This document is available in Spanish and English with the same content. In case of any discrepancy, the Spanish version prevails.
Privacy Policy
Last updated: October 2026
Short version: in case you are short of time
HostMasters is a small local team in Almuñécar (Costa Tropical, Granada) that manages holiday rental homes as a co-host on Airbnb and Booking.com. Below we summarise the key points according to your relationship with us:
I. As an Owner who contracts our service
- HostMasters, trade name of Yuri Rodolfo Alves Sales de Almeida (sole trader, NIF Z3680371P), Almuñécar, Granada, España is the controller of the personal data you provide when you sign up to the Starter plan or the Plus plan.
- We will process your data to manage your listings and your property, coordinate cleaning and services, issue your invoices and collect our fees. Depending on your contract arrangement, either Airbnb and Booking pay you directly and we charge our fees to your card (via Stripe), or we receive the platform payments on your behalf into a client funds account, deduct our fees and transfer the balance to your IBAN monthly (collection mandate).
- We will send you operational communications about your property (bookings, statements, cleaning, maintenance). We will only send you marketing communications about services similar to those you already use, and you can unsubscribe at any time.
- We will share only the strictly necessary data with our providers (Stripe, Vercel, Neon, Anthropic, etc.) and with the authorities when required by law.
- You can access, rectify or erase your data at any time, as well as exercise other rights (we explain these further on).
II. As a service provider working with us
- We will process your data to manage your working relationship with HostMasters (cleaning, laundry, maintenance, gardening, pool or any other services we request from you): task assignment, photographs verifying the work, and weekly payment for approved work.
- To check that you can legally invoice HostMasters and to pay you, we keep a copy of your identity document, your NIF/NIE (Spanish tax identification number), proof of your registration as self-employed and your IBAN. Only HostMasters administrators have access, and they are kept in private storage.
- You can access, rectify or erase your data at any time, as well as exercise other rights.
III. As a Guest staying at a managed property
- Our team submits your data to the traveller register (SES.Hospedajes, Ministry of the Interior) on behalf of the owner, who is the party legally obliged to do so, and assists you during your stay through our AI chat.
- Your registration data is kept for the legally required period. Conversations with the AI chat are deleted after 90 days.
IV. As an enquirer or referral programme partner
- If you ask us for information (form, email, WhatsApp or phone), we process your contact details to reply to you. We may call you with our AI voice assistant to understand your situation (you can decline the call); the transcript is kept for a maximum of 12 months.
- If you take part in the referral programme, we process your identification, tax and bank details to calculate and pay your commissions.
It is important that you know:
We recommend that you read this full Privacy Policy to understand in detail what data we use, for what purpose and for how long we keep it.
This Policy may be updated. Material changes will be communicated by email and by notification on the platform.
Contents
- Data controller
- Categories of data
- Purposes of processing and legal basis
- Recipients
- International transfers
- Retention period
- Automated decisions (Art. 22 GDPR)
- Data subject rights
- Data of minors
- Cookies
- Confidentiality and security
- Changes
1. Data controller
Controller: HostMasters, trade name of Yuri Rodolfo Alves Sales de Almeida (sole trader, NIF Z3680371P), Almuñécar, Granada, España (“HostMasters”).
Privacy contact: For any matter relating to the processing of your personal data, including exercising your rights or making a complaint, you can contact us at: privacy@hostmasters.es.
Data Protection Officer (DPO): Appointing a DPO is not currently required under Article 37 of the GDPR and Article 34 of the LOPDGDD, as HostMasters does not carry out large-scale processing of special categories of data or regular and systematic monitoring on a large scale. Should our scale or a change in the law require it in the future, we will appoint a DPO and publish their contact details here.
Applicable law: General Data Protection Regulation (EU) 2016/679 (“GDPR”, in Spanish “RGPD”) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (Ley Orgánica de Protección de Datos Personales y garantía de los derechos digitales, “LOPDGDD”).
2. Categories of data
When you use our platform we may process the following categories of personal data, depending on your relationship with us:
2.1 Owners
| Category | Examples |
|---|---|
| Identification data | First name, surname, DNI/NIE/passport, NIF for invoicing, preferred language |
| Contact data | Email, phone number, postal address |
| Financial and tax data | NIF/NIE or tax identification number of your country, tax address, IBAN for the monthly transfer (collection mandate), Stripe customer ID, history of charges, invoices and settlements, booking records (amount received, commission and net). We never store card numbers: Stripe holds them. |
| Property data | Address, photographs, tourist licence (VUT), house rules, agreed minimum and maximum prices, smart lock codes (if there is one), maintenance status |
| Usage data | Use of the owner portal and conversations with the portal's AI assistant |
2.2 Service providers
Self-employed individuals who provide HostMasters with services of any kind (cleaning, laundry, maintenance, gardening, pool, etc.).
| Category | Examples |
|---|---|
| Identification data | First name, surname, NIF/NIE number, profile photograph |
| Compliance documentation | Copy of identity document (DNI, NIE or passport) and proof of registration as a self-employed worker (registration with the RETA and/or census declaration, Modelo 036/037) |
| Contact data | Email, phone number |
| Activity data | Tasks assigned and completed, photographs and checklists of the work, start and finish times |
| Financial data | IBAN for payment, invoicing data and weekly payments |
We do not request a certificate of being up to date with Social Security: keeping up to date with Social Security contributions and tax obligations is the sole responsibility of the service provider.
