Privacy notice

Last updated 26 Sept 2026

Who we are

HostSorted is provided by Pro Photo Guy Ltd, trading as Property Photo Guy. Registered in England and Wales, company number 17433897. Registered office: 20 Wenlock Road, London, England, N1 7GU. We are the data controller for personal data processed through HostSorted. Contact: [email protected].

What we collect

Account details: your name, email address and password. Passwords are stored only as a secure hash, and we can't read them.
Property and compliance records: property names, addresses and postcodes; check dates and notes; and the details of the contractors you record, such as company names, registration and certificate numbers.
Documents you upload, such as certificates and reports.
Booking calendar links you add, and the dates they contain. We only keep whether each date is a stay or a block, never guest names or booking details.
Billing information: your subscription status and payment history. Card details are handled by Stripe, and we never see your full card number.
Team and owner details: if you're invited to an account, the name and email address you're invited with, your role and which properties you can see. Letting agencies and managers who add owners to their account are the controller of that information; we process it on their behalf.
Host tools: the details you record about cleaners and contractors (names, phone numbers and email addresses), changeover notes and photos, maintenance jobs, alarm test records, and income and expense entries.
Guest register: if a host switches on online registration, guests' names, nationalities, arrival and departure dates and, for guests who aren't British, Irish or Commonwealth citizens, passport numbers, places of issue and next addresses. The host is the controller of this information and we process it on their behalf. Passport details and addresses are encrypted.
Guestbook entries: if a host invites you to write in their guestbook, the name, location, rating and message you choose to give, which appear on the host's public guestbook page. The host is the controller and can remove entries; you can ask them, or us, to remove yours at any time.
Booking requests: if you ask to book a property through a host's HostSorted website, your name, email, optional phone number, dates, number of guests and message are sent to the host and stored so they can reply. The host is the controller. We delete requests 24 months after the stay.
House rules agreements: if a host asks you to agree to their house rules, the lead guest's name, optional email, arrival and departure dates, the number of adults and children, the rules you agreed to, the time and your browser type. The host is the controller and can use it if there's a dispute or damage claim. We delete it two years after the stay.
Offers from hosts: if you tick "email me offers" on a host's website or house rules form, we keep your name and email for that host so they can email you about future stays. Every email has an unsubscribe link, and unsubscribing stops them for good.
Cleaners' photos: photos a cleaner uploads through their schedule link are stored with the upload time and a fingerprint of the file, so hosts can use them as evidence of a property's condition.
Checklist requests: if you download our free checklist, your email address, and whether you asked us to email you when the rules change.
Messages you send us.
Technical data: IP address, browser type and server logs, used for security and to keep the service working.

Why we use it

To provide HostSorted, including storing your records and sending the reminders you ask for (to perform our contract with you).
To take payments and keep financial records (contract, and our legal obligations).
To keep the service secure and prevent misuse (our legitimate interests).
To keep the guest register on behalf of the host, so they can meet their legal obligation to record guests (the host's legal obligation).
To send schedule links to cleaners and booking requests to contractors when the host asks us to (the host's legitimate interests).
To send invitations, and monthly reports to property owners, on behalf of the account that invited them (contract with the account holder, and their legitimate interests).
To send important service messages, such as changes to these terms (contract and legitimate interests). We don't send marketing emails without your consent.

Cookies and website statistics

We use one essential cookie to keep you signed in. Cloudflare, which protects our website, may set essential security cookies. We use Cloudflare Web Analytics to count visits and see which pages are useful; it doesn't use cookies or track you across other websites. We don't use advertising cookies.

In your first week we may send you a couple of emails with tips for getting set up. You can turn these off from any of them, or on your account page; reminders about your checks are separate. If you download the checklist, we email you the link and, only if you ask, occasional updates when the rules change.

If you're a host: your guests' information

For information about your guests, cleaners, contractors and owners, you're the controller and we're your processor. Our data processing terms set out what we promise to do with it. The suppliers listed below are our sub-processors.

Who we share it with

We use trusted suppliers to run HostSorted. They only process your data on our instructions:

Amazon Web Services: hosting, file storage and email delivery, in the London (UK) region.
Cloudflare: website security and delivery.
Anthropic: reads the certificates you choose to scan so we can fill in the details for you, and powers Max, our AI guide. A document is only sent when you upload it for reading, and a question is only sent when you ask Max. Anthropic keeps API data only for a limited period and doesn't use it to train its models.
Stripe: payment processing. Stripe is also responsible for some payment data as an independent controller.

We don't sell your data. We may share information if the law requires us to.

Max, our AI guide

When you ask Max a question, the question and the earlier messages in that conversation are sent to Anthropic to write the answer. We don't save your conversations: they stay in your browser tab until you close it. Max can't see your account or properties. Please don't type personal details, such as names, addresses or payment details, into Max. We keep standard server logs, which may include your IP address, for a short time to stop misuse.

International transfers

Your records and documents are stored in the UK. Some of our suppliers, such as Cloudflare, Stripe and Anthropic, may process limited data outside the UK, including in the United States. When they do, it's protected by UK adequacy regulations or approved contractual safeguards.

How long we keep it

Your account, records and documents are kept until you delete your account. Deleting your account removes them from the live service straight away, and from our backups within 14 days. Backups are encrypted and stored in the UK (AWS London).
Guest register entries are deleted automatically 12 months after the guest's departure, the period the Immigration (Hotel Records) Order 1972 asks hosts to keep them for. Hosts can delete them sooner.
Billing records are kept for 6 years, as tax law requires.
Email addresses from checklist downloads are kept for up to 2 years, or until you ask us to remove them.
Server logs are kept only as long as we need them for security and troubleshooting.

Keeping it secure

Data is encrypted in transit, access is restricted, and your documents can only be viewed from your own account.

Your rights

You can access, correct, export or delete your data, object to or restrict how we use it, and ask us to move it. Most of this you can do yourself from your account page, or email [email protected]. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

We'll update this notice if how we use data changes, and email you about significant changes.