Privacy Policy

1. Data controller

In accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), Organic Law 3/2018 (LOPDGDD), the rules derived from Directive 2002/58/EC (ePrivacy), the LSSI-CE (where applicable to cookies/electronic communications), Regulation (EU) 2024/1689 (Artificial Intelligence Act) where applicable, and other applicable European and Spanish law, the data controller is:

HOSTELELLA has not formally appointed a Data Protection Officer where this is not mandatory under Article 37 GDPR and Article 34 LOPDGDD. If this becomes mandatory in the future or one is appointed voluntarily, the corresponding contact will be published and the AEPD notified where applicable. This conclusion will be reviewed periodically and before scaling processing involving large-scale regular and systematic monitoring, special categories or new high-risk features.

2. Scope, recipients and B2B nature

HOSTELELLA is a professional digital platform (SaaS and, where applicable, marketplace features and business-to-business interactions) intended exclusively for business and commercial use (B2B), offering tools for operational management, document processing, team and shift management, and analytical assistance.

The Service is not intended for personal, household or consumer use. Users act in a professional or business context. When a user contracts, configures a business or accepts terms on behalf of a company, they must have sufficient authority to do so.

3. Exclusion of minors as users

Access to and use of the Service as a user is reserved for adults. Users must be at least 18 years old. HOSTELELLA does not deliberately collect or process the personal data of minors acting as users.

Important clarification: the 18-year restriction applies to whoever uses the platform. By contrast, the data of persons managed by the business Customer (e.g., employees included in shift planning) may, where applicable, relate to minor workers lawfully employed. In that case, the Customer acts as Controller and is solely responsible for the legality of employing minors and for complying with labor rules protecting minors (working hours, rest, night work, etc.). Any access to or use of the platform by a minor is unauthorized and contrary to the intended scope of the Service.

4. Categories of data subjects

• End users of business customers (owners, administrators, managers and employees).
• Customer workers whose data is managed in the Service (e.g., for shifts, team and planning), including, where applicable, lawfully employed minors.
• Persons requesting information, diagnosis, support or commercial contact via the website.
• Professional contacts of suppliers, distributors or partners (if applicable).
• Legal representatives and contact persons of customers (billing/commercial relationship).

5. Categories of personal data processed

Depending on the use of the Service, the following categories of data may be processed:

• Identification and contact data (e.g., name, email, professional phone).
• Authentication and account data (e.g., login identifiers, role, business membership, invitations).
• Subscription and billing data: plan, subscription status and periods, trial eligibility and use, amounts, currency, taxes, invoices, retries, cancellations, refund requests and status, and provider customer, payment or subscription references.
• Minimized payment data: brand and last digits when supplied by the provider, payment-method country, and a non-reversible cryptographic fingerprint used to prevent trial abuse. HOSTELELLA does not receive or store the full card number (PAN) or CVC.
• Business and operational information entered into the Service.
• Documents and financial, accounting and commercial data (invoices, receipts, expenses, sales, delivery notes, equivalent documents).
• Labor and workforce-planning data entered or configured by the Customer: contract hours and type, department or operational area, minimum rest, shift-band preferences, declared availability, minor-age indicator, assigned shifts, clock-ins/attendance and absences or time off (holidays, leave, public holidays, sick leave).
• Personal data of employees, suppliers or customers included in documents uploaded by business customers.
• Technical, security and usage data (e.g., IP, logs, device/browser info, timestamps, security events).
• Data derived from communications (e.g., incidents, support, transactional messages, notifications, team chat).
• Data entered in commercial or diagnostic forms (e.g., contact, business, needs and messages).
• Communication preferences and email delivery data (e.g., opt-in/opt-out for product or commercial communications, preferred language, date and proof of consent or objection, delivery status, bounces and, where lawfully enabled, invitation open/click events or aggregated communication metrics).
• Prompts, queries, content sent to AI features and generated results when the user decides to use such features.
• Data about your relationship with Ella (proactive assistance, section 11.2):
  • Service usage events, recorded on the server: which action was taken, by whom and when (e.g., that the business was created, that someone joined the team or was invited, that a document was uploaded, read, opened or corrected, that a movement was recorded, a shift was published or a change was requested, an order was sent or received, a stock count was made, someone clocked in or wrote to Ella). They carry internal identifiers and the type of action, but not the content of those records (no amounts, no text, no shift times). They also include the time at which you return to the App after at least 30 minutes without using it (at most one record every 30 minutes), the platform, the App version and the status of the notification permission. Clock-ins are recorded with the day only, never the time.
  • Relationship state: the stage you are at, the goal you have confirmed, the name you prefer to be called, rest days, preferred channel and time slot, and topics you have postponed.
  • Short memory: a summary and, at most, three notes of up to 500 characters about what you have said or done. The system rejects notes containing health data, contact details or data about other people.
  • Contact log: what Ella decided (to write, to wait or to stay silent), for what reason, through which channel and when; whether the message was shown, tapped, led to the action, was ignored, postponed or dismissed; and your rating (👍/👎).

5.1 Data that may reveal sensitive information (absences)

Managing absences and time off may include categories such as “sick leave”. Where an absence is linked to sick leave, that information may reveal data concerning health (a special category under Article 9 GDPR). In these cases:

• The business Customer is the Controller and must have an adequate legal basis (typically Article 9.2.b GDPR, in connection with employment and social-security obligations) and apply the required safeguards.
• HOSTELELLA applies minimization: for shift planning only the unavailability period is needed. The reason or type of absence is not transmitted to AI providers.
• The Customer must avoid entering more health data than strictly necessary and must not record diagnoses or clinical details in free-text fields.

Other than the above, the Service is not designed to process special categories under Article 9 GDPR. The Customer must not upload them unless it has an adequate legal basis, it is necessary and sufficient safeguards are applied.

6. Source of the data

• Data provided by the user when creating the account or completing their profile.
• Data provided by other users/administrators of the same business (e.g., invitations, role assignment, user onboarding, team labor and shift configuration).
• Data included in documents and records uploaded by the business customer.
• Data collected automatically through use of the Service (technical, security, analytics and the usage events described in section 5).
• Your responses to Ella: the options you tap in her messages, what you postpone and your ratings.
• Data obtained from third parties when the customer integrates external services or a marketplace is used (if applicable), in accordance with applicable law.
• Data received from Stripe, Apple or Google regarding the outcome and lifecycle of payments, subscriptions, refunds or external-purchase reports when the relevant channel is enabled.

7. Allocation of roles (Controller / Processor / Joint controller)

7.1 When HOSTELELLA acts as Controller

HOSTELELLA acts as Controller in respect of the data needed to operate the Service, such as: account administration, authentication, access control, security, fraud/abuse prevention, support, service communications, trials, subscriptions, billing, collection and refunds.

Ella's proactive assistance. HOSTELELLA is also the Controller for deciding whether Ella writes to you, when and through which channel, for recording those contacts and their outcome, for keeping your relationship state and memory and, only for the person who manages the business's plan, for plan suggestions (section 11.2). For this it uses data for which it is already the Controller: your account, your role, Service usage events, the plan and the status of the trial or subscription.

The business data Ella mentions inside a message — for example the supplier and amount of a document you uploaded, the week's sales or your upcoming shifts — remains Customer Data processed as a Processor (section 7.2): it is part of the assistance the Service provides to the business. Searching, among the business data you can already access through your role, for what may be useful to you (a document that has been read, a supplier missing an email address, your upcoming shifts or the week's totals) is also processing as a Processor. Ella only shows it to people who can already see it because of their role in that business, and it is not used for plan suggestions or for news and offers.

HOSTELELLA personnel access to personal data is limited to authorized persons bound by confidentiality and a need to know for requested support, security, continuity, compliance or incident investigation. Risk-appropriate least privilege and logging apply; there is no unrestricted commercial access to business data.

Stripe may act as a processor for certain activities performed under HOSTELELLA's instructions and as an independent controller for regulatory, fraud-prevention, security, compliance and payment-network operations. Its own terms and privacy notice supplement this information.

7.2 When HOSTELELLA acts as Processor

When business customers upload business documents and records or configure staff data (including shift, team and absence management) containing personal data of employees, customers, suppliers or other third parties, HOSTELELLA acts as Processor on behalf of the business customer, in accordance with the corresponding Data Processing Agreement (DPA) under Article 28 GDPR.

In these cases, the business customer remains the Controller and is solely responsible for: (i) informing data subjects, (ii) having an adequate legal basis, (iii) handling rights and (iv) complying with applicable obligations, including labor obligations (working hours, rest, protection of minors and informing workers' legal representatives).

7.3 Joint controllership (if applicable)

In certain flows (e.g., marketplace features, business-to-business communications or exchange of orders/data between parties), HOSTELELLA and other entities may jointly determine the purposes and means of processing and act as joint controllers under Article 26 GDPR. In those cases, the applicable framework of responsibilities and the contact point for exercising rights will be defined. Joint controllership is not presumed by default and will only apply where an agreement, configuration or flow justifies it.

8. Purposes of processing

• Provision, operation, maintenance, improvement and evolution of the Service. Where data forms part of a Customer processing mandate, improvement stays within its instructions; general improvement uses minimal telemetry and anonymous or aggregated data.
• User authentication, management of roles, permissions and access, and business administration on the platform.
• Processing, extraction and analysis of documents (including OCR/AI) at the user's express request.
• Team, working-time and shift-planning management, including AI-assisted generation of shift proposals at the Customer's request, as a support tool subject to human review.
• Generation of reports, metrics, insights and operational recommendations.
• Customer support and service communications (including security alerts and transactional notices).
• Administer the free trial, purchase and manage plans, process charges and renewals, issue invoices or receipts, handle failed payments, cancellations and refund requests, and evidence authorization for future charges.
• Prevent trial abuse and payment fraud through minimized signals and resolve disputes.
• Comply with external-purchase information and reporting duties to Apple or Google where a user purchases through a mobile channel subject to those programs.
• Ella's proactive assistance inside the App: supporting you as you get started and use the Service with messages that Ella, HOSTELELLA's AI assistant, starts on her own in the App and, if you allow it, with a notification on your phone: introducing herself, telling you a result is ready, proposing the next step, asking a question that unlocks a feature, reminding you of something you asked her for, or offering to put you in touch with a person from the team. It includes checking whether the message was useful, so as not to repeat what does not interest you and to write less to people who do not respond. See section 11.2.
• Plan suggestions from Ella, only to the person who manages the business's plan and only inside the App: proposing the plan that fits actual use of the Service. See sections 11.2 and 22.
• Optional email communications, only if you have turned them on: (i) guides and summaries from Ella; and (ii) news and functional changes, setup tips, notices about new features and invitations to try them, newsletters, content, use cases, event invitations, surveys, offers and promotions about HOSTELELLA, as well as aggregated measurement of the effectiveness of such communications.
• Managing your communication preferences: recording and evidencing what you have turned on or off, handling opt-outs, and maintaining the suppression list that prevents us from contacting you again.
• Security, fraud prevention, abuse detection, internal audit and incident response.
• Compliance with applicable legal, tax, accounting and audit obligations.
• Defense against legal claims and protection of rights and legitimate interests.

9. Legal bases

We process personal data on one or more of the following legal bases:

• Performance of a contract (Art. 6.1.b GDPR): to provide and operate the Service.
• Compliance with a legal obligation (Art. 6.1.c GDPR): to comply with applicable law (e.g., tax/accounting where applicable).
• Legitimate interest (Art. 6.1.f GDPR): security, fraud/abuse prevention, proportionate Service improvement using data for which HOSTELELLA is controller, Ella's proactive assistance inside the App and her plan suggestions, legal protection and business continuity, after balancing necessity, impact and reasonable expectations.
• Consent (Art. 6.1.a GDPR): non-essential cookies and all optional email communications — guides and summaries from Ella, news, tips, offers, promotions, events and surveys — whether or not you are already a customer. See section 22.

For data processed on behalf of the Customer (including shift planning and team management), the legal basis vis-à-vis the workers is determined by the Customer as Controller (typically performance of the employment contract, compliance with labor obligations, or a legitimate interest in organizing work).

Data marked as necessary to create an account, purchase, bill, protect the Service or meet legal duties is contractually or legally required: failure to provide it may prevent registration, payment or the affected service. Device permissions, non-essential cookies and optional communications are voluntary; refusing them does not reduce unrelated features. You may object to legitimate-interest processing on grounds relating to your particular situation by writing to legal@hostelella.com. HOSTELELLA will stop unless it demonstrates compelling legitimate grounds or needs the data for legal claims.

Data of our customers' workers. Data we process as a processor on behalf of a Customer (e.g., the team registered by a business, their shifts, clock-ins, or contacts contained in uploaded documents) is not used for HOSTELELLA's own marketing. The only way a person can receive an optional email from us is by registering and turning it on themselves in their preference centre (section 22.2). We never buy or rent contact lists.

If you work at a business that uses HOSTELELLA. Ella never talks to you about plans, prices, offers, the business's sales or other people: her assistance is limited to what is yours (your shifts, your clock-ins and the answers to your requests). Ella does not report to the business on how you use the App (whether you log in, open or read a message); the only thing she may mention to whoever manages the business is that you have joined the team, which they can already see in their team list. Neither your relationship memory nor your contact log is visible to the business. You can turn Ella's messages off without this affecting your work or the operational notices about your shifts and clock-ins, which depend on the business.

10. Device permissions (Mobile app)

For certain features, the App may request optional device permissions:

• Camera / gallery access: to capture or upload photos and documents (e.g., invoices, receipts) for analysis.
• Attachment metadata: attached images are processed before upload to remove technical metadata, including EXIF/GPS, where the format allows. Documents uploaded by the Customer (e.g., PDF) may contain metadata embedded by the Customer or its authoring tools; HOSTELELLA processes them as part of the content/documentation provided for OCR, analysis and operations, and not as location data used for maps or proximity.
• Microphone access: for voice/dictation features (if enabled).
• Contacts access: to invite team members or suggest contacts (if enabled).
• Location access: only when the employing business enables presence verification at clock-in/out (see section 10.1). The App does not use location for maps, proximity or any other purpose, and never accesses it in the background.

The operating-system authorization permits technical access to the device and can be revoked in its settings. It does not by itself determine the GDPR legal basis: for employment location verification the employer determines that basis under section 10.1 and it is not worker consent. Revocation may limit the affected feature but will not prevent basic use where possible.

10.1 Location verification at clock-in/out (optional per business)

The employing business may optionally enable presence verification for the working-time record (clock-in/out). When enabled, the App captures a single, one-off position at the moment of clocking in or out, always in the foreground and after requesting the device's location permission. The position is sent to the server, which calculates the distance to the verified address of the workplace, for the sole purpose of verifying that the person is at the workplace when clocking in or out. There is no continuous tracking, no background capture and no capture outside the moment of clocking in or out.

