Host Haven

Privacy Notice

Last updated: 22 June 2026

This Privacy Notice explains how Host Haven Group Ltd, a company incorporated in England & Wales (company number 17255321), trading as "Host Haven" ("we", "us", "our"), collects, uses and protects your personal data when you use our website and application (the "Service"). Host Haven Group Ltd is the data controller for the personal data described below.

1. Personal data we collect

  • Account data — name, email address, password (hashed), profile details.
  • Property & booking data — property details and any guest information you choose to add (names, contact details, booking dates, messages).
  • Support data — messages, attachments and metadata when you contact us.
  • Usage & device data — log data, device identifiers, IP address, browser type, pages visited, feature interactions.
  • Marketing data — preferences and email engagement, where applicable.

Payment details (card number, billing address) are collected directly by our payment provider Paddle and are not stored by Host Haven.

2. Gmail integration

If you choose to connect your Gmail account to send guest communications directly from your own inbox, we access only the minimum data needed to provide that feature:

  • What we access — your Google account email address, the OAuth tokens required to send email on your behalf, and the recipient, subject and body of messages you explicitly choose to send through the Service.
  • Why we access it — to authenticate the connection, send the emails you initiate from the Service, and log sent communications against the relevant booking record.
  • What we do not do — we do not read the contents of your inbox, list received emails, download attachments from your mailbox, or collect email data beyond what is required to send the communications you authorise.
  • Scope limitation — we request only the https://www.googleapis.com/auth/gmail.send OAuth scope (and any supporting scopes strictly needed to maintain the connection). We do not request broad mailbox access.

You can disconnect Gmail at any time from Settings. On disconnect, we revoke our access and delete the stored tokens and email address from our systems.

3. How and why we use your data

  • Provide the Service — create your account, run your properties, send transactional emails (legal basis: performance of a contract).
  • Gmail send functionality — when you connect Gmail, to transmit the emails you compose in the Service through your Gmail account (contract / consent, depending on jurisdiction).
  • Customer support — respond to questions and troubleshoot (legitimate interests / contract).
  • Security & fraud prevention — detect and prevent abuse, secure our systems (legitimate interests / legal obligation).
  • Product improvement & analytics — understand how the Service is used so we can improve it (legitimate interests).
  • Marketing — send updates and offers you can opt out of at any time (consent or legitimate interests, depending on your jurisdiction).
  • Compliance — meet legal, tax and regulatory obligations (legal obligation).

4. Who we share data with

  • Service providers / subprocessors — cloud hosting, database, email delivery, analytics and customer support tooling, acting on our instructions under written agreements.
  • Google (Gmail integration only) — when you connect Gmail, we exchange OAuth tokens and send email through Google's Gmail API on your behalf. Google processes this data under its own terms and privacy policy.
  • Merchant of Record (Paddle) — for sale of subscriptions, subscription management, payments, tax compliance and invoicing.
  • Professional advisers — legal, accounting and audit, when necessary.
  • Authorities — where required by law or to protect our rights.

5. International transfers

Some of our service providers are located outside the UK / EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent UK transfer mechanisms.

6. Retention

We retain personal data for as long as your account is active and for a reasonable period afterwards to comply with our legal obligations, resolve disputes and enforce our agreements. When data is no longer needed, we delete or anonymise it.

7. Your rights

Depending on where you live, you may have the right to:

  • access the personal data we hold about you;
  • request correction or deletion;
  • restrict or object to processing;
  • request portability of your data;
  • withdraw consent at any time, without affecting prior processing;
  • lodge a complaint with your local data protection authority.

To exercise these rights, email admin@gethosthaven.com. We aim to respond within one month.

8. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls and least-privilege practices — to protect personal data against unauthorised access, alteration, loss or disclosure.

9. Cookies

We use essential cookies to keep you signed in and the Service working, and limited analytics cookies to understand usage. You can control non-essential cookies through your browser or, where shown, our cookie banner.

10. Changes

We may update this Privacy Notice from time to time. We'll post the new version here and update the date above. Material changes will be notified in-app or by email.

11. Contact

Questions or concerns? Contact us at admin@gethosthaven.com.