1. Data controller
The controller is Marcin Konrad Pawlak, sole trader (autónomo), NIF: Y4858428Z, address: Calle Roque de los Muchachos 10, 38679 Adeje, Santa Cruz de Tenerife, España, trading as Huespo. For anything about personal data: contact@huespo.app.
2. Who this policy covers
- Hosts with a Huespo account (app.huespo.app).
- People who contact us (the form on huespo.app, e-mail, WhatsApp, SMS).
- Guests who open a guide link. We don't collect any data from Guests apart from the technical data described below. The Host is responsible for the data they put in their guide (section 11 of the Terms).
3. What data we process
- Account: e-mail address, password (stored only as an encrypted hash); with Google sign-in, the e-mail address and Google account ID; the date the Terms were accepted and the newsletter choice.
- Subscription and billing: chosen plan, payment status, country, Stripe customer and subscription IDs; billing details entered in Stripe checkout (name or company name, address and, where given, tax/VAT number). We never see full card details — Stripe processes them.
- Properties: the content the Host enters in the panel (name, address, instructions, codes, photos, logo, contact details).
- Contact: name, e-mail address or phone number and the message.
- Post-trial survey: the answers, if the Host fills it in.
- Technical data: IP address, browser and device type, server and security logs — also when a Guest page is opened.
4. Purposes and legal bases
- Providing the service: account, panel, Guest pages, free trial, payments, e-mails about the account and plan (e.g. trial-ending reminders) — performance of a contract (Art. 6(1)(b) GDPR).
- Answering messages and support — steps at the person's request before a contract, or performance of a contract (Art. 6(1)(b) GDPR).
- Invoices, accounting and tax — legal obligation (Art. 6(1)(c) GDPR).
- Security, abuse prevention (e.g. checking that a password hasn't been leaked), aggregated statistics and improving the service — legitimate interests (Art. 6(1)(f) GDPR).
- Information about similar Huespo services sent to our customers — legitimate interests (Art. 6(1)(f) GDPR and Art. 21.2 of the Spanish LSSI). Every such e-mail has an unsubscribe link and you can object at any time.
- Newsletter — consent given at sign-up (Art. 6(1)(a) GDPR), which you can withdraw at any time.
5. Who we share data with
We use trusted providers that process data on our behalf under GDPR-compliant agreements:
- Lovable (Lovable Labs Sweden AB, Sweden) — the platform the app runs on, and sending system e-mails (account confirmation, reminders).
- Supabase, Inc. — database, sign-in and photo storage (as part of Lovable Cloud).
- Cloudflare, Inc. — app hosting, content delivery network and attack protection.
- Stripe Payments Europe, Limited (Ireland) — payments, invoices and the billing portal. Stripe also processes some data as an independent controller (e.g. to prevent fraud) — see stripe.com/privacy.
- Resend (Plus Five Five, Inc.) — sending the welcome e-mail.
- Zoho Corporation (Zoho Mail, EU data centre) — the contact@huespo.app mailbox.
- Netlify, Inc. — hosting huespo.app and its contact form.
- Google — Google sign-in (only if the Host uses it) and website fonts (Google Fonts).
- WhatsApp (Meta) — only if someone contacts us on WhatsApp.
- Accountant (gestoría) — invoice data, as required by law.
- Public authorities — only when the law requires it.
We don't sell data or share it for advertising.
6. Transfers outside the EEA
Some providers (e.g. Cloudflare, Supabase, Netlify, Resend, Google) are based in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
7. How long we keep data
- Account and properties — until the Host deletes them or asks for the account to be deleted. We don't delete properties automatically when a plan ends, so you can come back to them.
- Invoices and billing data — for the periods required by tax and commercial law (up to 6 years).
- Messages and enquiries — up to 12 months after the conversation ends.
- Newsletter and service information — until you withdraw consent or object.
- Technical logs — usually a few weeks, unless needed to investigate a security incident.
8. Your rights
You have the right to access your data and get a copy, to rectification, erasure, restriction, portability, to object to processing based on legitimate interests, and to withdraw consent at any time. Write to contact@huespo.app — we reply within one month.
You can also complain to the Spanish Data Protection Agency (aepd.es) or to the data protection authority in your country.
9. Cookies and device storage
We don't use advertising or tracking cookies or analytics tools that profile users. We only use device storage that is strictly necessary for the service, so we don't show a consent banner:
- Host panel — sign-in session data and small settings (e.g. whether the survey has been shown).
- Guest page — a copy of the guide and its photos saved on the Guest's device so it works offline. The copy stays only on that device; the Guest can remove it by clearing the site's data in their browser.
- huespo.app — the language chosen for the website.
10. Security
Connections are encrypted (HTTPS), passwords are stored only as encrypted hashes, at sign-up we check that the password doesn't appear in known data leaks, and access to data in the database is limited to the account owner.
11. Minors
Only adults can create a Huespo account.
12. Changes to this policy
We will e-mail you about material changes. The current version is always on this page.