HOSTANDO PRIVACY POLICY

1. Who we are and when we are the controller

Hostando is provided by IOANNIS DIMITRIOS MATHIOUDAKIS, son of Georgios, a sole proprietorship trading as “STACKNUP”, Tax Identification Number (ΑΦΜ) 159559260, Rethymno Tax Office, General Commercial Registry (ΓΕΜΗ) number 196997650000, based in Erfoi, Rethymno, postcode 74052 (“STACKNUP” or “we”). Contact for data matters: info@stacknup.com.

STACKNUP has two roles, and this policy concerns only the first:

• Controller of the data we need in order to run Hostando as a business: user accounts, demo requests, invoicing our customers, and support.
• Processor of whatever a property management company enters into Hostando (owners, guests, reservations). For that data the company is the controller, and its own privacy notice applies. If you are an owner or a guest, contact the company that serves you; if you write to us, we will forward your request to that company.

2. What data we process as controller

• Hostando users (employees and associates of our customers)

  What: Full name, email, department and role, language, profile photo if you add one, sign-in and security details (when you signed in, from which IP address and device).

• People who request a demo on hostando.com

  What: Company name, full name, email, phone, number of properties, anything you note for us, and our replies.

• Customers (companies), for invoicing

  What: Company name, tax identification number (ΑΦΜ), tax office (ΔΟΥ), address, billing email, subscription, payments and invoices.

• People who contact support

  What: The messages, and anything you send us so that we can help you.

• Users of the digital assistant (Ando)

  What: Who asked, when, what it cost and whether the answer was completed. We do not store the text of the questions and answers.

3. Why, and on what lawful basis

• Operating the accounts and providing the service to our customer

  Lawful basis (GDPR): Performance of the contract with the customer (Article 6(1)(b)) and the legitimate interest of the customer and of ourselves in giving access to the users the customer designates (Article 6(1)(f))

• Replying to a demo request, and the offer

  Lawful basis (GDPR): Steps taken at your request before entering into a contract (Article 6(1)(b))

• Invoicing and keeping tax records

  Lawful basis (GDPR): Legal obligation (Article 6(1)(c))

• Security, preventing abuse, the assistant's usage limits, and support

  Lawful basis (GDPR): Legitimate interest (Article 6(1)(f))

We do not sell data, we do not use it for advertising, and we do not make automated decisions that affect you.

4. Cookies

Hostando uses only strictly necessary cookies: to keep you signed in, for your language, and for the company you are working in when you have access to more than one. It does not use analytics, advertising or third-party cookies; that is why it does not ask for your consent.

5. Who we share it with

With the providers we use to run the service, each only for its own task and under a data processing agreement:

• Supabase

  For what: Database, accounts, files

  Where: EU (Frankfurt)

• Vercel

  For what: Hosting the application

  Where: EU (Frankfurt); a company based in the USA

• Resend

  For what: Sending email

  Where: EU (Ireland); a company based in the USA

• Cloudflare

  For what: Backups of the files

  Where: EU

• Google

  For what: The support mailbox

  Where: EU / USA

• Papaki

  For what: Domain name and email of hostando.com

  Where: Greece

• Anthropic

  For what: The digital assistant (Ando), only for customers who switch it on

  Where: USA

• Meta

  For what: The WhatsApp Business connection, only for customers who connect it

  Where: EU (Ireland) / USA

• Routee

  For what: Viber and SMS messages, only for customers who connect them

  Where: EU

Also with our accountant and the tax authorities for invoicing, and with public authorities when the law requires it.

6. Transfers outside the European Union

Where a provider is based in, or has access from, a country outside the EU, the transfer is made with the safeguards of the GDPR: an adequacy decision (for the USA, the EU–US Data Privacy Framework, where the provider is certified) or the standard contractual clauses of the European Commission.

7. How long we keep it

• User accounts: for as long as the user has access and the customer works with us; afterwards they are deleted together with the customer's data, as the customer's contract provides.
• Sign-in and security details: twelve (12) months.
• Demo requests that did not lead to a cooperation: twelve (12) months.
• Invoices and payments: for as long as tax law requires.
• Support messages: three (3) years.

8. Your rights

You have the right of access to your data, and the rights to rectification, erasure, restriction of processing, portability and objection, where they apply. Write to us at info@stacknup.com; we will reply within one month. If you are a user of one of our customers, we handle some requests (e.g. deleting your account) in consultation with the customer, because the customer decides who has access. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

9. Security

Data is encrypted in transit and at rest. Each company sees only its own data, and this is enforced by the database itself, not only by the application. Within a company, each user sees what their permissions allow, and every action is recorded with the name of the person who performed it. We keep daily backups.

10. Minors

Hostando is a professional tool and is not intended for persons under 18.

11. Changes

We may update this policy; for a material change we will inform our customers in advance. Last updated: 24 October 2026.