2.3 Referral programme partners and enquirers
| Category | Examples |
|---|---|
| Enquirers (leads) | Name, email, phone number, message, property details you give us, follow-up notes, AI analysis of the enquiry and, where applicable, the transcript and summary of the call with our voice assistant |
| Referral partners | Name or company name, tax identification, email, phone number, IBAN, referred owners and commissions earned and paid |
2.4 Guests
| Category | Examples |
|---|---|
| Identification data | Those required by the traveller register: name, nationality, identity document, date of birth, contact details |
| Stay data | Check-in and check-out dates, property, number of guests |
| Interaction data | Conversations with the guest AI chat and, where applicable, the feedback call after the stay |
3. Purposes of processing and legal basis
3.A) Processing necessary for the performance of the contract (Art. 6.1.b GDPR)
If you are an Owner:
- Management of your account and your owner portal
- Creation and management of your listings on Airbnb and Booking.com as a co-host (photos, description, calendar, messages and reviews)
- Nightly pricing using Airbnb Smart Pricing within the minimum and maximum you agree with us
- Collection mandate (the default arrangement): receipt of platform payments on your behalf into the client funds account, monthly settlement (with an invoice for our fees) and transfer of the balance to your IBAN
- Charging your card, via Stripe, for one-off services when you confirm them and, if you collect directly from the platforms yourself, for the monthly fee, plan commission (Starter or Plus) and cleaning, always with the corresponding invoice
- Monthly statement of bookings, amounts and charges
- Coordination of cleaning, check-ins, emergencies and maintenance
- Management of the smart lock where installed (temporary codes per guest and per task)
- Operational communication about your property
If you are a service provider:
- Assignment and management of tasks (cleaning, laundry, check-ins, maintenance, gardening, pool or other services)
- Photographic verification of the work carried out
- Calculation and weekly payment of approved work to your IBAN
- Verification of your documentation (identity document, NIF/NIE and self-employed registration) to check that you can legally invoice HostMasters for the services provided
If you are a referral programme partner: management of the partnership agreement, attribution of referred owners and monthly payment of your commissions.
If you ask us for information: replying to your enquiry and preparing a proposal (pre-contractual steps at the request of the data subject, Art. 6.1.b GDPR).
3.B) Compliance with legal obligations (Art. 6.1.c GDPR)
- Traveller register: submission of guest data to the Ministry of the Interior (SES.Hospedajes) in accordance with Real Decreto 933/2021 (Royal Decree 933/2021). Our team submits it on behalf of the owner, who remains the party bound by the obligation.
- Invoicing: issuing and keeping invoices in accordance with Spanish tax law.
- Service provider documentation: keeping service providers' tax identification (NIF/NIE), proof of self-employed registration and payment details, which is necessary to justify the invoices received and payments made to the Spanish Tax Agency (Ley 58/2003, General Tributaria, and the Código de Comercio).
- Requests from authorities: responding to requests from courts, tribunals, law enforcement agencies or other competent authorities.
The tourist licence (VUT) and the owner's tax returns remain the responsibility of the owner or their adviser; HostMasters only handles them when the owner contracts that one-off service (for example, the initial services kit or the annual Modelo 210).
3.C) Legitimate interest (Art. 6.1.f GDPR)
- Security and fraud prevention: monitoring the platform to detect unauthorised access or misuse.
- Service improvement: aggregated analysis of platform usage.
- Automated operational monitoring: daily checks on bookings, cleaning and charges to detect issues and alert our team.
- Qualification call to enquirers: a call from our AI voice assistant (which identifies itself as such) to anyone who has asked us for information, to understand their situation; they can decline it or object at any time. We always review the call before taking any decision.
- Feedback call after the stay: a short call to the guest to learn about their experience and improve the service; they can decline it or object at any time.
- Communications about similar services: we will inform you about services related to those you already use. You can unsubscribe at any time.
We have balanced these interests against your rights and freedoms: we use only the minimum data necessary, it is processing that can reasonably be expected within the existing relationship and we apply appropriate safeguards (restricted access and human review). You can object at any time (section 8).
3.D) Consent (Art. 6.1.a GDPR)
- Analytics and marketing cookies: Google Analytics 4 and Meta Pixel are only activated with your prior consent.
