Privacy Policy

This policy explains what personal data Hostoa ("we") collects when you visit hostoa.com or use our services, why, who we share it with, and the choices you have. For the Hostoa services we are the "controller" of your data. Questions: [email protected]. Hostoa is owned by Pofii Cloud Group.

1. What we collect

Account and billing. Your email address, name, optional company and billing address, username, your sign-in history (last sign-in time and IP address), your preferred currency, and a profile photo if you add one. Payments are handled by Stripe; we receive payment status and limited card details (such as the last four digits and a card fingerprint used to prevent abuse), never the full card number.

Your services. Websites and domains you add, plan and credit history, support tickets and messages, API tokens (stored hashed), team members you invite, and the registrant contact details you give us for domains (name, address, phone, email).

What you host. The files, databases and email on your websites are your content. We process them only to provide the service.

Free Perks and partner services. If you use the AI website builder, the text you type is sent to our partner Themecut to create your site. If you claim uptime monitoring, we show you a link or code for StatusSpy. If you join the Gelmy waiting list we store that you did. If you send a quote request for the Kickbytes offer, we pass what you wrote, your email and budget to our team and to Kickbytes so they can reply.

Chat assistant. If you use the "Ask us" chat, what you type is sent to our AI provider (Anthropic) to produce an answer. Please do not put passwords or sensitive information in it. Ticket first replies may also use AI.

Usage and security. We keep server logs and use security and fraud checks. Our own analytics record page views and actions on our site: a hashed visitor identifier, the page, referrer, UTM tags, country (and city if available), device, browser and system, and a shortened IP address (its last part is blanked). We do not store full IP addresses in analytics, and without your consent we use a visitor identifier that changes every day, so we cannot follow you across days.

Cookies and similar storage. See section 7.

Emails. Records of the emails we send you, so we can show support what you received.

2. Why we use it and our legal bases

• To provide the services and run your account (setting up websites, billing, support): performance of our contract with you.
• To keep Hostoa safe and prevent fraud and abuse (for example checking that a welcome offer is not used repeatedly, rate limits, security logs): our legitimate interests in protecting our services and customers.
• To understand and improve our site with our own cookieless analytics: our legitimate interest in running and improving a service. Google Analytics and the cross-day visitor identifier only run if you accept analytics cookies: your consent.
• To email you important account, billing and security messages (contract and legitimate interests). Tips and reminder emails are sent to customers with a plan, and every one has an unsubscribe link: our legitimate interest, which you can object to at any time.
• To meet legal duties such as tax, accounting and responding to lawful requests.

3. Automated decisions

Some checks are automatic: for example, a welcome offer may be declined if it was already used with the same email, card or a disposable email address, or if the daily limit has been reached. This does not stop you buying a regular plan. If you think a decision was wrong, contact us and a person will look at it.

4. Who we share data with

We use trusted providers to run Hostoa, each only for its purpose:

• Stripe – payments and subscriptions.
• Google (Google Workspace mail) – sending our emails.
• Our hosting and server-panel infrastructure – to create and run your websites in the region you choose.
• Spaceship – our domain registrar, which receives the registrant details for the domains you register or transfer, and passes them to the domain registry as the rules require.
• Anthropic – the AI provider for the chat assistant and ticket replies.
• Pofii Group partners – Themecut (AI website builder), StatusSpy (uptime monitoring) and Gelmy (lead finding), as described in section 1.
• Kickbytes – our sister company, only when you send a quote request.
• Google – Google Analytics only if you accept analytics cookies, and Google Fonts when a page that uses it is shown.

We may also share data when the law requires it, to protect rights and safety, or in a business transfer. We do not sell your personal data.

5. International transfers

Some providers are outside your country or the European Economic Area. Where that happens we rely on safeguards such as the European Commission's standard contractual clauses or an adequacy decision.

6. How long we keep data

• Account data: while your account exists, and afterwards for the time needed to resolve disputes and meet legal duties.
• Billing records: as long as tax and accounting law require.
• Services after cancellation or suspension: websites and their data are deleted about three weeks after a plan ends, unless you reactivate it.
• Support tickets: while your account exists, then for a reasonable period.
• Analytics records: about 13 months, then deleted.
• Security and server logs: a short period, normally weeks to a few months.

7. Cookies and local storage

• Necessary: your sign-in session, your language and currency choice, remembering that you closed a notice (such as the welcome offer), a referral code from a friend's link, and your cookie choice. These do not need consent.
• Analytics (only with your consent): Google Analytics, and a random identifier in your browser that lets our analytics recognise you across days. You can accept or decline in the cookie notice; declining does not stop you using Hostoa.
• We do not use advertising cookies.

You can clear cookies and site data in your browser at any time. To change your cookie choice, clear the Hostoa cookie data and the notice will appear again.

8. Your rights

Depending on where you live (for example under the GDPR) you can ask us to give you a copy of your data, correct it, delete it, limit or object to how we use it, move it to another provider, and withdraw consent at any time. Email [email protected] and we will answer within one month. You can delete your tips emails with the unsubscribe link, and you can ask us to close your account. If you are unhappy with how we handle your data, you can complain to your data protection authority.

9. Security

We protect data with encryption in transit, hashed tokens and one-time sign-in links, access controls, encrypted storage of server credentials and regular backups. No system is perfectly secure; if there is a breach that affects you we will tell you as the law requires.

10. Children

Hostoa is not for people under 18, and we do not knowingly collect data from children.

11. Changes

We may update this policy. We will post the new version here and, for significant changes, tell you by email or in the dashboard.

12. Contact

Hostoa. Email: [email protected].

Effective 19 October 2026.