Legal

Privacy policy

Original policy effective 7 September 2026. Last updated 18 October 2026.

Auro MGT LLC, Miami, Florida, operates HoztSync. We use information to help rental operators manage stays, property work and payments. We do not sell personal information. For privacy requests, contact hello@hoztsync.com.

Who is responsible

We decide how account administration, software billing, support and service security information is used. For guest, owner and staff records entered by a rental operator, we generally process information on that operator’s instructions. The operator is responsible for its rental activity and notices. Where Auro MGT LLC is also your rental operator, its rental use and HoztSync’s software use remain distinct purposes.

What we collect and why

Accounts and access: name, email, workspace, role and authentication records, to sign you in and control access. Ordinary sign-in uses email codes or links; restricted review accounts may use passwords handled by our authentication provider.
Rental operations: property and booking details, guest contact information, calendars, tasks, messages, photos, uploaded files, house rules and agreements. These come from you, your rental operator, authorized team members or connected calendars and forwarded emails. We use them to coordinate stays and work, maintain records and deliver requested services.
Payments and evidence: subscription and booking invoices, service orders, payment references and status, fees, refunds, disputes, payouts and agreement acceptance. Stripe collects card, identity-verification and bank details in its own forms. HoztSync does not ask you to enter raw card numbers, SSNs or bank credentials into its own forms. We keep the references, limited payment-method details and transaction records needed to operate and reconcile payments.
Messages and support: sign-in emails, invitations, invoices, reminders, work notifications and support correspondence. Forwarded booking emails are kept for manual review. Delivered emails may remain in the recipient’s inbox.
Technical and security records: request times, browser/device information, IP addresses where supplied, authentication and error records, and audit events. Some acceptance records include a timestamp and IP address. We use these to protect accounts, investigate problems and document actions.

Where European data-protection law applies, we rely on providing the service you request, legal obligations, and legitimate interests in running, securing and supporting the service, balanced against your rights. Optional analytics requires consent. The rental operator determines the appropriate basis for its rental records. Information needed to sign in or perform a requested transaction is required for that function; optional photos and alerts are your choice.

AI-assisted email reading, reply drafting and generated summaries are disabled in this release. These features do not send your content to an AI model. We do not use them to make decisions about you.

Who can access information

Workspace access depends on current membership, role, property access and task or stay assignment. Guests see their own stay information; owners and staff see information relevant to their authorized work. Administrators manage their workspace. Restricted retained evidence has separate access controls and is not an ordinary workspace view. Authorized support and service providers may access information needed for their work; legal disclosure may be required by a valid legal request.

Our service providers include:

Supabase for authentication, database and file storage.
Vercel for hosting and delivery, including technical request and security records.
Resend for sending and receiving service emails; Google Workspace for our support inbox.
Stripe for HoztSync subscriptions, direct-booking and additional-service payments, connected-account verification, bank linking and payouts. Stripe also processes information for its own payment, fraud-prevention and legal purposes.
Apple and your browser’s push service for optional notifications.

Providers may process information in the United States and other countries. Applicable provider data-processing terms include transfer safeguards such as standard contractual clauses where required. You can ask us for information about the safeguards applicable to your data. Selecting a hosting or email-sending region does not mean every provider copy stays in that region.

Cookies, analytics and the iPhone app

We use necessary cookies and browser storage for sign-in, workspace selection, security and saved preferences. Blocking these can prevent sign-in or other requested functions.

Google Analytics and Vercel Web Analytics collection are disabled in this private-pilot release, including custom usage events. Personal onboarding milestone collection is also paused. Historical usage records may remain subject to deletion requests. Operational audit records and hosting/security logs still exist. We may review aggregate search-performance reports for our public website; those reports do not require an analytics script in your browser.

If optional analytics is introduced, we will update this notice and present the applicable choice before collection. We do not claim a current Google retention setting. Historical Google Analytics data follows Google’s separate retention controls; detailed-data settings do not govern all aggregate reports. Stopping collection or removing cookies does not erase information already received by Google. See Google’s retention explanation and privacy policy.

The iPhone app loads the hosted HoztSync service, so this notice applies there too. Optional push alerts use a device token linked to your account and a notification destination; Apple or the browser push provider delivers them. You can turn alerts off through Account or device settings. Photo and camera access is used only when you choose to attach a file. Delivered alerts and files you have downloaded may remain on your device.

How long we keep information

Cancelling a subscription does not delete your account or workspace. Operational information remains available for its service purpose until a deletion request is completed or its specific retention rule applies.

Exports: downloads expire after 7 days; scheduled cleanup removes the stored copy. A copy you downloaded is under your control.
Abandoned uploads: unattached files become eligible for cleanup after 24 hours, once we check that they are not used or needed as evidence.
Routine copies: resolved raw imported emails, completed rendered notification copies and finished routine worker records become eligible after 30 days. Unresolved work, required evidence and applicable holds are excluded. This is not a universal limit on every audit or provider log.
Necessary financial and contractual evidence: selected invoices, transaction facts, accepted agreements and supporting originals are retained separately with restricted access. Our baseline is 7 years, with longer applicable requirements, including at least 10 years for covered Dominican records. The clock depends on the relevant tax filing, book, settlement or other applicable event. This is not a seven-year archive of every guest profile or message.

Legal holds and unresolved financial obligations can extend retention of the affected evidence. Missing dates or records require review rather than an invented expiry. Cleanup runs in scheduled batches and retries failures, so eligibility is not a promise that every byte disappears at that instant.

Providers, backups, support mail, public caches and recipients’ copies have separate retention and deletion processes. We do not promise that app deletion immediately erases every external copy. Stripe may retain payment and verification records for its legal obligations. Deletion records are kept with restricted access to prevent removed data from being restored to use.

Deletion and your rights

Use Account → Delete account to request personal account deletion, or contact us. Workspace administrators can export information and request workspace closure. Personal access can be shut down while required business evidence or provider follow-up remains; open obligations do not justify keeping your login active. A deletion receipt shows pending and completed steps.

Workspace closure removes ordinary workspace data once open obligations are handled and necessary evidence is preserved. Account deletion does not erase other people’s records or unrelated workspaces. Photos or files you contributed to shared workspace records may remain under those records’ permissions pending content review. A host may retain your name on a current or upcoming stay until it ends. Already-issued file links can remain usable until their expiry; new access is checked against current permissions. Downloads cannot be recalled.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You can withdraw consent without affecting earlier lawful processing, and complain to your data-protection authority, including Spain’s AEPD where relevant. Send requests to hello@hoztsync.com. We may need to verify identity or coordinate with your rental operator, and will explain any lawful restriction or extension. We aim to respond within 30 days and comply with any shorter applicable deadline.

Security and children

We use encrypted connections, provider storage protections and role-based access controls. No service can guarantee perfect security. Please do not upload payment credentials, identity-document images or other sensitive material unless specifically required through the appropriate provider’s secure process.

HoztSync accounts are intended for adults. Rental operators may record information about children in a travelling party where needed and lawful for a stay. We do not invite children to create accounts or knowingly use their information for marketing.

Changes

We will post changes here and, for material ones, email Customers 30 days ahead.