• What is stored: only the verification result (inside/outside or equivalent) and the approximate distance to the workplace. The worker's coordinates are never stored: they are processed ephemerally on the server during the request and are not written to logs or to any storage.
• Roles and legal basis: the employing business is the Controller of this processing and HOSTELELLA acts as Processor under the DPA. The legal basis is determined by the employer, typically the employer's power to monitor work performance (Art. 20.3 of the Spanish Workers' Statute) and the working-time record (Art. 34.9), subject to the prior-information duty of Article 90 LOPDGDD; it is not based on the worker's consent.
• Proportionality and DPIA: before enabling it, the employer must document necessity, suitability, proportionality, less intrusive alternatives, consultation/information of representatives where applicable, and assess Article 35 GDPR criteria. If processing may create high risk — including a combination of employment monitoring, location or systematic evaluation — it must complete a data-protection impact assessment before use.
• Retention: the result and the approximate distance are kept together with the working-time record they accompany (generally 4 years under Art. 34.9 of the Spanish Workers' Statute).
• Alternative: the business may enable clocking in/out from a shared device at the workplace itself, which requires no location permission and captures no position; its availability is at the business's discretion.

If the business does not enable this feature, the App does not request location permission. The above does not change the attachment-metadata processing described in this same section: attached images are still processed before upload to remove technical metadata, including EXIF/GPS, where the format allows.

10.2 Daily working-time record (clock-ins) and who can see it

The employing business is the Controller of the daily working-time record of its staff (Art. 34.9 of the Spanish Workers' Statute) and HOSTELELLA acts as Processor under the DPA. The legal basis is the employer's compliance with that legal obligation (Art. 6.1.c GDPR); it is not based on the worker's consent. The employer organises and documents the record in accordance with labour law (collective bargaining, company agreement or employer decision after consulting workers' representatives) and informs its staff of its existence and purpose; this Policy supplements that information.

• What is recorded: the specific start and end time of each working day, using the server clock; where the person manually indicates the clock-out time, it is marked as "time indicated". Breaks are not recorded unless the business configures it.
• Integrity and traceability: each clock-in/out is linked to an audited event; corrections made by managers keep the previous value, the new value, who made them and when. Automatic safety closures are identified as such.
• Who can see the record: the worker (their own clock-ins and history), and those who manage the record on behalf of the business: the owner and people with admin or manager permission, in respect of lower-ranked people. Workers' legal representatives and the Labour Inspectorate access it through the business, which can export the record at any time. The record is not visible to other co-workers.
• Team presence (optional): the business may enable the team to see, in the internal chat, who is working at that moment (avatar and name of those who clocked in and are still in), for the sole purpose of coordinating the shift. In that case no clock-in/out times, lateness, overtime or any other record data are shown to the rest of the team. The business can disable it at any time.
• Notices to managers (optional): managers may receive a notice for each clock-in/out of their team and reminders when a clock-in/out is missing; those notices are not sent to the rest of the staff.
• Permissions assigned by the business: the business decides each person's permission. Whoever is granted manager, admin or owner permission can see and correct the clock-ins of lower-ranked people; the app warns of this when the permission is assigned, and that decision belongs exclusively to the business as Controller.
• Retention: four years from each clock-in/out (Art. 34.9 Workers' Statute), also after the person leaves the business. If the business stops using the Service, it can export the full record before deletion (see Retention Policy).
• Biometrics: HOSTELELLA does not perform biometric identification. Any fingerprint or face unlock the person enables in the app runs on their own device with the manufacturer's means; the business receives and stores no biometric data.
• Location verification: only if the business enables it and under the terms of section 10.1.

11. Artificial Intelligence and automated processing

HOSTELELLA may use automated processing and artificial intelligence to extract information from documents, classify data, assist with queries and generate shift-planning proposals, and to resolve the applicable labor framework or collective agreement based on the business's location and sector. Ella, HOSTELELLA's AI assistant, may also write to you on her own initiative inside the App (section 11.2).

These features are designed as assistance and productivity tools, not as a substitute for human review nor as a system intended by default to make labor, tax, accounting, credit, legal or significantly impactful decisions. AI-generated shift proposals require human review and approval (by a person with a manager role or above) before publication or application; the Customer and its managers retain the final decision at all times.

Artificial Intelligence Act (EU 2024/1689). AI features are conceived as support tools. HOSTELELLA may be the provider or downstream provider of the integrated system and the Customer the deployer in its organization; each party retains its mandatory duties. Both must take measures to support the AI literacy of persons operating the system (Art. 4). Where a feature is used in the employment context, intended and actual use must be classified and documented, with an impact assessment and safeguards where required. The Customer must ensure lawful use, competent human oversight with authority, prior information to affected persons and retention of logs under its control. In Spain, it must also respect workers' representatives' right to information about parameters, rules and instructions of algorithms or AI systems affecting working conditions (Art. 64.4.d Workers' Statute).

