Privacy Policy
This Privacy Policy describes how Hashbang Ltd (“Hashbang,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information in connection with Host Homebase, our multi-tenant owner portal platform for short-term rental management companies (each a “Tenant”). Tenant-facing products may use their own brand names (for example, a Tenant may brand its portal as that company’s “Owner Portal”); this policy covers the Host Homebase platform that powers those experiences.
1. Who this policy covers
This policy applies to:
- Account holders who sign in to a Host Homebase portal (property owners, owner-entity members, and Tenant staff).
- Visitors to this public site (homebase.host), including the pages that publish this policy and our Terms of Service.
Host Homebase is not a consumer guest-booking site. Guests book through Airbnb, Vrbo, direct-booking sites, and similar channels operated by Tenants or listing platforms. We may still process limited guest-related data that Tenants or their integrations send into the platform so owners and staff can manage stays (see below).
2. Information we collect
2.1 Information you provide
- Account identity: name, email address, and optional profile image.
- Phone number and notification preferences: if you add a phone number, we store it in E.164 format, along with your preferred notification channel (email, SMS, or both) and a record of when SMS consent was obtained for that number.
- Owner-entity and membership data: the owner entities you belong to and your role on each (for example, owner).
- License and compliance records: short-term rental and tax license details you or Tenant staff enter (license type, numbers, jurisdictions, expiry dates) and certificate documents you upload.
- Support communications: messages you send to our contact addresses.
2.2 Information from Tenants and connected services
Tenants connect Host Homebase to operational systems. Depending on configuration, we may receive and store:
- Property and listing data from property-management integrations (for example, Hospitable), including property names, addresses, listing identifiers, calendar/pricing snapshots, and listing description text used for license-compliance checks.
- Reservation and financial data for owner reporting: stay dates, platform, reservation codes, host- and guest-side money figures (stored as integer cents), itemized fee/tax lines, and cancellation-related amounts where applicable.
- Guest display names associated with reservations. We deliberately minimize guest contact data from integrations: we store the guest name for calendar and operational display and do not retain guest email, phone, or location from those payloads for product use.
- Payout records from connected payout feeds, including amounts, dates, references, and masked bank-account descriptors as provided by the source system (not full account numbers we collect ourselves).
- Maintenance / approval workflow data from connected operations tools (for example, Breezeway task/approval content and comments) so owners and staff can review work in the portal.
- Raw integration payloads stored alongside normalized rows so we can reprocess syncs and audit data integrity. Those payloads may contain additional fields supplied by the third party beyond what we display.
2.3 Information collected automatically
- Session and authentication data: session tokens, expiry times, and limited request metadata such as IP address and user agent associated with sign-in sessions.
- Magic-link / verification records: short-lived tokens used to complete email (and, when enabled, SMS) sign-in.
- Operational logs and sync metadata: job run status, error diagnostics, and similar platform telemetry needed to operate and secure the service.
- Public-site technical data: standard web request logs and edge/security telemetry from our hosting provider when you visit homebase.host.
3. How we use information
We use personal information to:
- Provide, maintain, and secure Host Homebase for Tenants and their owners.
- Authenticate users (email magic links today; SMS sign-in codes when that feature is enabled).
- Send operational notifications you configure or that Tenants reasonably need for portfolio management (for example, license expiry reminders), by email and, when enabled and consented, by SMS.
- Sync and display property, reservation, payout, license, and maintenance data from connected systems.
- Run compliance and data-integrity checks (for example, comparing stored licenses to listing text and public city registries).
- Respond to support and privacy requests.
- Comply with law, enforce our Terms, and protect rights, safety, and security.
- Improve reliability and understand aggregate usage of the platform.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
4. Text messages (SMS)
Host Homebase may send SMS messages when a Tenant enables SMS for its deployment and a user has provided a phone number with the required consent. Message and data rates may apply.
Purposes. SMS may be used for:
- Operational product notifications you opt into (for example, license expiry or renewal reminders and other portfolio alerts offered in the product).
- Authentication messages, such as one-time sign-in or verification codes, when SMS sign-in is enabled.
We do not use SMS for promotional marketing blasts or to sell your number. We do not share phone numbers with third parties for their marketing.
