This policy explains which personal data we process, why, on what legal basis, and how you can exercise your rights. It is governed by Costa Rica's Law No. 8968 and, where applicable, by the EU General Data Protection Regulation (GDPR) and US privacy laws, including California's CCPA/CPRA.
1. Who is the controller
Hostli is a brand of Infinet Media, Costa Rican legal entity no. 3-102-812294 (“Infinet”, “we”), based in Costa Rica. Infinet is the controller of the data collected on hostli.app and of our business customers' data.
For any privacy matter, email us at hi@hostli.app.
2. Scope and our customers' sites
This policy applies to hostli.app, demo requests, and our relationship with the hotels, rentals and operators that subscribe to Hostli (“Customers”).
Our Customers' websites and booking engines run on Hostli, but each Customer is the controller of its guests' data. In those cases Infinet acts as a processor: it processes data only on the Customer's instructions and to provide the service. If you booked on one of those sites, please review the hotel's privacy policy and send your requests to the hotel; we will help them respond.
3. Data we collect
- Data you give us: name, email, phone, company, role and the message you send when requesting a demo or contacting us.
- Customer data: legal name, tax ID, billing address, signer and contact details, and the information needed for invoicing.
- Account data: email and dashboard login credentials (passwords are stored hashed; we never see them).
- Technical data: IP address, browser and device type, pages visited and server logs needed for the security, operation and improvement of the site.
- Payments: processed by ONVO. Hostli does not store full card numbers.
We do not collect sensitive data (health, religion, ethnic origin or similar) and we do not use targeted advertising or behavioral profiling.
4. How we use it and legal basis
| Purpose | Legal basis |
|---|---|
| Respond to demo requests and inquiries | Your consent and pre-contractual steps |
| Provide the service, support and invoicing | Performance of a contract |
| Protect the platform, prevent fraud and keep security logs | Legitimate interest |
| Meet accounting, tax and legal obligations | Legal obligation |
| Send product updates to customers | Legitimate interest; you can unsubscribe at any time |
Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
6. International transfers
Some providers process data outside Costa Rica, mainly in the United States. When data originates in the European Economic Area or the United Kingdom, these transfers rely on the European Commission's Standard Contractual Clauses or other valid mechanisms, together with technical measures such as encryption.
7. How long we keep it
- Demo requests that do not become customers: up to 24 months from the last contact.
- Customer data: for the duration of the contract and then as long as accounting and tax law requires (up to 5 years).
- Technical and security logs: up to 12 months.
- Guest data on Customer sites: per the Customer's instructions; returned or deleted when the service ends.
8. Security
We use encrypted connections (HTTPS/TLS) across the site, database-level data isolation between customers, role-based access control, hashed passwords and daily backups. If an incident affects your data, we will notify you and the competent authority within the timeframes required by law.
9. Your rights
Depending on where you live, you have the right to:
- Access your data and know how we process it.
- Correct inaccurate or incomplete data.
- Delete your data when it is no longer needed.
- Object to processing or ask us to restrict it.
- Receive your data in a portable format.
- Withdraw your consent at any time.
- In California: know, delete, correct and opt out of the sale or sharing of data (we do not sell it), without discrimination for exercising your rights.
To exercise them, email hi@hostli.app. We will respond within 5 business days under Law 8968, 30 days under the GDPR, or 45 days under the CCPA. We may ask for information to verify your identity. You may also file a complaint with Costa Rica's Data Protection Agency (PRODHAB) or with the data protection authority in your country.
10. Children
Hostli is a business service and is not directed to anyone under 18. We do not knowingly collect data from minors; if we find any, we will delete it.
11. Changes to this policy
We may update this policy. We will post the current version on this page with its update date and, for material changes, notify our customers by email.
12. Contact
Infinet Media, Costa Rican legal entity no. 3-102-812294. Costa Rica. Email: hi@hostli.app.