To minimize processing, before sending information to AI providers measures such as pseudonymization are applied (e.g., the shift generator operates with initials and operational data, not full names) and unnecessary data is excluded (e.g., the reason for absences is not transmitted). Results may contain inaccuracies or limitations. The Service is not designed for biometric identification, social scoring, emotion recognition, recruitment, automated disciplinary assessment or other prohibited or high-risk purposes unless under specific contract, assessment and safeguards. HOSTELELLA does not use Customer Data to train its own or third parties' models unless under express authorization, specific contract or clear Customer configuration.

11.1 Cross-business learning (not active)

We are designing a feature that would let a business authorize its document-reading quality to contribute, in the form of aggregated signals within minimum-size cohorts, to improving the accuracy of the Service for every business. This feature is not active. Today, each business's documents, data and corrections are used for that business only, and nothing leaves it towards shared learning.

When it does become available, it will be enabled only with the express authorization of each business owner, after completing the corresponding impact assessment, and under these conditions: documents, text, names, tax IDs, suppliers, products and amounts will never leave the business; only data created after the authorization will be used, never historical data; the authorization will be revocable at any time with immediate effect on future contributions; and publishing any aggregated result will require minimum thresholds of businesses and samples. We will explain all of this here and inside the App before asking you for anything.

11.2 Ella, AI assistant: when she writes to you and how she decides

Besides answering when you write to her, Ella may write to you first. This is how it works:

• What she observes. The Service usage events described in section 5 (which actions were taken and when), your role, the stage you are at, the plan and the status of the trial or subscription, your responses to her previous messages and your short memory. To find something useful to show you, she also reviews the business data you can already access through your role (for example, a document that has been read, a supplier missing an email address, your upcoming shifts or the week's totals), on behalf of the business (section 7.1).
• How she decides. An automated process checks whether there is something useful to tell you: as a rule once a day, almost immediately during the first two hours after you join and, if you still have the App open, shortly after something you have just done. The code prepares a closed list of possible messages; the AI model picks one — or decides not to write, which is a valid and frequent outcome — and drafts the text. Before delivery, the code checks the limits, your role, that figures and names match your real data and that the tone is not manipulative. If anything fails, nothing is sent.
• Limits the model cannot exceed. As a rule, one contact per day across all your businesses, and a second one that same day only if you responded to the first (up to three in the first two hours after you join each business, while you are getting started), not counting the reminders you ask her for. What Ella starts on her own is scheduled for the time at which you usually use the App or, until she knows it, within a daytime slot in the business's local time, respecting your rest days if you tell her about them; what responds to something you have just done while you are still in the App, or to a reminder you asked for, arrives at that moment and, in the first case, only inside the App. Phone notifications respect your quiet hours and are not sent on the day you join. If you postpone a topic ("Not now"), she does not come back to it for at least 14 days; and if you ignore several messages in a row, she writes less. False urgency, guilt and any technique that exploits tiredness, haste or a situation of need are prohibited.
• Profiling. This processing is profiling within the meaning of Art. 4(4) GDPR: it evaluates how you use the Service in order to decide what to propose to you and when. It produces no legal effects and does not significantly affect you: Ella only proposes. She does not change your plan, your price or your access, she takes no decisions about your employment relationship, and it is not a decision under Art. 22 GDPR.
• What she sees depending on your role. Owner and administrator: the business data they already have access to. Manager: no business-wide figures or counts and no data about other people. Worker: only what is theirs; never amounts, sales, plans or other people. Plans, prices and the trial are only discussed with the person who manages the business's plan.
• What the model receives. A minimal file: your first name, your role, your language, the country and the name of the business, the local time, your progress by Service area, the specific data for the possible message (for example the supplier of a document and, if your role allows it, its amount; or your upcoming shifts), your latest usage events, your latest contacts with their outcome and your short memory. If you are an owner or administrator it may include the first name of someone who has just joined the team; if you are an owner, administrator or manager, which plan features have been used up, without figures; and if you manage the plan, also the status of the subscription. It does not include your email, your phone number or the history of your conversations. It is processed by Microsoft (Azure OpenAI) as a processor, in an EU data zone deployment, and is not used to train models.
• Continuity in the chat. When you are the one writing to Ella, her answer takes into account your relationship state and memory (your goal, the name you prefer, your rest days, what you have postponed, your notes and her latest messages with their outcome), so that each conversation does not start from scratch. Only what is yours is used, and only in your own conversations, including if you have turned off "Ella messages me first", because you are the one starting the conversation; you can ask us to erase your memory at any time. The chat currently uses the global deployment described in section 16.
• Phone notifications. They are optional: they require the operating system's notification permission, which Ella only asks for in context. The notification text contains no figures, amounts, dates, percentages or names of people, because it may be visible on a locked screen. They are never used for plan suggestions or offers.
• Help from a person. When the option is available and you choose "Talk to someone", we send HOSTELELLA's support mailbox your first name, your email, your language, the name of the business, your role, the reason and internal identifiers, so that a person from the team can get in touch with you. They are not sent the content of your conversations or any other business data.
• Testing before it is switched on. Before Ella actually writes, the assistance may run in test mode: Ella prepares the messages with the same data, limits and controls, but does not deliver them. Authorised HOSTELELLA staff review those texts, without identifiers and for a maximum of 30 days, to check their quality.

