ProHost ("the Platform", "we", "us") is a Lebanon-focused marketplace connecting independent healthcare and professional-services specialists ("Specialists") with workspace hosts ("Pro Hosts") who list clinics, offices, and shared practice spaces ("Listings") for rent.
This Privacy Policy explains what personal data ProHost collects from Specialists, Pro Hosts, and anyone browsing the app; why we collect it; how it is stored, secured, and shared; and the rights you have over it. It applies to the ProHost Android application and any associated backend services, and is written to reflect Lebanese law — principally Law No. 81/2018 on Electronic Transactions and Personal Data, and, to the extent applicable, general principles recognized under the Lebanese Penal Code's provisions protecting private life and correspondence (Articles 579–580) and the Code of Obligations and Contracts governing contractual good faith. Where our practices also track internationally recognized data-protection norms (such as the EU General Data Protection Regulation) more closely than Lebanese law strictly requires, we do so voluntarily, as a matter of good practice for our users, not because Lebanese law itself currently imposes an equivalent standalone comprehensive data-protection regime.
The latest version of this policy is always available online at https://pro-host.tech/privacy — check there if you want to confirm you're reading the current version.
Account & identity data: full name, email address, phone number (verified by SMS one-time code through Firebase Phone Authentication), country/governorate/city, and the professional specialty you declare.
Verification documents: a government-issued ID document you upload at registration, and — for Pro Hosts — a proof-of-ownership or right-to-rent document uploaded when publishing a Listing. Both are stored as private files in Firebase Cloud Storage, accessible only to you and to ProHost Administrators; ProHost does not operate an automated or manual review/approval process for either document — they are kept on file, not verified for authenticity, and you remain solely responsible for the accuracy and lawfulness of what you upload.
Location data: the precise GPS coordinates you place a pin at when publishing a Listing (used to plot it on the discovery map), and, with your device permission, your approximate location while browsing the map to show nearby Listings. We do not track your location in the background or outside active use of the map features.
Listing and booking data: everything you enter to publish or book a workspace — title, address, photos, pricing, availability, and the details of any booking request you send or receive, including the other party's name, phone number, and contact details as necessary to complete the booking.
Communications metadata: when you use an in-app "WhatsApp" button to contact another user, ProHost does not see or store the content of that WhatsApp conversation (it happens entirely within WhatsApp, a third-party service you must have installed separately), but we do record that the hand-off occurred — timestamp, initiating account, and target — in our internal audit log, for accountability and dispute-resolution purposes only.
Device and diagnostic data: your Firebase Cloud Messaging push-notification token (to deliver booking alerts to your device), and standard technical logs (crash reports, IP address at time of request, app version) generated by Firebase's infrastructure.
We do not collect payment-card or bank-account data of any kind. ProHost has no in-app payment processing for booking rent — Specialists and Pro Hosts settle rent between themselves, outside the app, by whatever means they agree (commonly cash or bank transfer); subscription/package fees for Pro Host listing tiers, where applicable, are processed through Whish Money, a third-party Lebanese payment provider, and ProHost's servers only ever receive a payment confirmation from Whish, never your card or wallet credentials.
To create and secure your account, verify your phone number, and authenticate you on each sign-in.
To operate the core marketplace function: displaying Listings, matching Specialists with Pro Hosts, and processing booking requests through to acceptance or decline.
To enable direct contact between a Specialist and a Pro Host (the WhatsApp hand-off), which you initiate voluntarily on each occasion.
To send you push notifications about your own bookings, listings, and account status (for example, a booking accepted, a payment reminder, or an account suspension).
To maintain a security and governance audit trail — every listing action, booking action, WhatsApp hand-off, and Administrator action is logged with a timestamp and actor identity, so that misuse, disputes, or account-suspension decisions can be investigated and, where appropriate, explained to you.
To comply with a legal obligation, respond to a lawful request from a competent Lebanese authority, or establish, exercise, or defend a legal claim.
Where we process data for a purpose not listed here, we will seek your consent first.
Firebase (Google Ireland Limited / Google LLC): our sole backend infrastructure provider — authentication, database (Cloud Firestore), file storage (Cloud Storage), push notifications (Cloud Messaging), and serverless backend logic (Cloud Functions) all run on Firebase. Data may accordingly be processed and stored on Google's servers outside Lebanon (see Section 6, International Transfers).
Whish Money: receives only the minimum information needed to process a subscription/package payment you initiate (your name, phone, and the amount) — it never receives, and ProHost never stores, your card or wallet credentials.
