1. Introduction
KozyHost S.L. ("we," "us," or "our") operates the KozyHost platform (kozyhost.com), a multi-tenant SaaS platform for the hospitality and retail industries. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our back-office tools, storefronts, and integrations with third-party services.
This policy complies with the General Data Protection Regulation (GDPR), the Spanish Ley Orgánica 3/2018 (LOPDGDD), and the Ley 34/2002 de Servicios de la Sociedad de la Información (LSSI-CE).
2. Data Controller & Data Processor Roles
KozyHost S.L. as Data Processor: When businesses use the platform, KozyHost S.L. processes on their behalf, as a data processor under GDPR Article 28, the data they keep in it: bookings, orders, customer profiles, event admissions and tickets, marketing campaigns, the messages and calls handled by the platform’s assistants, reviews, sales records, and the records of their staff, including employment details, schedules and timesheets. Each business is the data controller of that data, and our Data Processing Agreement governs how we process it.
KozyHost S.L. as Data Controller: KozyHost S.L. is the data controller of the user account data it manages for the people who use the platform (login identity, credentials and account settings) and of its own subscribers’ billing data, as well as of the enquiries and support requests sent to it and of the platform’s own security and usage records. The staff records a business keeps in the platform are that business’s data, which we process as its processor.
Vendors are responsible for providing their own privacy notices to their customers and for ensuring that their use of customer data through the platform complies with applicable data protection laws.
3. Information We Collect
3.1 Information You Provide
- Account registration data (name, email, phone number)
- Business information (vendor name, address, tax ID, business type)
- Payment and billing details
- Staff records that a business keeps in the platform (name, email, phone, role, employment details, schedules and timesheets), which we process on that business’s behalf (Section 2)
- Content you create (menus, products, posts, media, legal pages)
- Customer reservation data (name, email, phone, booking preferences)
- Communications with our support team
- Customer event data processed for venues (ticket buyer and ticket holder name, email, phone, the admission and session bought, invitations sent by the venue)
- Enquiries from businesses considering KozyHost, sent through our sales contact page (business name and type, location, number of venues, the contact person's name, role, email and phone, website and message)
3.2 Information from Third-Party Services
When you connect third-party accounts (Google Business Profile, Facebook, Instagram, WhatsApp), we receive:
- OAuth access tokens (stored encrypted using AES-256-GCM)
- Business page/account identifiers and names
- Reviews and ratings from connected profiles
- Page insights and analytics (when authorized)
We do not access your personal social media feed, private messages, or contact lists. We only request permissions necessary for business page management.
3.3 Automatically Collected Information
- Device and browser information (type, version, operating system)
- IP address and approximate geographic location
- Usage patterns and interaction data
- Session cookies for authentication and security
4. Legal Basis for Processing
We process personal data under the following legal bases (GDPR Article 6):
- Contractual necessity (Art. 6(1)(b)): Processing necessary to provide the Service, manage accounts, process event admissions and ticket purchases, fulfill subscription agreements, and answer a business's enquiry about subscribing, at its request, before any contract
- Legitimate interest (Art. 6(1)(f)): Platform security, fraud prevention, service improvement, analytics, and measuring the delivery and link opens of a venue's own campaigns (no advertising profile is built and no third-party tracker is used)
- Consent (Art. 6(1)(a)): Marketing communications, non-essential cookies, and optional AI features
- Legal obligation (Art. 6(1)(c)): Tax compliance, regulatory reporting, and data breach notifications
5. How We Use Your Information
- Provide, operate, and maintain the platform and its features
- Process transactions, manage subscriptions, and handle billing
- Sync and display reviews from connected platforms
- Publish posts to connected social media accounts on your behalf
- Sync menus and business information to Google Business Profile
- Send transactional emails and messages (activation, password reset, booking confirmations, event tickets and their changes)
- Process AI-assisted tasks (document analysis, content generation, translation)
- Improve our services, develop new features, and fix bugs
- Ensure platform security, detect fraud, and prevent abuse
- Comply with legal obligations and respond to lawful requests
- Sell and deliver event admissions on behalf of venues: process the order and its payment through the venue's payment gateway, issue the venue's receipt or invoice, and send the tickets by email, WhatsApp or SMS
- Send venues' marketing campaigns to the customers who opted in on their storefront, and measure them: delivery, one-click unsubscribe, and whether a link in the message was opened (a redirect through the platform records the click; there is no tracking pixel and no third-party tracker)
6. Marketing Communications
We may send you marketing communications about new features, promotions, or service updates only if you have explicitly opted in to receive such communications (GDPR Article 6(1)(a)).