- Offers and news for guests: only if the guest ticks the specific box (unticked by default) on the registration form; see section 3.E.
You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
3.E) Guest data
When a guest stays at a home we manage, we process their data for two different and separate purposes:
- Traveller register (legal obligation, Art. 6.1.c GDPR): on their stay page the guest enters, for each adult, first name and surnames, document type and number (and support number for DNI/NIE), nationality, date of birth, sex and, for the lead guest, address, phone number and email. We use them to report the stay to SES.Hospedajes (Ministry of the Interior) under Real Decreto 933/2021 and to look after the stay (access, issues, check-out message and feedback). Providing them is mandatory by law; without them we cannot complete the registration. They are kept for 3 years from the end of the stay (see section 6) and are not used for marketing purposes.
- Offers and news (consent, Art. 6.1.a GDPR and Art. 21 LSSI, the Spanish Information Society Services Act): only if the guest ticks the separate box, which appears unticked, will we send offers and news about HostMasters holiday homes by email. Registration works in the same way without ticking it. We record the date, wording and language of the consent. It can be withdrawn at any time using the unsubscribe link included in every email or by writing to us; we keep this data while consent remains in force and, after unsubscribing, only the proof of the unsubscription for the limitation periods.
4. Recipients
4.1 Processors
| Provider | Purpose | Location |
|---|---|---|
| Stripe Payments Europe Ltd. | Card payments (fee, commission, cleaning and services) and invoices | EU (Ireland) |
| Vercel Inc. | Application hosting, CDN and private file storage (provider documents, photographs) | EU (Frankfurt); US company (EU-US Data Privacy Framework / Standard Contractual Clauses) |
| Neon Inc. | PostgreSQL database | EU |
| Resend Inc. | Sending transactional emails | EU |
| Anthropic PBC | AI features (guest chat, portal assistant, monitoring and translation) | US (Standard Contractual Clauses) |
| ElevenLabs Inc. | Guest feedback calls after the stay | US (Standard Contractual Clauses) |
| Nuki Home Solutions GmbH | Smart lock, where installed (temporary codes and entry log) | EU (Austria) |
| Twilio Ireland Ltd. | Telephony for voice calls and SMS notifications | EU (Ireland); US-headquartered group (EU-US Data Privacy Framework / Standard Contractual Clauses) |
| Google LLC (Google Workspace / Gmail API) | HostMasters mailbox: automatic reading of booking notifications from the platforms | US (EU-US Data Privacy Framework / Standard Contractual Clauses) |
| PriceLabs Inc. | Nightly price recommendations (property and calendar data; no guest data) | US (Standard Contractual Clauses) |
| Google LLC | Google Analytics 4 (only with consent to analytics cookies) | US (Standard Contractual Clauses, IP anonymisation) |
| Meta Platforms Inc. | Meta Pixel (only with consent to marketing cookies) | US (Standard Contractual Clauses) |
| Sentry Inc. | Error and performance monitoring | EU |
A data processing agreement in accordance with Article 28 of the GDPR has been signed with each provider.
Guest data: the owner is the controller of their guests' data and HostMasters acts as processor. Owners can consult the data processing agreement (DPA) or request it at privacy@hostmasters.es.
4.2 Disclosure to third parties
- Booking platforms: we share property data and availability with Airbnb and Booking.com to publish and manage the listings.
- Banks: Revolut Bank UAB (client funds account and payments to owners, service providers and partners) and Stripe, as independent controllers of their own processing (payment services and anti-money laundering regulations).
- Public authorities: Ministry of the Interior (traveller register) and, where legally required, the Spanish Tax Agency or other competent authorities.
We do not sell, rent or transfer your personal data to third parties for those third parties' own commercial purposes.
5. International transfers
Some of our providers (Anthropic, ElevenLabs, Google, Meta) are located outside the European Economic Area (EEA). We only transfer data to providers that:
- are located in a country with an adequacy decision from the European Commission (including the EU-US Data Privacy Framework where the provider is certified); or
- provide us with appropriate safeguards through Standard Contractual Clauses approved by the European Commission.
Some processors with data hosted in the EU (for example Vercel, Neon, Resend or Sentry) are US companies that could access it from the US to provide support; such access is covered by the same safeguards.
We also apply additional technical measures such as encryption in transit and data minimisation. You can request information about the applicable safeguards at privacy@hostmasters.es.
