accept in the EEA, the UK, and Switzerland. Elsewhere they are on unless you decline.

5. Text Messages (HostDesk Koli Texts)

HostDesk sends text messages through HostDesk Koli Texts, our SMS program, to people who ask for them: owners and HostDesk users, prospective customers, and people who contact us. Texts come from Koli, HostDesk's AI concierge, and our team. Our messaging provider is Twilio Inc. This section explains how we collect, use, and protect your mobile phone number in connection with text messages.

5.1 How We Collect Your Phone Number

You give us your mobile phone number when you choose to. You can opt in to texts in any of these ways:

• Checking the optional, unchecked “Text messages” box on our Get Started form or our Free property report form.
• Checking the text message consent box when you create a HostDesk account or in your account settings.
• Saying yes on a phone call when Koli asks whether we may text you, or asking us to text you.
• Texting us first; we reply within that conversation.

You are never required to provide a phone number or to agree to texts to use our services. See how the opt-in looks at thehostdesk.com/en/sms-opt-in.

5.2 Opt-In and Consent

We text you only after one of the actions above. Consent is not a condition of purchasing any product or service. HostDesk Koli Texts is a customer care program: we do not send marketing or promotional text messages. We keep a record of your consent (the wording you agreed to, your number and the time).

5.3 Types of Messages We Send

• Replies from Koli, HostDesk's AI concierge, to questions you ask
• Approvals, updates and reminders about your property, bookings, guests and work orders
• Account and onboarding notifications, such as your Get Started request or free property report
• Responses to messages you send us (e.g., HELP requests)

5.4 Message Frequency and Rates

Message frequency varies. Texts depend on your requests and account activity.

Msg & data rates may apply. Your mobile carrier may charge you for text messages you send and receive. Carriers are not liable for delayed or undelivered messages.

5.5 How to Opt Out

You may opt out of text messages at any time using any of the following methods:

• Reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) to any text from us. You will receive one confirmation message, and no further messages will be sent. Reply START to rejoin.
• Update your notification preferences in your HostDesk account settings.
• Email hello@thehostdesk.com or privacy@thehostdesk.com.

5.6 How to Get Help

For help, reply HELP to any text from us, email hello@thehostdesk.com, or call or text (855) 212-4853. You can also call us at +1 (855) 212-4853.

5.7 No Sharing of Mobile Information

Mobile information will not be shared with third parties or affiliates for marketing/promotional purposes. Text messaging opt-in data and consent will not be sold, rented, or shared with any third party or affiliate. All of the sharing categories in Section 3 exclude text messaging opt-in data and consent. Our messaging provider (Twilio) receives your number only to deliver the messages you asked for, and phone numbers are otherwise used only to comply with legal obligations.

6. Data Retention

We retain your personal information only as long as necessary for the purposes described in this policy, or as required by law. The following retention periods apply: account and profile data is retained for 3 years after account closure; billing records and transaction data are retained for 7 years to meet legal and tax obligations; SMS consent records and opt-in/opt-out logs are retained for 5 years; support communications are retained for 3 years; and server and access logs are retained for 12 months. When retention periods expire, data is securely deleted or anonymized. You may request early deletion as described in Section 8, subject to any legal holds.

Activity Ledger entries (records of automated actions taken under Approved Rules) are retained for the duration of your account and for 7 years after it closes, after which they are deleted or anonymized in accordance with applicable law. Retention beyond this period applies only where legally required, for example tax records, litigation hold, or regulatory inquiry.

7. Data Security

We implement industry-standard technical and organizational safeguards to protect your information against unauthorized access, disclosure, alteration, and destruction. These include encryption of data in transit, access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Your Privacy Rights

8.1 California Residents: CCPA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, disclose, and sell
• Right to delete personal information we have collected from you
• Right to opt out of the sale or sharing of your personal information (note: we do not sell personal data)
• Right to non-discrimination for exercising your privacy rights
• Right to know about, and in some cases opt out of, automated decision-making that has a significant effect on you, including actions taken under Terms Section 8.3. Contact privacy@thehostdesk.com to exercise this right.

To exercise these rights, contact us at privacy@thehostdesk.com. We respond to verifiable requests within 30 days.

8.1.1 Other U.S. State Privacy Rights

If you are a resident of Colorado, Connecticut, Virginia, Texas, or Utah, you may have additional privacy rights under your state's law, including rights related to profiling and automated decision-making. Contact privacy@thehostdesk.com for details.

8.2 EEA/UK Residents: GDPR Rights

If you are located in the European Economic Area or United Kingdom, you have rights under GDPR including:

• Right of access, rectification, erasure, and restriction of processing
• Right to data portability
• Right to withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal)
• Right to lodge a complaint with a supervisory authority
• Right under GDPR Article 22 not to be subject to a decision based solely on automated processing if it has a legal or similarly significant effect on you. Where you have set and approved an Approved Rule under Terms Section 8.3, that approval is the legal basis for processing under Article 22. You can request human review of any automated decision and challenge it through the Activity Ledger dispute process in Terms Section 16.6.

To exercise GDPR rights, contact us at privacy@thehostdesk.com. We respond within 30 days.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will take steps to delete it.

10. Third-Party Links and Services

Our platforms may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through our platform.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy with a revised “Last Updated” date. For material changes, we will provide additional notice (such as via email or a platform notification). Your continued use of our services after changes take effect constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our data practices, please contact us: