Legal PagesPrivacy Policy
How HostKit collects, uses, shares, sells/shares for advertising, retains, exports, corrects, deletes, and protects restaurant, client, guest, analytics, cookie, SMS, review, AI, and billing data.
Version 2026.06.07 | Effective June 7, 2026 | Last updated June 7, 2026Who this policy covers
- This policy covers HostKit websites, checkout, dashboard, restaurant menu pages hosted by HostKit, support, onboarding, messaging, reservations, reviews, analytics, and marketing workflows.
- Restaurants are usually the business or controller for their own guest/customer data. HostKit is often a processor/service provider for restaurant instructions and may also act as an independent business/controller for HostKit security, billing, support, analytics, marketing, compliance, and product improvement.
- Restaurant menu pages include both HostKit legal links and restaurant-specific legal/contact information where configured.
Personal information collected
- Restaurant and account data: owner names, staff names, emails, phone numbers, roles, business details, locations, tax details, billing data, domains, logos, menu content, support records, and account settings.
- Guest and client data: names, phone numbers, emails, reservation details, messages, reviews, ratings, comments, QR/menu activity, preferences, visits, segments, loyalty signals, campaign history, and support interactions.
- Device and online data: IP address, user agent, device/browser details, pages viewed, QR scans, cookies, pixels, conversion events, referrers, and advertising identifiers where enabled.
- Sensitive data is limited to necessary operational information such as allergies, dietary needs, accessibility requests, or special occasions. HostKit restricts sensitive data from advertising and model-training use.
Use of personal information
- Provide, secure, personalize, bill, support, analyze, improve, and troubleshoot HostKit services.
- Operate restaurant menus, messaging, reservations, review requests, customer profiles, segments, analytics, campaigns, and AI-assisted drafts.
- Send transactional notices, service updates, support replies, legal notices, security alerts, marketing communications, and restaurant-authorized customer messages.
- Prevent fraud, enforce legal terms, comply with law, honor privacy choices, respond to requests, maintain suppression lists, and protect customers and the platform.
Sale, sharing, advertising, and opt-out rights
- HostKit may share personal information for cross-context behavioral advertising, retargeting, attribution, audience syncing, or similar advertising technology when those tools are enabled.
- California residents and other users may use Do Not Sell or Share My Personal Information, cookie preferences, and Global Privacy Control to opt out of sale/sharing and targeted advertising.
- HostKit records opt-out choices and applies them to advertising cookies, retargeting tags, audience syncing, and related sharing where technically feasible.
California privacy rights
- Users may request access, deletion, correction, portability, opt-out of sale/sharing, limitation of sensitive personal information, and non-discrimination for exercising privacy rights.
- Requests require email-token verification or another reasonable verification method. Authorized agents may submit requests when legally permitted and verifiable.
- HostKit aims to acknowledge privacy requests within 10 days and complete verified requests within 45 days unless an extension or exception applies.
Retention and security
- HostKit uses long retention for business records, analytics, disputes, security, legal compliance, and product improvement, but retention is category-specific and documented in the Data Usage Policy.
- HostKit uses access controls, audit logs, encryption in transit, secure payment processors, monitoring, backups, least-privilege practices, and incident response processes.
- No security program can guarantee perfect security. Security reports should be sent to security@hostkitapp.com.
Children
- HostKit is a general-audience business service and is not directed to children under 13.
- HostKit does not knowingly collect personal information from children under 13. If such data is identified, HostKit will delete it or take other legally required action.
