Legal

Privacy Policy

How Resipilot collects, uses, and protects personal data.

Last updated: 17 April 2026

1. Who we are

"Resipilot", "we", "us", and "our" refers to the entity providing the platform to you, depending on where you are located:

  • European Economic Area (EEA), United Kingdom, and Switzerland: Peak Property sp. z o.o., a Polish limited liability company with its registered office at ul. Hoża 29, 00-521 Warsaw, Poland (the "EU Controller").
  • Rest of the world: Hoza Holdings Pte. Ltd., a Singapore private limited company with its registered office at 21 Tan Quee Lan Street, #02-04 Heritage Place, Singapore 188108 (the "Global Controller").

For users in the EEA, UK, and Switzerland, the EU Controller is the "data controller" of your personal data within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

2. Contact

For any privacy-related question, or to exercise your rights under applicable data-protection law, contact us at privacy@resipilot.com, or in writing at the registered office of the relevant entity above.

3. Personal data we collect

We collect the following categories of personal data:

  • Account data: name, email address, phone number, password (hashed), authentication identifiers (including Google account ID if you sign in via Google).
  • Property and business data: addresses of properties, ownership structures, revenue and expense records, tax identifiers, and other data required to operate the platform.
  • Identity verification data: where required for KYC/AML, compliance, or host/tenant verification — government-issued ID, date of birth, nationality, and verification outcomes (we use third-party processors for this; see section 6).
  • Guest/tenant data that you provide to us for the operation of bookings or tenancies (name, contact details, stay details).
  • Usage and device data: IP address, browser and device identifiers, pages viewed, timestamps, and interactions with the product.
  • Communication data: emails, chat messages, and support requests you send us.
  • Payment data: processed directly by our payment providers; we do not store full card numbers on our servers.

4. Legal bases for processing (EEA/UK users)

Under the GDPR and the UK GDPR, we process personal data on the following legal bases:

  • Performance of a contract (Article 6(1)(b)) — to provide the services you have signed up for.
  • Legal obligation (Article 6(1)(c)) — to comply with tax, accounting, short-term rental licensing, anti-money-laundering, and other statutory obligations.
  • Legitimate interests (Article 6(1)(f)) — to operate, secure, and improve the platform, prevent fraud, and communicate with our customers. Where we rely on this basis we have balanced our interests against your rights and freedoms.
  • Consent (Article 6(1)(a)) — for optional marketing communications and non-essential cookies. You may withdraw consent at any time.

5. Purposes of processing

We use personal data to:

  • Create and administer your account and authenticate you;
  • Operate short-term, mid-term, and long-term rental workflows (listings, pricing, bookings, guest/tenant communications, payouts);
  • Provide accounting, reporting, and compliance features including tax filings and licensing where you have engaged us to do so;
  • Verify identities of users, hosts, guests, and tenants;
  • Protect the security and integrity of the platform, including fraud detection;
  • Communicate with you about the service and respond to your requests;
  • Comply with legal obligations.

6. Recipients and third-party processors

We share personal data only where necessary to provide the service or to meet a legal obligation. Categories of recipients include:

  • Cloud hosting and infrastructure providers (e.g., Digital Ocean, Amazon Web Services);
  • Authentication providers (WorkOS, Google) when you sign in with third-party credentials;
  • Payment processors (e.g., Stripe) when you make or receive payments through the platform;
  • Identity verification providers (e.g., Didit, or equivalent providers);
  • Channel managers and booking platforms you connect to your account;
  • Professional advisers (accountants, lawyers, auditors);
  • Regulatory and tax authorities where required by law.

All processors act on our instructions under a written data-processing agreement.

7. International transfers

Personal data of EEA/UK users may be transferred to countries outside the EEA/UK — including to our Singapore affiliate and to sub-processors located in the United States or elsewhere. Where we transfer personal data outside the EEA/UK to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and, where relevant, supplementary technical and organisational measures. Copies of these safeguards are available on request at privacy@resipilot.com.

8. Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

  • Account data: for the duration of your account plus up to 24 months after closure;
  • Accounting, invoicing, and tax records: for the period required by applicable law (in Poland, typically 5 years from the end of the relevant accounting year);
  • Identity verification records: for the period required by applicable AML/KYC rules;
  • Marketing data: until you withdraw consent or object.

9. Your rights (EEA/UK users)

Subject to applicable law, you have the right to:

  • Access your personal data and receive a copy of it;
  • Have inaccurate or incomplete data corrected;
  • Have personal data erased in certain circumstances;
  • Restrict or object to certain processing;
  • Receive your data in a portable format where applicable;
  • Withdraw consent at any time where processing is based on consent;
  • Lodge a complaint with your local supervisory authority — in Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

To exercise any of these rights, contact us at privacy@resipilot.com. We will respond within one month of a valid request, as required by the GDPR.

10. Cookies and similar technologies

We use strictly necessary cookies to operate the platform (for example, to keep you signed in and to prevent CSRF). We also use analytics cookies where you have consented. You can manage non-essential cookies through your browser settings or any in-product cookie banner we provide.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects on you based solely on automated processing. Where algorithmic pricing, scoring, or matching features are used, they are tools that inform — but do not replace — human decisions you or our team take.

12. Children

The platform is not directed to individuals under the age of 18 and we do not knowingly collect personal data from minors.

13. Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, and disclosure. These include encryption in transit, access controls, logging, and regular security reviews. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified to you by email or through the product. The "last updated" date at the top of this page reflects the current version.