1. Who We Are

ProHost ("we", "us", "our") operates a mobile and web platform that connects independent professionals ("Specialists") with property owners or operators ("Pro Hosts") who list rentable clinic, office and workspace subdivisions. We act as a platform intermediary and are not a party to any rental agreement between users. ProHost is the data controller (or, for California and similar U.S. state laws, the "business") responsible for the personal data described in this Policy.

2. Data We Collect

2.1 Account Data

• WhatsApp number — entered by you so hosts and guests can reach you about bookings; it is not verified by SMS. You sign in with your email (one-time link or code) or Google; we do not store passwords.
• Email address — used for email or Google sign-in, sign-in codes and service emails (booking and subscription notices).
• Display name and specialty/profession — provided during registration; shown to the other party in a booking transaction.
• Profile photo — optional; stored in Google Cloud Storage if uploaded.
• Government-issued ID document — collected only if and when you complete identity verification ("KYC") in order to become a Pro Host; never requested at registration, and never required of a Specialist. It is reviewed by a ProHost Administrator before your account is approved as a Pro Host.

2.2 Listing and Booking Data

• Space address, GPS coordinates, photos, pricing and availability configured by Pro Hosts.
• Booking requests, confirmation status and rental period.
• WhatsApp phone number shared at the point of confirmed booking (Specialists see host's number and vice versa).

2.3 Usage and Device Data

• Approximate location (device GPS), used only while the app is open to show nearby spaces. Not stored server-side continuously.
• Crash logs via Google Firebase Crashlytics — anonymised and never linked to your account.
• Usage analytics (only if you choose "Allow") via Google Analytics for Firebase: screens opened, searches and filters used, listings and rooms viewed, booking and subscription steps, and errors. These events are linked to your pseudonymous ProHost code (U-…), your role, country/governorate, plan status and account-age range — never to your name, email, phone number or the advertising ID. Some subscription and booking events (e.g. renewals, cancellations) are sent from our servers on your behalf, only while your choice is "Allow". Nothing is collected until you choose, and you can change your choice any time in Profile › Privacy. Analytics data is never used for advertising.

2.4 Subscription and Purchase Data

• If you subscribe to ProHost Premium, Google Play processes the payment; we never receive your card or bank details. We receive and store the Google Play purchase token, order ID, plan (monthly or yearly), subscription status and renewal/expiry dates, linked to your account, to verify the purchase, grant and remove Pro Host access and prevent fraud.

2.5 Communications

ProHost does not host or store chat messages. Direct communication happens on WhatsApp, which is governed by Meta's own privacy policy. We only store the event record (booking request/acceptance) within our platform.

2.6 Website Contact Form and Newsletter

• When you use the contact form on pro-host.tech we store your name, email, and, if you give them, your phone number, organization, role and message, and we email your request to our team at admin@pro-host.tech so we can answer you.
• If you tick "Send me ProHost news and offers" or subscribe to the newsletter, we keep your email (and the details you gave) in our mailing list and send you occasional ProHost news and offers from noreply@pro-host.tech. Every email has an Unsubscribe link that removes you immediately; you can also write to admin@pro-host.tech.
• This data is stored in Google Firebase, is accessible only to ProHost administrators, and is never sold. We keep contact requests for as long as needed to handle them and our relationship with you, and newsletter data until you unsubscribe (after which we keep only a record that you opted out, so we don't email you again).

3. How We Use Your Data

• To verify identity and prevent fraud (sign-in by email link/code or Google, and ID verification for Pro Hosts only).
• To display your listing to users searching in the app.
• To facilitate booking requests and confirmations.
• To provide customer support and investigate disputes.
• To comply with legal obligations, including data-protection, consumer-protection, and tax/accounting laws applicable in the jurisdictions where we or our users operate.
• To improve the platform through aggregated analytics — never sold to third parties.
• To answer website contact requests and, only with your consent, to send ProHost news and offers (see 2.6).