- You may opt in to marketing during registration or from your account settings
- Every marketing email includes a one-click unsubscribe link
- You may withdraw consent at any time without affecting the lawfulness of prior processing
- We do not sell or share your email address with third parties for their marketing purposes
- Transactional emails (password resets, billing notifications, security alerts) are not considered marketing and will always be sent
- Venues may send their own marketing campaigns through the platform to customers who opted in on the venue's storefront; each message names the venue, carries a one-click unsubscribe, and is measured as described in Section 5. The venue is the controller of that marketing
- Where a venue offers it, you may also opt in to receive its marketing by WhatsApp or SMS; that consent is separate, recorded with its date and source, and withdrawn by replying STOP or from the venue's privacy page. Where a venue belongs to a group of venues under one company and its notice says so, your marketing consent may be offered for the group as a whole; it is never extended without your choice
7. Data Storage & Security
Your data is stored on secure servers within the European Union. They are our own servers, on our own network in Spain. We apply the following security measures:
- AES-256-GCM encryption at rest of credentials (such as OAuth tokens and API keys) and of the fields that hold personal contact details
- Full-disk encryption of our servers, and backups encrypted with our key before they reach our own backup storage
- TLS 1.2/1.3 encryption for all data in transit
- TLS 1.2/1.3 encryption of data in transit
- Per-business data isolation and role-based access control (RBAC)
- Two-factor authentication for our staff and for businesses’ administrators, and logging of activity on the platform
- Regular internal security audits, within an information security management system aligned with ISO/IEC 27001 (not certified)
8. Third-Party Integrations & Sub-Processors
8.1 Google Business Profile
We use Google's API to sync menus, manage reviews, and update business information. Your Google credentials are stored encrypted and can be disconnected at any time. See Google's Privacy Policy.
8.2 Meta (Facebook & Instagram)
We use Meta's Graph API to publish posts and manage business pages. We request only permissions necessary for page management. See Meta's Privacy Policy.
8.3 Sub-Processors
The platform runs on our own servers, on our own network in Spain, and the emails it sends leave from our own mail servers, so no third party hosts your data or delivers those emails. The following providers process personal data on our behalf; for the data we process on behalf of businesses, they act as our sub-processors:
- Network edge — Cloudflare: all web traffic to and from the platform passes through it (DNS, encrypted connections, firewall and the secure tunnels to our servers); it works on a global network, at the point nearest each user, and its tunnels to our servers terminate in Madrid
- AI providers — OpenAI (voice concierge, assistant and content features), Anthropic, Google (Gemini) and Cerebras, which receive the data each AI task needs, as described in Section 11, and Tavily, which runs the assistant’s web searches; all of them process data in the United States
- Messaging and telephony — Twilio (the concierge’s phone line, SMS such as sign-in codes, and WhatsApp Business messages: tickets, reservation and order notices) and Meta’s WhatsApp Business Platform, which WhatsApp messages reach through Twilio; both process data in the United States
- Push notifications — Apple, which delivers the notifications sent to the staff and point-of-sale apps, in the United States
- Address suggestions — Google Maps Platform (Places), in the United States: what you type in an address field is sent to Google to propose the complete address; nothing else is sent
- Remote camera viewing — Xirsys, which relays the live images of a venue’s cameras while they are watched remotely in the video surveillance module; the platform does not record them
For the data we process on behalf of businesses, Annex III of our Data Processing Agreement is the complete list of sub-processors, with what each one does and where it processes data. The platforms a business connects under its own account (Sections 8.1 and 8.2), the payment gateway it contracts for its own sales and any AI provider it uses with its own key act under that business’s own relationship with them, not as our sub-processors. The data processing terms that apply to each sub-processor are available on request from the address in Section 13.