Frequency. Message frequency varies with activity and your preferences. You should expect occasional transactional or operational messages, typically a few per week when features you use are generating alerts, not a high-volume marketing cadence.
Opt-in. SMS is opt-in. Providing a number and completing the product’s consent flow (or otherwise clearly agreeing to receive texts) authorizes messages of the types described above for that number. A channel preference alone is not treated as consent until consent is recorded for the current number.
Opt-out. You can reply STOP to any Host Homebase text to opt out of SMS. After opting out, you will no longer receive SMS from us on that number unless you opt in again. You may also update or remove your number and notification preferences in the product settings where available, or contact privacy@homebase.host. Reply HELP for help.
Carriers are not liable for delayed or undelivered messages. Consent to SMS is not a condition of purchasing property-management services from a Tenant, but certain Host Homebase features may require a working email address for account access.
5. How we share information
We share personal information only as needed to run the service:
- With the Tenant that manages your access. Owner and staff data for a Tenant’s deployment is available to that Tenant’s authorized staff according to roles and permissions in the product. Host Homebase is multi-tenant: one Tenant does not get another Tenant’s customer data through the product.
- Service providers who process data on our instructions, such as cloud hosting and security (Cloudflare), email delivery, and, when SMS is enabled, SMS delivery (for example, Twilio).
- Connected systems the Tenant authorizes (for example, Hospitable or Breezeway). Data flows to and from those systems under the Tenant’s configuration and those providers’ terms.
- Legal and safety. When we believe disclosure is required by law, regulation, legal process, or to protect rights, safety, or security.
- Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and continued protection of personal information.
6. Retention
We retain personal information for as long as needed to provide Host Homebase to the relevant Tenant, comply with legal obligations, resolve disputes, and enforce agreements. Session tokens and verification codes are short-lived. When a Tenant relationship ends or an account is removed, we delete or de-identify personal data within a reasonable period, except where we must retain records (for example, security logs, financial audit trails Tenants still need, or legal holds). Uploaded license documents are stored in private object storage and removed when the related records are deleted through the product.
7. Security
We use administrative, technical, and organizational measures designed to protect personal information, including encrypted transport (HTTPS), access controls and permission checks in the application, private storage for uploaded documents, and hosting on infrastructure with network-level protections. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
8. Cookies and similar technologies
Host Homebase portals use cookies or similar storage that is necessary to keep you signed in and operate the service (session authentication). We do not use third-party advertising cookies on the product. This public marketing site is static and does not set product session cookies; our host may still process standard request logs for security and reliability.
9. Your choices and rights
Depending on your location, you may have rights to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete personal information, subject to legal and operational exceptions.
- Opt out of SMS as described above, and control notification preferences in the product.
- Export or receive a copy of certain information you provided.
To exercise these rights, email privacy@homebase.host. We may need to verify your identity. If you use Host Homebase through a Tenant, some requests may need to be coordinated with that Tenant (for example, when they are the party that controls owner records in their business relationship with you).
Residents of certain U.S. states may have additional rights under state privacy laws. We will not discriminate against you for exercising privacy rights. We do not sell personal information or process it for targeted advertising as those terms are commonly defined under state privacy statutes.
10. Children
Host Homebase is directed at businesses and adult property owners. We do not knowingly collect personal information from children under 13 (or under 16 where that is the relevant standard). If you believe we have collected such information, contact us and we will take appropriate steps to delete it.
11. International users
We are based in the United States and process information in the United States and in locations where our service providers operate. If you access Host Homebase from another country, you understand that your information may be transferred to and processed in the United States, which may have different data-protection rules than your country.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated policy at this URL (https://homebase.host/privacy) and revise the effective date above. Material changes may also be communicated through the product or by email when appropriate. Your continued use of Host Homebase after an update means you acknowledge the revised policy.
13. Contact
Hashbang Ltd
Attn: Privacy, Host Homebase
Phoenix, Arizona, USA
Email:
privacy@homebase.host
14. Governing law
This Privacy Policy is governed by the laws of the State of Arizona, USA, without regard to conflict-of-law principles, except where applicable privacy law requires otherwise.