4. Legal Bases for Processing

Where the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR, or an equivalent law applies to our processing of your personal data, we rely on the following legal bases:

• Contract performance (GDPR Art. 6(1)(b)) — processing necessary to register your account and fulfil booking transactions you initiate.
• Legitimate interest (GDPR Art. 6(1)(f)) — fraud prevention, ID verification for Pro Hosts, platform security, and aggregated analytics, balanced against your rights and never overriding them.
• Consent (GDPR Art. 6(1)(a)) — optional analytics and marketing communications; you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation (GDPR Art. 6(1)(c)) — compliance with applicable law, including responding to a lawful request from a competent authority.

5. Data Sharing

We do not sell your personal data, and we do not "share" it for cross-context behavioural advertising as that term is used in the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). We share data only as follows:

• Between users — a Specialist's name, specialty and phone number are shared with a Pro Host upon a confirmed booking, and vice versa.
• Google / Firebase — Firebase Authentication, Firestore, Cloud Storage, Functions, Crashlytics and Analytics are operated by Google LLC / Google Ireland Limited as our service provider / processor under appropriate data processing terms. See Firebase Privacy.
• Google Play — subscription purchases are processed by Google under the Google Play Terms of Service and Google's privacy policy; we exchange the purchase token with Google's Play Developer API to verify and manage your subscription.
• Legal process — we may disclose data if required by a valid court order, legal obligation or to protect the rights and safety of users.
• Business transfer — in the event of a merger, acquisition or asset sale, data may transfer subject to the same privacy commitments described here, and you will be notified of any change in controller.

6. Data Retention

• Active account data is retained while your account remains open.
• Booking records are retained for five (5) years for legal and dispute-resolution purposes, or longer where a longer statutory limitation period applies in the relevant jurisdiction.
• Subscription and purchase records are kept while the subscription is active and for up to five (5) years after it ends, for tax, accounting and chargeback/fraud purposes.
• Upon account deletion, personal data is purged within thirty (30) calendar days except where retention is required by law.
• Pseudonymous analytics events are kept for 14 months in Google Analytics and for up to 26 months in our private BigQuery export; aggregated, non-identifiable reports may be retained indefinitely. Withdrawing consent stops collection and resets the analytics identifier on your device.

7. Your Privacy Rights

Your specific rights depend on where you live. We honour the applicable rights below for every user, regardless of location, as a matter of policy — not only where strictly required by law.

7.1 If You Are in the EEA, UK, or a Similar GDPR-Aligned Jurisdiction

• Access (Art. 15) a copy of personal data we hold about you.
• Rectification (Art. 16) of inaccurate or incomplete data.
• Erasure (Art. 17) of your account and associated personal data — available directly in the app (Profile → Delete Account) or by written request to admin@pro-host.tech or via our web request form. Processed within 30 days.
• Restriction of processing (Art. 18) and objection (Art. 21) in certain circumstances.
• Data portability (Art. 20) — a machine-readable export of data you provided.
• Withdraw consent (Art. 7(3)) for optional analytics or communications at any time.
• Lodge a complaint with your local data protection supervisory authority — see Section 12.

7.2 If You Are a California or Other U.S. State Resident

Under the CCPA/CPRA and similar state laws (for example Virginia's VCDPA, Colorado's CPA, and Connecticut's CTDPA), you may have the right to:

• Know / Access the categories and specific pieces of personal information we have collected about you and the purposes for collection, as described in Section 2 and Section 3.
• Delete personal information we have collected from you, subject to certain exceptions (e.g. completing a transaction, legal compliance).
• Correct inaccurate personal information.
• Opt out of "sale" or "sharing" — we do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of; we do not use dark patterns to obscure this fact.
• Limit use of sensitive personal information — we do not use your government ID document or precise geolocation for any purpose beyond identity verification, safety, and providing the core booking/discovery features you request.
• Non-discrimination — we will not deny you goods or services, or provide a different level of service, because you exercised a privacy right.
• Appeal a denied request, and designate an authorised agent to submit a request on your behalf (subject to identity verification).

