Homy Privacy Policy

Homy is provided by ROCCHI GROUP FZCO, established in Dubai, United Arab Emirates, with registered office at IFZA Business Park, Dubai, United Arab Emirates (“Homy”, “we”, “us”). Our websites and application are at rocchico.com and myhomy.app.

For questions about personal data, contact privacy@myhomy.app or write to our registered office. Legal notices may be sent to legal@myhomy.app. R&C LLP is Homy’s identified privacy representative. Until a separate direct address is published, communications for R&C LLP may be sent to privacy@myhomy.app for routing.

This policy concerns personal data processed through the Homy service and related communications. It covers hosts, their team members, guests who view guides, prospective customers and people who contact Homy.

Homy acts as controller for its account administration, billing administration, security, support and other purposes it determines. Where a host decides how guest information is collected and used for its accommodation services and Homy handles that information on the host’s instructions, the host is controller and Homy is processor. That processing is governed by the Data Processing Agreement at myhomy.app/dpa.

A guest should contact the host identified in the guide for questions about the stay, host-provided content and the host’s use of guest information. If you contact us about data processed on a host’s behalf, we will route the request to that host and assist as appropriate. Opening a guide does not make Homy the operator of the accommodation.

Account and team information: names, email addresses, sign-in information, language preferences, listing memberships, roles and invitations. If you use Google sign-in, we receive the profile and account information supplied through that sign-in flow.

Property and guide information: property names, addresses and coordinates, public listing URLs, descriptions, photographs, facilities, house rules, arrival instructions, host contact details, links and other information entered or imported by the host. Hosts should avoid placing private credentials or unnecessary guest information in public guides.

Billing information: the selected plan, property and customer references, subscription status, billing periods, invoice information and payment-method references. Card-entry fields and the billing portal are supplied by Stripe; Homy uses Stripe references and payment status rather than receiving full card details through those fields.

Usage and technical information: device and session identifiers, request metadata, browser/network information, guide visits, interaction labels, session duration, approximate location derived from network information, and operational errors. The guide analytics application hashes an IP address with a daily salt rather than storing the raw IP in the analytics record; network and service providers may separately process IP addresses to deliver and secure their services.

Communications and optional features: information included in support requests, authorised emails, enabled AI inputs and outputs, uploaded files, translations and connected services. Depending on the feature, selected text, images, property details or conversation context may be sent to its provider. Avoid including identity documents, full payment details or sensitive personal information in ordinary guide, chat or upload fields.

We receive information directly from you, from hosts and authorised team members, from activity in the service, and from providers you choose to connect or use. When a host requests a property import, Homy may obtain information from the supplied public property listing or webpage using import providers. Public availability does not remove the information’s personal-data protections.

If a host adds another person’s information, the host is responsible for having an appropriate basis and providing the relevant notice.

Account creation, authentication and service delivery: to provide the service requested by a customer. Where you personally contract with Homy, the basis is performance of that contract or steps taken at your request before contracting. For staff or representatives of a business customer, the basis is our legitimate interest in administering the business relationship and authorised access.

Billing and contractual administration: to manage subscriptions, payments, invoices, cancellations and refunds, on the basis of contract performance, applicable legal obligations and legitimate interests in administering business accounts, as appropriate.

Security, reliability and support: to prevent misuse, investigate problems, enforce service limits and respond to requests. The basis is our legitimate interest in maintaining and protecting the service, contract performance where applicable, and any relevant legal duty. Host-directed processing remains subject to the host’s instructions and lawful basis.

Service usage information: to operate visit limits and provide guide statistics, and to understand and maintain the service. Where Homy determines the purpose, we assess our legitimate interests against affected people’s rights. Where information is processed for the host, the host determines the basis. A legitimate interest under data-protection law does not replace any separate consent required for access to or storage on a device.

Optional communications and tracking: where consent is required, it must be obtained separately and may be withdrawn. Accepting Terms of Service is not consent to marketing. We may also process information to meet legal obligations or establish, exercise or defend legal claims.

Homy uses authentication cookies for sign-in and security, a locale preference, and a first-party “homy” device cookie. The device cookie can be set in account-related flows and when a guide tracking event is recorded; it supports device recognition, guide visit limits and statistics. The “homy” and locale cookies are configured with a maximum lifetime of one year when set by Homy. Actual persistence also depends on browser settings and subsequent updates.

Referral flows can use referral cookies to attribute a referral. The browser can also store local preferences, unfinished property information, a pending registration/claim marker and, where the guest assistant is used, local conversation history. The pending claim marker expires after 24 hours in the claim flow. Other browser records may remain until the relevant flow clears them or you clear site data.

Stripe and other embedded services may use their own device technologies when you use them. You can manage cookies and local storage through your browser; removing essential data can sign you out or remove local drafts and preferences. Where consent is legally required for a technology or purpose, it must be obtained before that use; this policy does not itself obtain consent.

Information is shared with authorised personnel and service providers to the extent required for their function. The code integrates Cloudflare for application delivery, storage, caching, analytics infrastructure and some AI operations; Prisma for database access; Resend for email delivery; and Stripe for payments and subscriptions.

