Privacy Policy

1. Overview

This Privacy Policy (the “Policy”) describes how Hoost, Inc. (“Hoost,” “we,” “our,” or “us”) collects, uses, discloses, and otherwise processes personal information about you when you access or use our mobile applications, websites at hoost.it and related subdomains, and any other products, features, or services that link to this Policy (collectively, the “Services”).

By using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with our practices, do not use the Services. Where required by law, we will obtain your consent before processing certain categories of personal information.

2. Scope & Applicability

This Policy applies to personal information processed by Hoost as a data controller in connection with the Services. It does not apply to personal information processed by third parties whose services you access through the Services, including venue and vendor partners. Those third parties operate their own privacy practices, and we encourage you to review them before sharing personal information directly with them.

3. Data Controller

The data controller for personal information processed in connection with the Services is Hoost, Inc., a Delaware corporation. Contact details are provided in Section 22.

4. Information We Collect

We collect the following categories of personal information:

4.1 Information you provide directly

Account information. Name, email address, phone number, and password (when applicable) when you create an account. If you use Sign in with Apple, we receive an Apple-issued identifier and either your verified email address or an Apple-relay address.
Profile information. Optional profile photo, billing address, event preferences, and any other information you choose to add to your account.
Booking and event content. Event briefs you submit (including the free-text descriptions you provide to the search and concierge features), guest counts, dates, budgets, dietary or accessibility notes, venue and vendor selections, and messages exchanged with partners through the Services.
Payment information. Card details, billing address, and other payment instrument data are collected and processed by our payment processor, Stripe, Inc. (“Stripe”). We do not store full card numbers on our servers. We do retain transaction metadata such as amount, currency, last four digits, card brand, country, and an internal reference identifier.
Communications. The content of emails, in-app messages, support tickets, survey responses, and feedback you submit to us.

4.2 Information collected automatically

Device and identifier data. Device model, operating system version, app version, language, time zone, IP address, mobile country code, and an installation identifier we assign to your device. We do not collect the Apple Advertising Identifier (IDFA) and do not use the App Tracking Transparency framework.
Usage data. Pages and screens viewed, features used, taps and clicks within the Services, search queries you submit, referring URLs (web), and timestamps. We log these events with a user identifier after you sign in and with an anonymous installation identifier before you sign in.
Location data. If you grant permission, we collect approximate or precise device location to surface nearby venues and vendors. You may revoke this permission at any time in your operating-system settings.
Diagnostic data. Crash reports, exception traces, performance traces, and limited stack and runtime context to help us diagnose and fix problems. A sampled subset of sessions (currently 10% of traces and 5% of profiles) is captured for performance monitoring through our diagnostic provider, Sentry.
Push notification tokens. If you enable push notifications, the Apple Push Notification service (APNs) issues an opaque device token to us so that we can deliver notifications you have opted into.

4.3 Information from third parties

Apple. If you use Sign in with Apple, we receive limited identifiers and, depending on your choice, your email address or an Apple-relay address.
Stripe. Stripe shares transaction status, dispute and refund events, and limited identifiers tied to your payment method.
Google. If a partner connects Gmail to Partner OS, Google shares Gmail data authorized by that partner, including message metadata, sender and recipient details, subject lines, message content needed for the inbox, and the connected Google account email address. This connection is optional and is described in Section 21.
Public sources. For venue and vendor pages, we may incorporate publicly available business listings and partner-supplied content. This data is not associated with a consumer account until a booking or inquiry is initiated.

4.4 Information we do not collect

We do not knowingly collect health, biometric, government identification, racial or ethnic origin, religious, political, trade-union, sexual orientation, or precise genetic data. We do not collect contact lists from your address book. The iOS app does not record, capture, or transmit microphone audio.

5. How We Collect Information

We collect personal information directly from you when you use the Services, automatically through software development kits and servers operated on our behalf, and from third parties listed in Section 4.3 and Section 9.

6. How We Use Information

We use personal information for the following purposes:

Provide and operate the Services. Authenticate you, present search results, route inquiries to venue and vendor partners, process bookings, handle payments and refunds, and maintain your account.
Communicate with you. Send transactional emails and push notifications relating to your bookings, account, and changes to the Services; respond to support requests; and, where you have opted in, send marketing communications.
Improve the Services. Analyze usage to debug issues, measure engagement, and prioritize features. Where technically feasible, we perform this analysis on aggregated or pseudonymized data.
Personalize your experience. Rank venues and vendors based on the event brief you submit and prior bookings; surface relevant editorial content.
Fraud prevention, safety, and security. Detect and prevent fraudulent transactions, abusive use, and security incidents, and protect users, partners, and Hoost.
Legal compliance and dispute resolution. Comply with applicable laws, regulations, and lawful requests; enforce our agreements; and resolve disputes.