How you control it. Under You → Privacy and communications you have three independent controls: "Ella messages me first", "Plan suggestions from Ella" and "Guides and summaries from Ella by email". Section 22 describes them. If you turn off "Ella messages me first", Ella stops evaluating your usage and writing to you on her own initiative in all your businesses; she will keep answering when you write to her and reminding you of what you ask her for. At that same moment, your usage events already recorded stop being linked to you, and new ones are recorded only as activity of the business, without identifying you.

12. Cookies and tracking technologies (web/PWA)

On the website and/or PWA, HOSTELELLA may use cookies, pixels or similar technologies for:

• Essential: operation, security, load balancing, authentication and fraud prevention.
• Analytics/measurement: Google Analytics to understand aggregated usage of the public website and improve performance and experience, only with prior consent.
• Preferences: remembering user settings (if enabled).

Non-essential cookies will only be used where consent exists, in accordance with ePrivacy and applicable law. The specific Cookies Policy supplements this information and prevails for granular cookie management.

13. Recipients, processors and sub-processors

We do not sell personal data. Data may be accessible to selected providers acting as processors/sub-processors under contractual obligations of confidentiality, security and compliance, including providers of:

• Cloud infrastructure, hosting and storage.
• Databases and authentication.
• Email and communications, including HOSTELELLA's support mailboxes on Microsoft 365.
• Payment processing, billing, fraud prevention and subscription management, primarily Stripe.
• AI and document-processing technologies, including Microsoft (Azure OpenAI and Azure's document-reading services), and Anthropic (Claude models) to resolve the applicable collective agreement or labor framework from the business's country, address and sector.
• Delivery of phone notifications (Apple and Google), which receive the device identifier and the notification text.
• Monitoring, analytics and security tools, including Google Analytics when the user accepts web analytics.
• Delivery of technical resources for the web app: when it opens, the browser downloads the rendering engine and fonts from Google servers (gstatic.com), which receive the IP address and technical browser data.

Each recipient receives only the data necessary for its function. Providers acquire no right to reuse Customer Data for advertising, their own profiling or model training; where they act as independent controllers — for example, certain regulatory payment or mobile store activities — their own responsibilities and policies are identified.

Under external-purchase programs for iOS or Android, Apple and Google may receive reporting identifiers or tokens, country, amount, currency, date and transaction status in order to administer their programs and fees. They act under their own terms and responsibilities. HOSTELELLA does not send them the full card number.

When HOSTELELLA acts as a processor, sub-processors are governed by the DPA, the Sub-processors Annex and the requirements of Article 28 GDPR. The up-to-date list of sub-processors is published in the Sub-processors Annex.

14. Authorities and defense of rights

We may disclose data to competent authorities where there is a legal obligation or legitimate request, and/or to defend rights, prevent fraud, ensure security or respond to claims, in accordance with the GDPR.

15. Corporate restructurings

In the event of a merger, acquisition, reorganization, sale of assets or equivalent procedures, data may be disclosed to third parties to the extent necessary and proportionate, with adequate safeguards.

16. International transfers

Where international transfers of data outside the European Economic Area occur, we apply adequate safeguards, including adequacy decisions, Standard Contractual Clauses (SCCs), the EU-US Data Privacy Framework where applicable and supplementary measures, in accordance with Articles 44–49 GDPR. Certain AI and communications providers are located in the United States; in such cases the above mechanisms and the minimization described in this Policy apply. Stripe payment services may involve global processing by its entities, financial institutions and payment-method providers under its DPA, terms and applicable safeguards. You may request a copy of the safeguards applicable to each transfer by writing to legal@hostelella.com.

Microsoft AI models (Azure OpenAI). The resources are created in the European Union and data at rest stays in that geography. Ella's proactive assistance uses an EU data zone deployment, in which Microsoft processes requests within its EU data boundary. The chat with Ella, AI-assisted shift generation and other assistance and classification features currently use a global deployment, in which Microsoft may process the request in any of the regions where it offers the model, including outside the EEA, under its data protection addendum, Standard Contractual Clauses and the EU-US Data Privacy Framework; we are migrating those features to the EU data zone. Your data is never used to train models.

In certain cases there may be a risk of access by authorities of third countries. In such cases we will apply supplementary measures where appropriate and, where necessary, inform and/or obtain consent in accordance with applicable law.

17. Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy and for the periods required by legal, tax, accounting, audit and security obligations. Thereafter, data will be deleted or anonymized, unless there is a retention obligation or a need to defend claims.

Retention is detailed in the Retention Policy. When HOSTELELLA acts as a processor, retention is governed by the DPA and the customer's instructions, without prejudice to legal obligations.

Data about your relationship with Ella. Usage events are deleted after 13 months. The contact log is deleted after 24 months, and the text Ella prepared for each contact is erased from that log 30 days after the contact is closed (the message you received stays in your conversation with Ella). Your relationship state and memory are kept while you are part of the business and are deleted when you stop being part of it, when the business is deleted or when you close your account. If you leave a business, only the decision — without its text — is kept in your contact log for that business until its period ends; if you close your account, it is deleted in full.

