Your data stays yours
- No commission, no middleman: Boostinghost is software. We manage no properties, never contact your guests and sell no data.
- The money goes to you: payments and security deposits go through your own Stripe account, never through Boostinghost's.
- Card numbers stay with Stripe: guests enter their card with Stripe; Boostinghost never receives or stores card numbers.
- The AI doesn't learn from your messages: messages processed by the AI are not used to train models.
Who sees what
- Protected passwords: they are stored with irreversible hashing, never in plain text. Sign-in with Google or Apple is also available.
- Permissions per team member: calendar, messages, cleaning, revenue, finances. The server checks each permission on every request, not just the screen.
- Owners: each owner only has access to their own properties.
- iPhone app: session kept in the secure iOS Keychain, unlocked with Face ID.
Guest access
- Hard-to-guess personal links: links sent to guests (payment, security deposit, welcome book) carry a random 12-character code, and repeated attempts with unknown codes are blocked.
- Access codes held back: the lockbox code isn't sent until the stay's security deposit is in place.
- One code per stay with an Igloohome lock, revoked if the stay is cancelled or moved.
Hosting and service providers
- Encrypted connections: the website, apps and API only run over HTTPS.
- Service providers: Stripe (payments), Render (application hosting), Supabase (database, AWS Ireland, European Union), Brevo (emails, European Union), Firebase (notifications), Groq (AI). The full list and their policies are in our privacy policy.
- Transfers outside the European Union covered by the European Commission's standard contractual clauses (GDPR article 46).
- Service status: availability monitored continuously, visible on our status page.
GDPR: your rights
- Access, rectification, erasure, portability, objection, restriction: write to contact@boostinghost.fr. You can also contact the CNIL, the French data protection authority.
- Deleting your account: directly from My account, on the website or in the app.
- Retention periods: account data for the contract term plus 3 years, booking data for the contract term plus 5 years, payment data 10 years (accounting obligation), sign-in logs 12 months.
- Ad measurement on the public website only with your consent in the cookie banner, never in the app.