We do not use your personal information to make decisions producing legal or similarly significant effects without meaningful human involvement.

7. Legal Bases (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR to process your personal information: (a) performance of a contract with you (Art. 6(1)(b)); (b) compliance with a legal obligation (Art. 6(1)(c)); (c) our legitimate interests in operating, improving, and securing the Services and our business (Art. 6(1)(f)); and (d) your consent (Art. 6(1)(a)), for example for marketing communications and certain analytics. You may withdraw consent at any time by following the instructions in the relevant communication or in Section 13.

We share personal information only as follows:

With venue and vendor partners. When you request an inquiry, quote, or booking, we share the details necessary to fulfill the request, including your name, contact information, event date, guest count, budget range, and any notes or messages you have provided. Partners process this information as independent controllers.
With service providers. We engage vendors to process personal information on our behalf, subject to written agreements that restrict their use of the information to the services they provide to us. See Section 9 for the current list.
With professional advisors. Lawyers, accountants, auditors, insurers, and bankers, where reasonably necessary.
For legal reasons. When we believe in good faith that disclosure is necessary to comply with applicable law, a legal process, or a lawful government request; to enforce our terms; or to protect the rights, property, or safety of Hoost, users, or others.
Business transfers. In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, subject to standard confidentiality terms.
With your consent or at your direction. When you ask us to share information or post content publicly.

We do not sell your personal information for monetary consideration. We do not engage in “cross-context behavioral advertising” as defined under California law. We do not share personal information with third parties for their own independent marketing without your opt-in consent.

9. Service Providers & Subprocessors

The following providers process personal information on our behalf under written data-processing agreements:

Supabase, Inc. — managed PostgreSQL database, authentication, and object storage. Used to store account, booking, and content data.
Stripe, Inc. — payment processing, payout management, and identity verification for partners (PCI-DSS Level 1).
Cloud hosting providers. Web hosting, edge functions, and content delivery.
Functional Software, Inc. d/b/a Sentry — crash reporting and performance monitoring for the iOS app and backend.
PostHog, Inc. — first-party product analytics. We do not use PostHog to enable cross-context behavioral advertising.
Resend, Inc. — transactional email delivery (checkout receipts, account notifications, support replies).
Twilio Inc. — text message (SMS) delivery and phone-number verification for the notifications and verification codes described in Section 17A.
ElevenLabs, Inc. — outbound voice synthesis used by our concierge feature to contact venue and vendor partners on your behalf. The iOS app does not collect or transmit your audio to ElevenLabs.
Apple Inc. — Sign in with Apple identity service and Apple Push Notification service. Apple acts as an independent controller for Sign in with Apple.
Render Services, Inc. — backend application hosting.
Google LLC (Workspace). — corporate email and document storage.

We may add or replace providers from time to time. The list above reflects our subprocessors as of the “last updated” date at the top of this Policy.

10. International Data Transfers

Hoost is based in the United States and processes personal information in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States and in any other country where our service providers maintain facilities. Where required, transfers from the European Economic Area, the United Kingdom, or Switzerland are made pursuant to Standard Contractual Clauses or another lawful transfer mechanism.

11. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Services. After your account is closed or you request deletion, we retain information for the shorter of (a) the period required to comply with our legal, accounting, tax, and audit obligations (typically up to seven years for transaction records under U.S. tax and financial regulations), (b) the period necessary to resolve disputes or enforce our agreements, or (c) the retention period set by applicable law. Diagnostic data and analytics events are retained for a maximum of twenty-four (24) months. Backup copies may persist for an additional thirty (30) days after deletion from primary systems. Partner AI write-tool audit entries for previews, completed actions, and failures that may contain free-form message content are bounded at capture and retained for no more than ninety (90) days, with PII-marked audit entries retained for no more than thirty (30) days.

12. Security

We implement administrative, technical, and physical safeguards designed to protect personal information. These include encryption of data in transit using TLS 1.2 or higher, encryption of data at rest using AES-256 or equivalent for our primary database, role- based access controls, multi-factor authentication for employee accounts, principle-of-least-privilege access policies, code review requirements for production changes, and segregated production environments. Payment card data is handled by Stripe within its PCI-DSS Level 1 environment; we never store full card numbers on our systems.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to identify and mitigate risks promptly. If we become aware of a security incident affecting your personal information, we will notify you and any applicable regulator to the extent required by law.

