Privacy Policy

1. Who we are

hostOPZ is provided by PT Island Dream Collective, Office Kembali Hub, Jl. Sunset Road No. 28, Kuta, Badung, Bali 80361, Indonesia. For privacy questions or requests, contact hello@islanddreamcollective.com.

2. Two different roles

• Your account and this website. For information about you as a customer (your name, email, billing) and about visitors to hostopz.com, we decide how it's used and are responsible for it.
• Your business's data. For personal data you bring into hostOPZ about your guests, staff and villa owners, your business decides how it's used, and we process it only on your instructions to provide the service. Guests and owners with questions about their data should contact the business that manages their stay or villa first; we'll help that business respond.

3. What we collect

• Account details: business name, your name, email address, a securely hashed password, and the logins you create for your team and owners.
• Billing details: invoices, amounts and payment status. Payments are handled by Xendit; we never see or store full card details. If you turn on automatic payments, we keep the reference Xendit gives us for your saved card (not the card number), encrypted, and delete it when you turn automatic payments off or cancel.
• Business data you connect or enter: bookings from your PMS (including guest names, contact details, dates and amounts), guest conversations (messages read from your PMS or written on a guest's check-in page, and the messages and notes your team adds), income, expenses, receipts and photos, maintenance issues, staff schedules, property details such as check-in instructions and WiFi, and owner reports. PMS credentials are stored encrypted.
• Usage and security data: sign-in attempts and IP addresses (to protect accounts against guessing and abuse), an audit log of important changes, and error reports.
• Website visitors: if you accept analytics cookies, Google Analytics and the Meta Pixel record how you found and used this site. If you then start a trial or pay your first invoice, our server tells Google and Meta, so we can see which of our ads work. Your email address goes to them only in scrambled (hashed) form, with your browser's analytics IDs. If you decline, none of this happens.
• Where you came from: when you sign up, we note the website or ad campaign that brought you (for example "instagram / founder video"), so we know which of our marketing works.

4. How we use it

• To provide hostOPZ: show your dashboard, sync your bookings and guest conversations, send the guest messages you write through your PMS, send the emails and notifications you've set up (such as maintenance alerts and owner payout summaries), and run features you use, like guest check-in pages.
• To bill you and keep financial records.
• To keep the service secure, prevent abuse and fix problems.
• To tell you about changes to the service or these terms. We'll only send marketing emails if you've agreed, and you can opt out at any time.

We don't sell personal data, and we don't use your business's data to train AI models or for advertising.

5. Service providers we use

These companies process data for us to run hostOPZ, under agreements that require them to protect it:

hostOPZ also connects to the PMS you choose (such as Lodgify, Beds24 or Smoobu) using credentials you provide. That company's own privacy policy covers the data it holds. Some of these providers are outside your country; where the law requires it, we rely on appropriate safeguards for those transfers.

6. How long we keep it

• Account and business data: while your account is open. After you close it, we delete your workspace data within 30 days of your written request.
• Invoices and billing records: as long as tax law requires, typically 10 years.
• Sign-in and security records: up to 12 months. Rate-limiting records are deleted after a day.
• Backups: encrypted database backups are kept for up to 30 days, then deleted.

7. How we protect it

• Everything is sent over encrypted connections (HTTPS).
• Each customer's data is kept separate and checked on every request on our servers; the database refuses all direct public access.
• PMS credentials are encrypted at rest; passwords are stored only as secure hashes.
• Guest check-in links are signed so they can't be guessed; sign-in and other sensitive requests are rate-limited.

No system is perfectly secure. If a breach affects your data, we'll tell you without undue delay and as the law requires.

8. Your rights

Depending on where you live — including under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and, where it applies, the EU or UK GDPR — you can ask to access, correct, export or delete your personal data, object to or restrict how it's used, and withdraw consent. Contact hello@islanddreamcollective.com. You can also complain to your local data protection authority.

9. Cookies

The hostOPZ app uses your browser's storage to keep you signed in and remember preferences such as the currency you view amounts in; that's needed for it to work. This website only loads Google Analytics and the Meta Pixel if you accept them in the cookie banner. If you accept, the "Start free trial" links also carry their IDs to the signup page, so a trial can be matched to the ad that led to it. Change your cookie choice.

10. Children

hostOPZ is a business service and isn't meant for children. We don't knowingly collect children's data except where a business records a booking that includes them.

11. Changes

We'll update this policy when what we do changes, and email customers about significant changes before they take effect.