6. Retention period
| Type of data | Retention period | Reason |
|---|---|---|
| Account data (owners and service providers) | Until the account is deleted + 30 days | Contractual relationship |
| Copy of service providers' identity document (DNI, NIE or passport) | While the provider is active; deleted when their account is closed (anonymised) | Contractual relationship |
| Service providers' proof of self-employed registration (RETA / Modelo 036-037) | While the provider is active and, afterwards, 4 years from the last payment we made to them (tax limitation period, Ley General Tributaria art. 66); after that period it is deleted | Legal obligation and defence in tax inspections |
| Service providers' NIF/NIE and IBAN | While the provider is active; when the account is closed they are removed from it and the NIF is kept only on invoices and statements already issued (next row) | Contractual relationship and legal obligation |
| Invoices, settlements, statements and accounting records (including the recipient's tax details: name, NIF and address) | 6 years | Commercial and tax obligation (Código de Comercio art. 30; Ley General Tributaria). If you request deletion of your account, your data is anonymised and only the data appearing in these documents is kept. |
| Enquirers who do not go on to sign up | 2 years from the last contact | Handling the enquiry and commercial follow-up |
| Call recordings and transcripts (guest feedback and enquirer qualification) | 12 months (only the scores and summary are kept) | Service quality |
| Referral partners | For the duration of the agreement and, afterwards, the tax limitation periods (4 to 6 years) for payments made | Contractual relationship and tax obligation |
| Traveller register data | 3 years from the end of the stay | Legal obligation (Real Decreto 933/2021) |
| Guest contact details for offers and news | Until consent is withdrawn (afterwards, only the proof of unsubscription) | Consent |
| Guest AI chat conversations (the portal assistant only keeps the conversation in your browser while the tab is open) | 90 days | Providing and improving the service |
| Notifications | 90 days (read) / 180 days (unread) | Operations |
| Verification photographs of cleaning and work | 12 months | Quality and resolution of complaints |
| Analytics and marketing cookies | As set out in the Cookie Policy | Consent |
Once the retention period has ended, the data is kept blocked for the applicable statutory limitation periods (art. 32 LOPDGDD) and then permanently deleted.
7. Automated decisions
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We use the following automated tools, always with human review:
- Nightly price: calculated by Airbnb Smart Pricing, always within the minimum and maximum that the owner agrees with us. The owner can change those limits at any time.
- Operational monitoring: automatic daily checks that generate alerts for our team. No action is taken against owners, guests or partners without human review.
- AI chat: replies to guests and owners; any matter it cannot resolve is passed to our team.
You have the right to obtain human intervention, to express your point of view and to contest any decision that affects you. Write to us at privacy@hostmasters.es.
8. Data subject rights
Under the GDPR and the LOPDGDD, you have the following rights:
- Access: to know what personal data of yours we are processing.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to request the deletion of your data when it is no longer necessary or you withdraw your consent.
- Restriction: to request that we restrict processing in certain circumstances.
- Objection: to object to processing based on legitimate interest; we will stop processing your data unless there are compelling legitimate grounds.
- Portability: to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
- Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
- Not to be subject to automated decisions: in accordance with Article 22 of the GDPR.
How to exercise your rights
Erasure and tax documents: if you have invoices, settlements or quotes with us, when we delete your account we anonymise your data (name, email, phone number, IBAN, tax identification) instead of erasing those documents, which the law requires us to keep; invoices already issued retain the recipient details that appeared on them.
Write to privacy@hostmasters.es stating the right you wish to exercise and your name. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it.
Response time: one month from receipt of the request, extendable by a further two months for complex or numerous requests, in which case we will let you know within the first month.
Complaints: if you believe your right to data protection has been infringed, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): www.aepd.es.
9. Data of minors
The platform is not aimed at under-18s and we do not knowingly process personal data of minors, except for data of minor guests required by traveller register regulations, which is kept only for the legal period.
10. Cookies
We use essential cookies for authentication and language preference. Analytics cookies (Google Analytics 4) and marketing cookies (Meta Pixel) are only set with your prior consent.
See our Cookie Policy for the full list, duration and purpose of each cookie.
11. Confidentiality and security
We apply appropriate technical and organisational measures to protect your personal data:
- TLS encryption on all communications and passwords protected with bcrypt
- Protection against brute-force attacks (rate limiting) and security headers
- Role-based access control: each person only accesses the data they need for their task
- Service provider documentation (identity document, proof of self-employed registration, IBAN) in private storage, accessible only to HostMasters administrators
- Temporary smart lock codes (one per guest or per task, revoked when finished)
- Duty of confidentiality for the whole team and all partners
We recommend that you use strong passwords and do not reuse them on other services.
12. Changes
We may update this Privacy Policy to reflect changes in our practices, in the applicable law or in the services we offer. Material changes will be communicated by email to the address associated with your account and by notice on the platform. The “last updated” date at the top of the document shows the version in force.
Contact
Privacy: privacy@hostmasters.es
General email: info@hostmasters.es
Phone: +34 951 82 30 29
Postal address: HostMasters, trade name of Yuri Rodolfo Alves Sales de Almeida (sole trader, NIF Z3680371P), Almuñécar, Granada, España
Website: hostmasters.es