13. Your Rights

Subject to applicable law and verification of your identity, you have the following rights with respect to personal information we hold about you:

Access. Request a copy of the personal information we hold about you.
Correction. Request correction of inaccurate or incomplete personal information.
Deletion. Request deletion of your personal information, subject to legal and contractual retention obligations.
Portability. Request a machine-readable copy of personal information you have provided to us.
Restriction and objection. Ask us to restrict or object to specific processing activities.
Withdraw consent. Where we rely on your consent, withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Marketing opt-out. Unsubscribe from marketing emails using the link in each message, opt out of text messages by replying STOP, or contact us using the details in Section 22.
Lodge a complaint. If you believe we have violated your privacy rights, you may contact us first or lodge a complaint with your local supervisory authority.

To exercise these rights, email privacy@hoost.it. We will respond within the timeframes required by applicable law (no later than thirty days under most regimes, or forty-five days under California law, in each case extendable where permitted).

14. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, “CCPA”). The categories of personal information described in Section 4 map to the following statutory categories: identifiers (Cal. Civ. Code § 1798.140(v)(1)(A)); customer records (B); commercial information (D); internet or other electronic network activity information (F); geolocation data (G); audio, electronic, or visual information (limited to images you upload) (H); professional or employment-related information (limited to partner accounts) (I); and inferences drawn to create a profile (K).

We collect these categories from the sources described in Section 5, use them for the purposes described in Section 6, and share them with the recipients described in Sections 8 and 9. We do not knowingly sell or share personal information for cross-context behavioral advertising, and we have not done so in the preceding twelve months. We do not use or disclose “sensitive personal information” (Cal. Civ. Code § 1798.140(ae)) for any purpose other than those permitted under Cal. Civ. Code § 1798.121(a)(2)(A)–(E) without your consent.

California residents may exercise the right to know, right to delete, right to correct, right to limit use of sensitive personal information, right to data portability, and right to non- discrimination by contacting privacy@hoost.it. You may designate an authorized agent to submit a request on your behalf; we will require proof of authorization.

15. European & UK Users (GDPR/UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the rights described in Section 13 are provided to you under the GDPR or UK GDPR, in addition to any rights under your national law. You may lodge a complaint with the supervisory authority in your member state of residence, place of work, or place of the alleged infringement. Our legal bases for processing are described in Section 7.

16. Cookies & Tracking Technologies

Our websites use cookies and similar technologies. We use strictly-necessary cookies to authenticate sessions and protect against fraud, and first-party analytics cookies (operated by PostHog) to understand product usage. We do not use third-party advertising cookies, retargeting pixels, or cross-context behavioral advertising. You may control cookies through your browser settings; some functionality of the Services may be impaired if you block strictly-necessary cookies.

Our mobile apps do not use browser cookies. Diagnostic and analytics SDKs in the iOS app are described in Sections 4.2 and 9. We honor “Global Privacy Control” signals on the web where required by law.

17. Marketing Communications

We send marketing emails only to users who have opted in. Each marketing email includes an unsubscribe link. Opting out of marketing does not affect transactional messages necessary to provide the Services (for example, checkout receipts and account-security alerts).

17A. Text Messages (SMS)

If you give us your mobile number and agree to receive text messages, we use it to send transactional messages about your account and bookings (verification codes, quote and booking notices, payment alerts, event-day coordination, and RSVP confirmations, reminders and updates). We record the date, time and source of your consent. Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out or HELP for help; you can also turn texts off in your Hoost settings or contact privacy@hoost.it. We do not share, sell, or rent your mobile phone number or your text-message opt-in data and consent to third parties or affiliates for their marketing or promotional purposes. We share it only with service providers, such as Twilio, that deliver the messages for us. We do not send marketing text messages unless you separately opt in.

18. Children’s Privacy

The Services are not directed to children under thirteen (13). Certain venues listed on the Services serve alcohol or otherwise cater to adults; you must be of legal age to enter into a contract in your jurisdiction to reserve an event. We do not knowingly collect personal information from children under thirteen. If we learn that we have collected personal information from a child under thirteen, we will delete it. If you believe we have collected information from a child under thirteen, contact privacy@hoost.it.

19. Third-Party Links & Services

The Services may contain links to third-party websites, apps, or services that we do not operate. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with personal information.

20. Sign in with Apple

When you use Sign in with Apple, Apple shares with us either your verified Apple ID email address or an Apple-relay address that forwards to your inbox. Apple acts as an independent controller for its identity service. If you used the “Hide My Email” feature, Apple may revoke the relay at any time at your direction. For more information, see Apple’s privacy disclosures at apple.com/legal/privacy/data/en/sign-in-with-apple.

