Privacy notice

Last updated 16 October 2026

This notice explains what information HostTab keeps, why we keep it, and the choices you have. It covers the HostTab app and this website.

What the app keeps

• Your account: your email address and the settings you choose.
• Your properties: property names, country, rates, the owner's name for statements, the payment details you share with guests (such as your M-Pesa Paybill), and the Wi-Fi and check-in details you add.
• Your records: bookings, guest names and phone numbers, payments, expenses, cleaning and maintenance notes and photos that you, your co-hosts or your cleaner add.
• Your team: the co-hosts you invite and their role on your account, and the cleaners you list.
• Your subscription: the passes you buy, the M-Pesa confirmation codes and receipts linked to them, and any license key. We never ask for your card or bank details to pay for HostTab.

Why we keep it

Only to run HostTab for you: to show your bookings and figures, sync them across your devices, let your co-hosts and cleaner work with you, switch on the passes you pay for, and remind you when your trial or pass is ending or has ended. We do not sell your information and we do not use it for advertising.

Who can see it

• You, and the co-hosts you invite to your account. Your cleaner's link shows only the coming check-outs (about two weeks ahead): guest first names, how many guests and your cleaning notes, never prices, payments or phone numbers.
• Each account's records are kept separate and are never shared with other hosts.
• If you signed up with a creator's code, that creator sees how many hosts joined with their code and, for each pass bought, its date, its length and the creator's fee. They never see your name, contact details or records.
• We look at account details when you ask for help, when needed to fix a problem with your account or payment, and to remind you when your trial or pass is ending or has ended.

Where it is stored

The app stores your information with Google Firebase, a cloud service run by Google. The app and this website are hosted by Netlify.

Guest information

When you record a guest's details, you are the one deciding to keep them. Record only what you need to manage the stay, and remove details you no longer need. You can edit or delete any booking in the app.

How long we keep it

We keep your information while your account is open. Cleaning photos are deleted after 60 days, or after the period you choose in the app's settings (30 to 90 days). If you ask us to delete your account, we delete your records. Export a backup first if you want to keep a copy.

Your choices

You can ask us for a copy of your information, ask us to correct it, or ask us to delete it. Message us on WhatsApp. Under the Data Protection Act, 2019, you can also raise a concern with the Office of the Data Protection Commissioner in Kenya.

This website

• This website uses no cookies, and it loads nothing from other companies: no fonts, no trackers, no adverts.
• Netlify keeps standard server logs.
• A creator's link opens the creator's page in the HostTab app. That page counts how many times the link is opened, at most once a day per browser, using a note it keeps in your browser. It keeps no visitor IDs.

Visit counts

To see whether the website is working, it counts visits anonymously. At most once per visit, it counts opening the home page, seeing the prices, tapping Start free trial, tapping WhatsApp, tapping Send me this quote under the price calculator and tapping share. The quote itself (your number of properties and the pass) goes only into your WhatsApp message, never to our server.

• Each count carries only how the visit arrived, such as a search engine, WhatsApp or social media. How the visit arrived is worked out in your browser. The address of the page you came from is never sent.
• Our server adds one to that day's totals and keeps nothing else: no cookies, no visitor IDs, no IP addresses and nothing you type. Your connection's address is used for a few minutes, in memory only, to stop one device inflating the counts.
• Your browser keeps a note for that visit so the same visit is not counted twice. It is cleared when you close the tab.
• Browsers set to Global Privacy Control or Do Not Track are not counted.
• Daily totals are deleted after 400 days.

Changes

If we change this notice in a way that matters, we will update the date above and tell you on WhatsApp.

Contact

For anything about your information, message us on WhatsApp. See also our terms of use.