To exercise any right in Section 7.1 or 7.2, contact us at admin@pro-host.tech. We will verify your identity before acting on a request and will respond within the time required by applicable law (generally thirty (30) to forty-five (45) days).

8. Security

We employ industry-standard security measures: HTTPS-only data transmission, Firebase Security Rules limiting data access to authenticated owners, server-side-only enforcement of sensitive fields (role, verification status, payment entitlements), and no storage of passwords or payment card data. No system is perfectly secure; we cannot guarantee absolute security. If we become aware of a data breach creating a real risk to your rights, we will notify affected users and, where legally required, the competent supervisory authority, without undue delay and in any event within the timeframe required by applicable law (for example 72 hours under GDPR Art. 33 where feasible).

9. Cookies and Tracking on This Website

The ProHost marketing website (pro-host.tech) uses no third-party advertising or behavioural-tracking cookies. Google Fonts are loaded from Google's servers; see Google's Privacy Policy for how font requests are handled. We honour the Global Privacy Control (GPC) signal and equivalent "Do Not Track" browser signals as a valid opt-out request under CCPA/CPRA where applicable, though as noted in Section 5 we do not sell or share personal information in any event.

10. Children's Privacy

ProHost is not directed at persons under 18 years of age (or the age of majority in your jurisdiction, if higher). We do not knowingly collect personal data from minors. If we become aware that a minor has registered, we will delete the account and associated data promptly.

11. Limitation of Liability and Disclaimer

To the maximum extent permitted by applicable law, ProHost's aggregate liability arising out of or in connection with the collection or use of personal data shall not exceed the total fees paid by you (if any) to ProHost in the twelve (12) months preceding the claim. See the Terms of Use, Sections 11–12, for our full limitation of liability and your indemnification obligations, and Section 17.3 of the Terms of Use for the non-waivable rights preserved for users in the EU/UK, Australia, California, and similar jurisdictions.

We are not liable for: (a) any consequential, indirect, incidental or punitive damages; (b) any loss of data resulting from the actions of third-party service providers such as Google Firebase; or (c) any breach resulting from a force majeure event as described in the Terms of Use.

12. International Data Transfers & Regional Compliance

ProHost's infrastructure runs on Google Firebase / Google Cloud, which may process and store data in the United States, the European Union, or other countries where Google operates data centres. Where we transfer personal data protected by the GDPR or UK GDPR outside the EEA or UK to a country not deemed adequate by the European Commission or UK authorities, we rely on an appropriate safeguard recognised under Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum), which Google offers to Firebase/Cloud customers, together with Google's own supplementary security measures.

EU/UK/EEA users: you may lodge a complaint with the supervisory authority in your country of habitual residence or place of alleged infringement (for example, the Irish Data Protection Commission for the EU, or the UK Information Commissioner's Office for the UK) at any time, in addition to contacting us directly.

California and other U.S. states: the rights and disclosures in Section 7.2 apply to you regardless of where our servers are physically located.

Lebanon: we operate in compliance with Lebanese Law No. 81/2018 (Electronic Transactions and Personal Data) and applicable consumer-protection obligations. Users located in Lebanon have all rights described in Section 7.1, applied by ProHost as a matter of policy even though Lebanese law does not currently mandate an identical standalone regime.

We do not transfer personal data to any jurisdiction without an appropriate safeguard of the kind described above, or another legally recognised transfer mechanism, in place.

13. Changes to This Policy

We may update this policy at any time. We will notify registered users of material changes via in-app notification at least fourteen (14) days before they take effect (or a longer period where required by mandatory law in your jurisdiction). Continued use of the platform after that date constitutes acceptance of the revised policy, without prejudice to any right you have to object to a change under Section 7 or to delete your account beforehand.