A deliberate exception: proof of your decisions. The record of when you turned an optional communication on or off — and the cryptographic fingerprint of your address in the suppression list — are retained even if you close your account. That is the only way to guarantee we will not write to you again and to demonstrate to the supervisory authority that we respected your decision (Arts. 5.2 and 7.1 GDPR). That record is kept blocked, separate from the rest, and is not used for any other purpose. The record of your decisions is kept for up to five years after the last one; the fingerprint in the suppression list, for as long as it is needed so that we do not write to you again.

18. Security measures

HOSTELELLA applies appropriate technical and organizational measures (Art. 32 GDPR) to ensure a level of security appropriate to the risk. The Security Policy describes the main measures, including access control, least privilege, encryption where appropriate, activity logging, incident management and service continuity.

Nonetheless, no system can guarantee absolute security. Users are responsible for keeping access to their accounts and devices secure.

19. Personal data breaches

In the event of a personal data breach, HOSTELELLA will follow internal procedures to assess the risk and, where appropriate, notify the competent supervisory authority and/or affected persons in accordance with Articles 33 and 34 GDPR.

When HOSTELELLA acts as a processor, notifications to the controller will be handled in accordance with the DPA.

20. Rights of data subjects

Data subjects may exercise their rights of access, rectification, erasure, restriction, objection and portability, as well as withdraw consent where applicable, by contacting: legal@hostelella.com.

We may request reasonable information to verify identity or representation. We will respond within one month of receipt of the request; this period may be extended by up to two additional months where necessary due to complexity or number of requests, informing the requester in accordance with the GDPR.

If the request relates to data processed by HOSTELELLA as a processor on behalf of a business customer, we may refer the requester to the relevant controller, who is the party that must handle the request.

Objection to direct marketing. Under Articles 21.2 and 21.3 GDPR, you may object at any time to the processing of your data for direct marketing purposes, including related profiling. This is an absolute right: no balancing test applies and we will stop processing your data for that purpose immediately. See section 22.

Objecting to Ella's messages and to her profiling. You do not need to write to us or give a reason: turn off "Ella messages me first" or "Plan suggestions from Ella" under You → Privacy and communications and it applies immediately in all your businesses. You can also ask us by email for access to your contact log and your relationship memory, or for their rectification or erasure.

21. Complaints

You can make a complaint to us at legal@hostelella.com: we will acknowledge it within 30 days at the latest, investigate it and inform you of the outcome. This is not a mandatory prior step.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). If you are outside the European Economic Area, see also section 26.

22. Communications and preferences

22.1 How we classify what we send you

Every message that leaves HOSTELELLA belongs to one of these five classes. The class determines its legal basis, whether it is on by default and how you stop it.

Why Ella's assistance is on by default. It relies on legitimate interest rather than on your consent because it happens inside the Service you already use, it is only about making good use of it with your own data, it has strict frequency limits and you can stop it at any time with a single gesture. Before enabling it we balanced that interest against your rights and expectations, paying particular attention to workers.

22.2 Your preference centre

Inside the App, under You → Privacy and communications, you can see and change at any time which communications you accept. This preference is yours as a person and does not depend on the business you are working in: if you belong to several businesses, it is still a single decision.

• Everything that arrives by email and is not necessary is off by default. We do not use pre-ticked boxes and we do not infer your consent from your sign-up, your activity, your plan, your role or the fact that you gave us your email address.
• Ella's two controls inside the App are on by default because they rely on legitimate interest, not consent (section 22.1). Turning them off is your right to object: it applies immediately, in all your businesses and without you having to give a reason.
• The purpose and the approximate frequency are described on the screen itself, next to the control, not behind a link.
• Each time you turn an option on or off we record a new event with the date and time, the version and hash of the exact text shown to you, the language and the origin of the decision (the App or a link in an email). That record is the evidence required by Article 7.1 GDPR and the evidence of your objection; it is never overwritten, only appended to.
• Withdrawing consent or objecting is as easy as the opposite and takes effect immediately for future sends, including messages already prepared. It does not affect the lawfulness of prior processing.
• Refusing, withdrawing consent or objecting does not limit any feature of the Service and does not change your plan.

22.3 One-click unsubscribe

Every optional communication includes an unsubscribe link that works in a single click, without signing in and without asking you for a reason, plus the List-Unsubscribe and List-Unsubscribe-Post technical headers so that your own email client can offer you its unsubscribe button. The link uses a random, single-use, expiring identifier: it never carries your email address or phone number.

When you unsubscribe we do two things in the same operation: we record the preference change and we add a cryptographic fingerprint of your address (HMAC-SHA256 with a key we keep separately; we never store your address in clear text in that list) to a suppression list. That list takes precedence over any prior consent and over any message already queued. We also add addresses to it automatically when they bounce permanently or when someone marks one of our emails as spam.

We handle opt-outs free of charge and without undue delay. You can also write to legal@hostelella.com or manage your preferences from your account settings.

