Privacy Policy
Last updated 23 October 2026
This Privacy Policy explains what information Hestio collects, how we use it, where it is stored, and the choices you have. By using Hestio you agree to the practices described here.
Information We Collect
We collect the information you provide when you create an account or use the service — such as your name, email address, and building and unit details — and information generated as you use Hestio, including maintenance requests, bookings, payments and messages. If you add a bank account as a payment method, we also collect your account holder name and bank account and routing numbers.
How We Use Your Information
We use your information to operate the service, manage your building and residency, process payments, send notifications, provide support, and keep the platform secure. We do not sell your personal information.
Where Your Data Is Stored
Hestio runs as separate regions, one per country. A company — with its buildings, units, residents, payments and files, and the accounts of its managers and residents — lives in exactly one region, the region of its country. Every region runs as its own deployment, with its own database, files and backups, and its own encryption keys; the personal data it holds is not copied to another region. We store your information with a cloud hosting provider; it may be stored and processed outside your province or country. hestio.ca runs Hestio Control, where Hestio staff manage companies, prices and subscriptions. About the regions it keeps only company-level information — company names, markets, building and unit counts, money totals per currency — and platform alerts, never residents' personal data.
Payments
Online payments are processed by the payment provider your building's company has connected — Stripe, PayPal, Mercado Pago, Tilopay (cards and Yappy) or PagueloFacil, depending on the country — on the provider's own secure page and under its own terms and privacy policy. These providers are certified under the PCI-DSS payment-security standard; we never receive or store full card numbers. Companies pay their Hestio subscription by card through Stripe. If you instead add a bank account directly (a manual bank or void-cheque account), the details are stored in your region, encrypted with strong AES-256 encryption using per-building keys, and only the last four digits are kept in readable form for display.
Service Providers
We use a small number of service providers to run Hestio, and each receives only what its task needs: • Hosting, storage and backups: Amazon Web Services, for every region and for Hestio Control. • Email, every region: Mailgun Technologies, Inc. (United States) delivers our emails; it receives your email address and the content of the email. • Payments: Stripe, PayPal, Mercado Pago, Tilopay and PagueloFacil, as offered in your country and connected by your building's company. Tilopay also receives the billing address you type in Hestio's pay window; Hestio keeps none. Stripe also processes the companies' Hestio subscriptions. • Help assistant, every region: Anthropic, PBC (United States) answers the questions typed into the in-app help. It receives only the question, not your account — please don't type personal information into it. • Analytics, every region, only if you accept cookies: Google Analytics (Google LLC, United States). • Fonts, every region: the app's typefaces are loaded from Google Fonts (Google LLC), which receives your IP address and browser details, as with any web request. • Push notifications, only if you turn them on: your browser's push service (for example Google, Apple or Mozilla) delivers them; the messages are encrypted, so that service cannot read them.
International Transfers and Safeguards
Your region's database, files and backups stay where the region is hosted, as described above. Personal data leaves your region only where the service needs it: • emails are delivered through Mailgun in the United States; • an online payment is processed by the payment provider you use, which may process it in another country; • a question you type into the help assistant goes to Anthropic in the United States; • Google receives analytics (only with your consent) and the requests for the app's fonts; • Hestio's support staff, who may work from another country, can view your region's data when they help you or your building's management and to keep the service running. What they can see and do depends on their permissions; they reach your region through a secured staff sign-in that is recorded; changes made in your company's or building's space by support staff with edit access to company and building spaces are recorded (this record does not cover Hestio's platform administrators); and nothing they view is copied out of your region. We protect these transfers with contracts that oblige our providers to safeguard your data (data-processing agreements and, where the law requires them, standard contractual clauses), with encryption in transit (TLS), and by sending each provider only what its task needs. Each transfer relies on a ground recognised by the data-protection law of your country — for example, in Panamá, Law 81 of 2019 and Executive Decree 285 of 2021, which allow transfers needed to provide the service you use and transfers covered by adequate safeguards.
Cookies & Tracking
We use a few cookies and similar browser storage: • Essential: a secure cookie that keeps you signed in (it ends when you sign out, 8 hours after you sign in unless you chose “Keep me logged in”, and in any case after 7 days without a visit); a cookie that remembers your region (hestio_region, for one year, shared by hestio.ca and the regional sites so we can take you to your region's sign-in); a cookie that remembers your cookie choice (six months); and your browser's local storage for settings such as your language and theme. • Analytics: Google Analytics cookies, set only after you accept them (see below). You can change your choice at any time with “Cookie settings” at the bottom of every page, or in your browser settings.
Google Analytics
We use Google Analytics 4 (Google LLC) for anonymous statistics about how Hestio is used, in every region. It is loaded only after you accept cookies. It receives the kind of page you open — its template, such as “/manager/:buildingId/finances” — never ids, names, email addresses or searches; we send no user id, and Google signals and ad personalisation are switched off. Like any web service, Google also receives the technical details of each request (your IP address and browser), from which it derives an approximate location. If you decline, Google Analytics is not loaded. You can change your choice with “Cookie settings”, or use the Google Analytics opt-out browser add-on.
Data Sharing
We share information only as needed to provide the service: with your building's management and its company (for example your unit, lease, payments and requests), with the service providers listed above, with Hestio staff as described above, and where required by law. We do not sell your personal information.
Data Security
We apply industry-standard administrative, technical and organisational safeguards to protect your information. Data is encrypted in transit using TLS (HTTPS), and sensitive data is encrypted at rest. Each region has its own encryption keys, and its backups are encrypted and kept where the region is hosted. Card payments are handled by PCI-DSS-certified providers, and any bank account details we store are protected with strong AES-256 encryption using per-building keys, with access restricted to authorised personnel on a need-to-know basis and logged. However, no method of transmission over the internet or electronic storage is completely secure; while we protect your information using commercially reasonable means, we cannot guarantee its absolute security.
Deleted Files, Trash and Backups
When your building's management deletes a building document, an attachment, a unit photo or a floor plan, it first goes to a trash, where it can be restored for 30 days; after that it is deleted for good. When a building document or a lease file is replaced, the earlier versions are kept as its version history until the file itself is deleted. Other files — profile photos, building and maintenance photos, delivery photos and payment receipts — are deleted as soon as they are removed. A download link that was already opened keeps working for at most 24 hours. Each region is backed up every hour where it is hosted; a backup is kept for at most six months (hourly ones for a day, then daily, weekly and monthly ones) and then deleted, so deleted data disappears from the backups within that time. Deleted files also stay in the file storage's version history for up to 30 days.
Data Retention & Deletion
You can ask us to delete your account at any time. When you do, we anonymise your personal data rather than retaining it: your name, email and phone number are removed or overwritten, you are removed from your units and buildings, your saved bank details are deleted, and messages you wrote are redacted. All your personal files are deleted for good: your profile photo, the delivery photos addressed to you, and the photos you attached to your own maintenance requests. Records you added to a building while managing it (building documents, lease files, unit photos and floor plans) belong to that building's records and stay there, no longer linked to your name, so leases and building records remain complete. Payment receipts you uploaded, invoices and payment history are kept because the law requires us to retain accounting records (GDPR Article 17(3)(b)) — only in a form that no longer identifies you.
Your Rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details below.
Contact Us
If you have questions about this Privacy Policy or how we handle your data, contact us at privacy@hestio.ca.