9. International Data Transfers
Your data is stored on our own servers in Spain. Some of the providers listed in Section 8.3 process part of it outside the European Economic Area (EEA):
- OpenAI, Anthropic, Google, Cerebras, Tavily, Twilio, Meta and Apple process it in the United States, for the tasks described in Section 8.3
- Cloudflare handles web traffic on its global network, at the point nearest each user (its tunnels to our servers terminate in Madrid), and Xirsys may relay the images of remotely viewed cameras through servers outside the EEA
- Each of these transfers relies on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for a provider certified under it, or, where no adequacy decision applies, on the standard contractual clauses adopted by the European Commission
- Data that a business sends, on its own instructions, to a platform it connects under its own account (for example, a post published on its Facebook page) is sent under that business’s own relationship with that platform
10. Data Sharing
We do not sell your personal data. We may share information with:
- Service providers: the providers listed in Section 8.3, bound by data processing terms, and Redsys, the payment gateway of our bank, BBVA, which processes our subscribers’ card payments under our merchant agreement
- Connected platforms and a business’s own providers: the platforms a business connects under its own account (such as Google Business Profile, Facebook and Instagram), the payment gateway it contracts for its own sales (such as Redsys, Stripe or Adyen) and any AI provider it uses with its own key receive only the data that business authorises, on its instructions and under its own relationship with them
- Legal requirements: when required by law, regulation, court order, or legal process
- Business transfers: in connection with a merger, acquisition, or sale of assets, with prior notification
11. AI Processing & Automated Decisions
The platform uses AI-powered features for document processing, content generation, translation, and business intelligence. Regarding AI processing:
- Some AI tasks run on a model we host on our own servers, and then no data leaves them; the others are sent to the AI providers named in Section 8.3: the telephone concierge streams the caller’s audio to OpenAI’s realtime service for the duration of the call, the assistant and content features send the text each task needs (for example a menu, a booking request or a document) to OpenAI, Anthropic, Google (Gemini) or Cerebras, and the assistant’s web searches go to Tavily
- Only the data the specific task requires is sent, for that task; the providers act as processors and are listed as sub-processors in Section 8.3, except a provider that a business uses with its own key, which acts under that business’s own contract with it
- AI processing is used to assist, not to make autonomous decisions with legal or significant effects
- No purely automated decision-making (as defined in GDPR Article 22) is performed without human oversight
- You may opt out of AI-assisted features at any time from your account settings
- AI-generated content (including legal documents) must be reviewed by the user before publication
12. Data Breach Notification
What KozyHost S.L. does after a personal data breach depends on whose data is affected:
- Data we process on behalf of a business (Section 2): we notify that business without undue delay and, in any event, within 72 hours of becoming aware of the breach, with the information it needs about the nature, scope and likely consequences of the breach
- That business, as controller, decides whether to notify the supervisory authority (Agencia Española de Protección de Datos) and the people affected, and we cooperate with it so that it can do so
- Data we control (the user accounts we manage and our subscribers’ billing): we notify the Agencia Española de Protección de Datos within 72 hours when the breach is likely to result in a risk to the rights and freedoms of the people affected (GDPR Article 33), and we inform those people without undue delay when it is likely to result in a high risk to them (GDPR Article 34)
- In every case, we take immediate steps to contain the breach and mitigate its effects, and we document the breach, its effects and the remedial actions taken
13. Your Rights
Under GDPR and the LOPDGDD, you have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Request erasure ("right to be forgotten") (Art. 17)
- Restrict processing of your data (Art. 18)
- Data portability — receive your data in a structured, machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7(3))
- Disconnect third-party integrations from the platform settings
- Lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es)
To exercise your rights over the data we control, contact us at [email protected]. We will respond within 30 days as required by law. If your request concerns data that a business keeps about you in the platform, such as a booking, an order or a message, that business is the controller and answers it: we pass your request on to it without undue delay and help it respond.
14. Data Retention
We retain your data according to the following schedule:
- Active accounts: Data is retained for as long as your account is active
- Deleted accounts: Personal data (name, email, phone, address) is purged by a daily job once 30 days have passed since its last role was deleted; a data-subject erasure request is executed on receipt
- Disconnected integrations: Access and refresh tokens are deleted the moment the integration is disconnected
- Billing records: Anonymized transaction records are retained for the legally required period (6 years under Spanish tax law)
- Audit logs: Application logs are kept for 90 days and server access logs for up to 6 months; the audit trail of actions on your account is kept for as long as the platform must be able to evidence its operation (up to 5 years), with your personal data removed from it when your account is erased; the record of messages sent to you is kept for 12 months
- Backups: Data may persist in encrypted backups: daily backups are kept for 30 days and monthly backups for 12 months; backups are not read back except to restore service
- Event and campaign records: Ticket orders are sales records and follow the billing schedule above; the personal details on a ticket (holder name, contact) are removed when the buyer's data is erased under Section 13. Campaign delivery and click records reference the recipient's account and never copy their identity, so they become anonymous when that account is erased; a venue's campaign history is kept as long as its account is active
- Enquiries from prospective customers: An enquiry sent through the sales contact page is deleted 12 months after our last contact about it, unless it leads to a subscription, in which case it is kept with the account
15. Cookies
The platform's own pages set only the cookies they need to work, such as the session, security, your language and your cookie choice. A venue's storefront can also load that venue's own analytics and advertising tags (Google Analytics, Google Ads, Meta Pixel), and only after you accept them.
- Strictly necessary cookies: sign-in, security, language and remembering your cookie choice. They cannot be disabled.
- Analytics and advertising cookies: a venue's own tags, set only with your consent.
The Cookie Policy below lists every cookie and explains how to change or withdraw your choice at any time with the "Cookie settings" control at the bottom of every page.
16. Children's Privacy
Our platform is designed for business use and is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.
17. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page, updating the "Last updated" date, and sending a notification to your registered email address. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.
18. Data Protection Officer
For questions about this Privacy Policy, to exercise your data protection rights, or to lodge a complaint about our data handling practices, contact our Data Protection Officer:
KozyHost S.L.
Calle Aragón 3, Sotogrande, 11310 San Roque (Cádiz), Spain
DPO Email: [email protected]
Supervisory Authority: Agencia Española de Protección de Datos (AEPD)
Platform: kozyhost.com