The other party to a booking or Listing: a Specialist's name, specialty, and contact details are shared with a Pro Host when the Specialist submits a booking request to that Pro Host's Listing (and vice versa) — this is inherent to how the marketplace functions, and cannot be turned off without disabling the booking feature itself for your account.
Lebanese authorities: only where required by a valid legal process (a court order, a request from the Public Prosecution, or an equivalent binding legal demand) or to protect the rights, property, or safety of ProHost, our users, or the public.
We do not sell your personal data to advertisers or third-party data brokers, and we do not run third-party advertising on the ProHost app.
We retain your account and profile data for as long as your account remains active, and for a reasonable period afterward (currently up to 24 months) to resolve any outstanding disputes, satisfy legal or accounting retention obligations, and prevent fraudulent re-registration.
Audit-security logs (the record of listing, booking, WhatsApp hand-off, and Administrator actions described in Section 3) are retained indefinitely as an immutable governance record, since their evidentiary value does not diminish over time — however, they are never publicly visible and are accessible only to ProHost Administrators.
If you delete your account (Section 8), we delete your profile, uploaded documents, and Listings within a reasonable operational period, except where a copy must be retained for the legal or dispute-resolution reasons above, or where the data has already been embedded in another user's booking/audit record (for example, a completed booking's historical record is not erased from the other party's booking history merely because you delete your own account).
Because ProHost is built entirely on Firebase, your data may be stored and processed on Google's servers located outside Lebanon, potentially including the European Union, the United States, or other jurisdictions where Google operates data centers. By using ProHost, you acknowledge and accept that this cross-border transfer is a necessary and unavoidable feature of the app's infrastructure. Google maintains its own data-protection and security certifications for Firebase; we encourage you to review Google's Firebase-specific privacy and security documentation for further detail on their safeguards.
We reserve the right to migrate our backend infrastructure — including to a different cloud provider, a different region, or a data store we operate ourselves — at any time, for reasons including but not limited to cost, performance, regulatory compliance, or the development of a successor or related application. Your data will be migrated under the same protections described in this Policy, and we will update this Policy and, where the change is material, notify you in-app in advance of the migration taking effect.
Access to your account requires phone-number verification via a one-time SMS code. Administrator access to the platform's governance tools is itself role-gated by server-verified credentials, not a client-side toggle.
Sensitive fields — your account role, verification status, suspension status, and payment/entitlement records — can only ever be written by our server-side Cloud Functions, never directly by any app (including a modified or reverse-engineered one), which materially reduces the risk of client-side tampering.
Uploaded documents (ID, proof of ownership) are stored in access-controlled Cloud Storage locations readable only by you and by Administrators — they are never publicly listed or indexed.
No system is perfectly secure. If we become aware of a data breach that creates a real risk to your rights or freedoms, we will notify affected users through the app and, where legally required, notify the competent Lebanese authority, without undue delay.
You may access, correct, or update most of your profile information directly in the app's Profile screen at any time.
You may request a copy of the personal data we hold about you, request its deletion, or object to a specific processing activity, by contacting us using the details in Section 11. We will respond within a reasonable time, and in any case no later than 30 days, except where a longer period is justified by the complexity of the request.
Deleting your account is available in-app (Profile → Delete Account) and takes effect subject to the retention exceptions described in Section 5. If you no longer have access to the app, you can also request deletion at https://pro-host.tech/delete-account.
If you believe your data has been mishandled, you may also raise a complaint with the competent Lebanese authority responsible for electronic transactions and data matters under Law No. 81/2018, in addition to contacting us directly.
ProHost is intended for licensed and practicing professionals and property hosts, and is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal data from a minor. If we learn that we have inadvertently collected data from a minor, we will delete it promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices, our infrastructure, or the law. We will post the updated version in-app with a new effective date, and for material changes we will provide reasonably prominent notice (such as an in-app banner) before the change takes effect. Continued use of ProHost after an update constitutes acceptance of the revised Policy.
For any privacy question, access/deletion request, or complaint, contact ProHost's data-protection point of contact through the in-app support channel listed in your Profile screen, or by the email address published on ProHost's Google Play Store listing.
Legal disclaimer: This document is a genuine, substantive draft prepared specifically for ProHost's actual features and Lebanon's applicable legal framework. It is provided for transparency to users and to support Google Play Store data-safety submission requirements, but it does not constitute legal advice, and ProHost recommends this Policy be reviewed by a licensed Lebanese attorney before being relied upon as final.