FortySix
Log in Start free trial

Legal

FortySix Privacy Notice

Draft for legal review Last updated 5 October 2026

This notice explains how FortySix Technologies Ltd ("FortySix", "we") collects and uses personal data. FortySix is software that hostels and small hotels use to run their bookings, bar and shop sales and bookkeeping.

We handle personal data in two roles. For the hostels that use FortySix, their staff and our own contacts, we decide how the data is used: we are the controller (in Mexico, the "responsable"). For hostel guests, we store and process their details only on the hostel's instructions: the hostel is the controller and we are its processor (in Mexico, its "encargado"). If you were a guest at a hostel, please contact that hostel first about your data; we will help it answer you.

1. Who we are

FortySix Technologies Ltd, registered in England and Wales, company number 17487825. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

Contact for anything about your data: support@fortysix.app.

2. The data we collect

  • Property owners and managers: name, email address, property name and address, tax ID (if given), login details (your password is stored only in hashed form), settings, and the problem reports and messages you send us.
  • Hostel staff: name, role, email and phone (if the hostel adds them, e.g. for rota emails), a staff PIN (stored only in hashed form), and a record of actions taken in FortySix (the audit log).
  • Hostel guests (on the hostel's behalf): name, email and phone, booking dates, bed or room, prices, payments recorded, booking references, booking details received from booking sites such as Hostelworld or Booking.com through our channel manager, and, where the law of the hostel's country requires it, nationality and passport or ID details (never document photos).
  • Technical data: error reports from the app and server logs, which can include IP addresses.
  • We do not collect or store card numbers. Card payments are handled by certified card processors; FortySix only records the amount and how it was paid. We do not collect sensitive personal data on purpose.

3. Why we use it, and on what basis

  • To provide FortySix to the hostels that use it: running their bookings, sales, bookkeeping, staff rota and guest invoices (contract).
  • To connect hostels to booking sites, send emails they ask us to send (such as guest invoices and staff rotas) and support them (contract).
  • To keep FortySix secure, prevent misuse and fix errors (legitimate interests).
  • To keep business and tax records, and to meet other legal obligations (legal obligation).
  • We do not sell personal data, and we do not use it for advertising. We only send product news to customers if they agree, and they can stop it at any time.
  • Mexico: all the purposes above are needed for the service (finalidades primarias). We do not use personal data for secondary purposes.

4. Who we share it with

Only with the service providers we need to run FortySix, under contracts that require them to protect the data, and with others only when the hostel asks us to or the law requires it:

  • Supabase (database and sign-in), with the data stored in the EU (Ireland).
  • Cloudflare (hosting the app and the website).
  • Channex (channel manager, connecting hostels to booking sites).
  • Resend (sending emails), from its EU region.
  • Google Workspace (our email).
  • Stripe (payments), once card payments through FortySix are offered.
  • Booking sites and other services a hostel connects, on that hostel's instructions.

5. International transfers

Our main database is in the EU. Some providers are based in, or can access data from, other countries such as the United States. Where data leaves the UK or the EU, we rely on the legal safeguards for that, such as the UK and EU standard contractual clauses. For Mexico, the transfers above are made to providers acting on our behalf to provide the service.

6. How long we keep it

  • Account data: while the account is open, then deleted on request, except records we must keep for tax and accounting (normally 6 years in the UK).
  • Guest data: for as long as the hostel keeps it in FortySix, and deleted when the hostel's account is deleted. Guests' nationality and passport details are deleted 13 months after the stay.
  • Logs: connection and integration logs for 180 days; app error reports for 30 days.
  • Backups are kept for a short period and then overwritten.
  • A hostel can download all of its data at any time from Account & Data.

7. How we protect it

Data is encrypted in transit and at rest, PINs and passwords are stored only in hashed form, each hostel can see only its own data, and access is limited to what each role needs.

8. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable form. In Mexico these are your ARCO rights (access, rectification, cancellation and opposition); you can also withdraw your consent or limit how your data is used or shared.

To make a request, email us with your name, how to reach you, what you are asking for, and a copy of an ID document (or that of your representative). We will reply within the time the law sets: one month in the UK and EU, 20 working days in Mexico. Guests: we will pass your request to the hostel, which decides on it.

If you have a complaint about how we handle your data, tell us at the address above and we will look into it and reply. In the UK and the EU you can also complain to the data protection authority: the Information Commissioner's Office (UK) or the Agencia Española de Protección de Datos (Spain).

9. Cookies

The FortySix app uses only what it needs to work: storage in your browser that keeps you signed in and remembers settings on that device. We do not use advertising or tracking cookies.

10. Changes to this notice

We will publish any change here with a new date, and tell hostels in FortySix when a change matters to them.