Enabled import, AI, mapping and upload features may also use Apify, Firecrawl, Google services, OpenAI and UploadThing. Diagnostic tooling includes Sentry, whose use depends on the deployed runtime configuration. Not every optional integration runs for every visitor or every account. Supplier entities, contractual roles, locations and transfer safeguards must be established for the services actually in use; the DPA’s Schedule C identifies the authorised processors for host-controlled information.

Hosts and authorised team members can see the information made available to them through their guides and account permissions. Anyone who receives a public guide link may be able to view its published content. A public guide is not a private document vault.

We may disclose information to professional advisers, competent authorities or other parties where necessary for a legal duty or legal claim. In a business transfer or closure, any further processing or transfer must have a lawful basis and appropriate safeguards. Independent payment, mapping, booking and other third-party services may act as controllers for their own purposes, as explained in their notices.

ROCCHI GROUP FZCO is based in the United Arab Emirates. Access by Homy and processing by its suppliers may involve countries outside the EEA or the United Kingdom. This service should not be understood as guaranteeing EU-only storage or access.

Where data-protection law restricts a transfer, an applicable adequacy decision or another valid safeguard, such as the relevant standard contractual clauses with necessary supplementary measures, is required before the transfer. The applicable mechanism must be assessed for the actual recipient and processing arrangement; use of a provider name alone does not establish a valid transfer mechanism. Contact privacy@myhomy.app for information about the safeguards applicable to your data and a copy where available, subject to appropriate redactions.

Account and listing information is retained for the service relationship and the purposes for which it is required, subject to deletion requests, contractual data-return arrangements and any applicable legal retention duty. Cancelling renewal and requesting account deletion are separate actions. For host-controlled data, the DPA provides a 30-day return-request period after termination and deletion of active copies within the following 30 days unless an earlier lawful deletion instruction or a mandatory retention/retrieval rule applies.

The standard host interface does not currently offer a general automatic retention-period selector. Hosts can use the available content controls or contact privacy@myhomy.app with export, deletion or retention instructions.

Guide analytics holds up to 400 daily buckets with recorded activity, dropping older buckets as that limit is exceeded. This is a bucket-count limit, not a guarantee of deletion after 400 calendar days. The all-time device index does not have automatic age-based expiry in the current application. A 30-day chart does not mean the underlying records are deleted after 30 days.

Billing, dispute and compliance records are kept for the periods required by the applicable obligation or claim, with access restricted to that purpose. Security and operational logs are retained according to operational need and the configured provider service. After active deletion, residual copies in managed backups are isolated from ordinary use and deleted or overwritten through the provider’s normal retention cycle; if restored for recovery, the deletion instruction is reapplied. Provider-side retention for an optional service is governed by the applicable account configuration and provider terms. Browser storage is described in section 6.

Where enabled, AI can assist with property content, image analysis, recommendations, translations or guest responses. Such processing may transmit selected context to the provider used by that feature. Homy’s service licence does not authorise general-purpose AI training on customer content.

Provider data use, retention and training terms depend on the product and account configuration. No claim of zero retention or provider-wide exclusion from training is made without verifying the applicable terms and settings. In particular, a provider’s paid business API and free service may have different data-use conditions.

AI output can be inaccurate. Hosts must review important content, and guests should confirm important stay information with their host. This policy does not authorise solely automated decisions producing legal or similarly significant effects on an individual; such processing would require a separate assessment, notice and safeguards.

Depending on the applicable law and processing, you may request access to your personal data, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You can object to direct marketing.

Send requests to privacy@myhomy.app. We may need proportionate information to verify identity and locate the relevant data. Where Homy is processor, the host normally decides the request and Homy assists. We will respond within the applicable legal time limits; under the GDPR this is normally one month, with any permitted extension explained to you.

You may complain to the competent data-protection authority, including the authority in your habitual residence, place of work or the place of an alleged infringement where the GDPR applies. For Italy, this is the Garante per la protezione dei dati personali (www.garanteprivacy.it); for the United Kingdom, the Information Commissioner’s Office (ico.org.uk). You do not have to contact Homy before making a complaint.

Homy’s contractual security duties are described in the DPA. The application uses authenticated sessions and listing permissions for protected account operations; public guide content is deliberately available through the configured sharing route. No system can guarantee absolute security. If you suspect an account or data incident, contact legal@myhomy.app.

Host subscription accounts are for adults authorised to act for their business. Guides may be viewed by people accompanying guests, including children; hosts should not enter unnecessary information about children. Contact privacy@myhomy.app if you believe personal information about a child has been included inappropriately.

We may update this policy to reflect changes in the service or applicable requirements. The effective date and version identify the current text. Material changes will be communicated where required; an updated notice does not itself establish consent for a new purpose.

Privacy: privacy@myhomy.app. Billing: billing@myhomy.app. Legal notices: legal@myhomy.app. Postal address: ROCCHI GROUP FZCO, IFZA Business Park, Dubai, United Arab Emirates.