22.4 Channels we use and channels we do not

In this version of the Service, Ella's guides and summaries and our news and offers are sent by email only and only with your consent. Ella's assistance and her plan suggestions live inside the App; the phone notification is used only for assistance, never for plan suggestions or offers. We do not send commercial SMS or WhatsApp messages, we do not make commercial phone calls and we do not display third-party advertising inside the App. Should we ever add any of those channels, it would appear as its own option, off by default, with its own consent and its own opt-out; and before using the telephone we would check advertising exclusion registries where the law requires it.

22.5 How we decide what to send you

Before an optional email is prepared, and again immediately before it is handed to the email provider, the system checks that the template is classified, that the purpose is allowed, that no active suppression exists and that your consent is still valid against a valid version of the text. If any of those conditions is missing, the send is blocked and logged: the system's default behaviour is not to send. Ella's messages inside the App go through an equivalent check: when deciding, your objection, your role and the frequency limits are applied, and immediately before delivery we check again that you have not objected and that your role has not changed (section 11.2).

We use automated systems, including Ella's AI, to choose what to tell you among options already defined, to draft it, to adjust frequency or timing, and to reduce or pause sending if we detect low interest or complaints. Those systems can never create a new purpose, infer a consent you did not give, reactivate an opt-out or an objection, or change your preferences, other than to record the objection you yourself tap in a message.

22.6 Limits we commit to

• We do not sell, rent or transfer contact data to third parties for advertising purposes.
• We do not buy lists or scrape email addresses.
• We do not use for our own marketing the data we process as a processor on behalf of a Customer: team, shifts, clock-ins, suppliers, products, amounts or contacts contained in uploaded documents.
• Plan suggestions from Ella rely only on the plan, the status and dates of the trial or subscription and measures of Service usage (for example, how many documents have been read). Never on the content of documents or on suppliers, products, amounts, shifts, clock-ins or team data.
• Only the person who manages the business's plan receives plan suggestions. Administrators, managers and workers receive no commercial content from Ella.
• We do not send third-party advertising and do not disclose your email to advertisers.
• We do not take automated decisions producing legal or similarly significant effects about you based on your interaction with our emails or with Ella's messages.
• In news and offers, at most, we segment by language, business type, plan and level of Service usage, in order to reduce irrelevant messages.

If you receive a commercial communication from us that you consider unsolicited, write to legal@hostelella.com: we will investigate it, unsubscribe you immediately and fix the source.

22.7 Guides and summaries from Ella by email: what you accept

This is the detail of what you authorize when you turn on "Guides and summaries from Ella by email". It is off by default: unless you turn it on yourself, Ella sends you no email.

23. Third-party links

The platform may contain links to third-party services (e.g., maps, integrations). HOSTELELLA is not responsible for the privacy practices of such third parties. We recommend reviewing their respective policies.

24. Changes to this Policy

This Privacy Policy may be updated to reflect legal, regulatory or operational changes. Each version applies from its publication and the current one is always available within the Service. When a version changes something material, the App shows it to you prominently before you continue using it, and no new processing applies to you before you have seen it. Changes do not retroactively legalize processing. Where a new purpose requires consent, it will be requested separately before processing begins.

25. Limitation of liability (Privacy)

Nothing in this Policy limits the mandatory rights provided by data-protection law. To the maximum extent permitted by law, HOSTELELLA will not be liable for damages arising from: (i) misuse of the Service, (ii) unlawful data uploads by customers/users, or (iii) actions taken solely on the basis of informational results, including AI proposals applied without the required human review.

26. If you are outside the European Economic Area

We apply this Policy to all users, wherever they are. You can exercise the rights in section 20 from any country at legal@hostelella.com, and we will also comply with the data protection law of your country where it grants you additional rights or different time limits.

• United Kingdom. The UK GDPR and the Data Protection Act 2018 apply. You can complain to us under section 21 and to the Information Commissioner's Office (ICO). Transfers from the United Kingdom to the European Union are covered by the United Kingdom's adequacy recognition.
• Switzerland. The Federal Act on Data Protection (FADP) applies. Data may be disclosed to States of the European Economic Area, to the United States and, in the global deployments described in section 16, to other countries where the provider delivers the service, with the safeguards of that section adapted to the FADP. You can complain to the Federal Data Protection and Information Commissioner (FDPIC).
• United States. We do not sell personal information, we do not share it for advertising based on your activity on other sites, and we do not use it for targeted advertising.
• Mexico. You can exercise your rights of access, rectification, cancellation and opposition (ARCO rights) and revoke your consent at legal@hostelella.com. The competent authority is the Secretariat of Anti-Corruption and Good Governance.
• Brazil. You can exercise the rights in Art. 18 LGPD at legal@hostelella.com, which is our channel of communication with data subjects, and complain to the National Data Protection Authority (ANPD).
• Canada. legal@hostelella.com is also the contact for the person responsible for the protection of personal information at HOSTELELLA. We do not make decisions based exclusively on automated processing (section 11).
• Other countries. You can also contact the data protection authority of your country.