21. Google API Services & Partner OS Gmail

Partners may choose to connect a Google Gmail account to Partner OS so Hoost can index event inquiries from the partner’s own inbox and show them in the partner-facing Partner OS inbox. This Gmail connection is optional and is available only after the partner completes the Google OAuth consent flow.

When a partner connects Gmail, Hoost requests only the Google API scopes needed to provide the visible Partner OS inbox feature: read-only Gmail access, permission to send partner-approved replies, and the connected account email address. We do not request Google permissions to modify, delete, compose, or permanently remove Gmail messages from the partner’s Google account.

Hoost uses information received from Google APIs only to provide or improve user-facing Partner OS features that are prominent in the application interface, including inquiry detection, inbox timeline grouping, event-detail extraction, draft-reply suggestions, and partner-controlled lead management. Hoost does not sell Google user data, use it for advertising or retargeting, or use it to train generalized artificial intelligence or machine-learning models.

Gmail-derived data may include message metadata, sender and recipient information, subject lines, message content needed to operate the inbox, extracted event details, and the encrypted OAuth tokens required to maintain the integration. Tokens are encrypted before storage. Message data is stored only to operate the Partner OS inbox. Hoost sends a Gmail reply only after an authorized partner reviews it and explicitly chooses Send in Partner OS; it does not send autonomous or background Gmail messages.

Partners can disconnect Gmail from Partner OS at any time. When a Gmail integration is disconnected, Hoost revokes Google access on a best-effort basis, deletes the stored integration record and encrypted tokens, purges indexed Gmail/platform inbox rows scoped to the disconnected address, and marks unconverted Gmail-derived leads as stale. Converted event records and audit records may be retained as business records and security evidence, but retained audit records do not include Gmail message body content.

Hoost’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. A focused Google API disclosure is available at /privacy/google-api-disclosure.

21A. Instagram Data

If you choose to connect an Instagram professional (Business or Creator) account to Hoost, Instagram asks you to allow Hoost to read your account information (the instagram_business_basic permission). Personal Instagram accounts cannot be connected. When you connect, Hoost reads, once:

your username, name, profile picture and account type;
your follower, following and post counts;
the like and comment counts of your 25 most recent posts; and
your Instagram account IDs.

Why. To verify that you own the account, and to show verified reach and engagement. Hoost shows your verified follower count, without your Instagram username, to sponsors who are reviewing your sponsorship requests and on your claimed organizer page on Hoost. Hoost shows you your own engagement rate in your Hoost account. Hoost does not post to your account, read your messages, or read anything else from it.

What we keep. Your Instagram account IDs, username, name, links to your profile and profile picture, your follower, following and post counts, the dates you verified, and one engagement rate calculated from your recent posts (the average of likes plus comments per post, divided by your followers). We do not keep the like and comment counts of each post, and we do not keep your account type after checking that the account is a professional account. We do not store your Instagram access token. Hoost uses it once, while you connect, to read the information above, and then discards it.

How long. We keep this information until you disconnect Instagram or delete your Hoost account, and then delete it; backup copies follow Section 11. If your verification is more than 90 days old, Hoost stops showing it to sponsors and on organizer pages, but keeps it until you disconnect or delete your account.

Deleting it. You can do any of the following:

Choose Disconnect under Social Accounts in the Hoost app.
In Instagram, open Settings, then Apps and websites, select Hoost and choose Remove. Instagram then tells Hoost, and Hoost deletes the information.
Delete your Hoost account in the Hoost app. Connected Instagram information is deleted with it.
Follow the steps at hoost.it/data-deletion or email privacy@hoost.it. When Instagram sends Hoost a data deletion request, Hoost deletes the information and returns a confirmation code and a link to a status page at hoost.it/data-deletion/status/<code>.

Sharing. We do not sell Instagram data, and we do not use it for advertising. It is stored with our database provider (Section 9) and shown only as described above. We do not use Instagram data to train AI models.

22. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “last updated” date at the top of this Policy. If we make material changes, we will provide additional notice (for example, by email or an in-app notice) and, where required, obtain your consent. Your continued use of the Services after a change becomes effective constitutes acceptance of the updated Policy.

23. Contact Us

For questions about this Policy or to exercise your privacy rights, contact us at:

Hoost, Inc.
Attn: Privacy Officer
Email: privacy@hoost.it
Support: team@hoost.it

If you require a copy of this Policy in an alternative accessible format, please contact us and we will provide one promptly.