UniStay Privacy Policy

1. Introduction

UniStay (“UniStay,” “we,” “us,” or “our”) is a hostel-finding and management platform that connects students with hostel owners for accommodation search, booking, and payment. This Privacy Policy explains how Genzcode IT Consult, the developer and operator of UniStay, collects, uses, discloses, and protects information when you use the UniStay mobile application (available on Android, with an iOS release planned) and its associated web platform (together, the “Service”). By creating an account or otherwise using the Service, you agree to the collection and use of information as described in this Privacy Policy.

2. Who We Are

UniStay is developed and operated by Genzcode IT Consult (“Genzcode,” “we,” “us”), based in Ghana. Genzcode IT Consult is the data controller responsible for the personal information described in this Policy. If you have questions or requests concerning your personal information, contact us at [email protected].

3. Scope

This Policy applies to all users of UniStay, including Students searching for and booking hostel accommodation, Hostel Owners listing and managing properties, and Administrators. It applies regardless of whether you access UniStay through the Android app, the iOS app once released, or the web platform.

4. Information We Collect

4.1 Information You Provide Directly

• Account Information: full name, email address, phone number, school/institution, and password (stored only as a one-way bcrypt hash — we never store or can retrieve your plain-text password).
• Profile Information: profile photo, and notification preferences (e.g., whether you want email or SMS alerts).
• Owner Verification (KYC) Information: if you apply to become a Hostel Owner, we collect your Ghana Card number, images of the front and back of your Ghana Card, and a selfie photograph of you holding your ID, for identity verification purposes.
• Business & Banking Information: if you are approved as a Hostel Owner, we collect business details, cancellation policy settings, and bank account details (account name, account number, and bank name) so we can process withdrawal payouts to you.
• Listing Content: if you list a hostel, we collect the hostel name, description, address/location, GPS coordinates, amenities, room details, pricing, and images you upload.
• Booking & Transaction Information: booking dates, room selections, payment amounts, and payment status. Full card numbers and mobile money credentials are entered directly into our payment processor, Korapay, and are not stored on UniStay’s own servers.
• Reviews and Ratings: any review text, star rating, and associated content you submit after a stay.
• Messages: the content of messages you send through UniStay’s in-app messaging system to communicate about a booking (between Students, Owners, and, where relevant, Administrators for support or dispute purposes).
• Support Communications: any information you provide when you contact us at [email protected] or otherwise request support.

4.2 Information Collected Automatically

• Device and Usage Data: device type, operating system, app version, browser type (for the web/WebView build), and general usage/interaction data with the Service.
• Log and Security Data: IP address and user-agent are logged in connection with sensitive account actions (such as login, password changes, and banking-detail changes) for fraud prevention and security auditing.
• Session and “Remember Me” Data: a session identifier is created when you log in; if you choose “Remember Me,” a hashed authentication token is stored on your device and on our servers to keep you signed in. This cookie requires a secure (HTTPS) connection.
• Location Data: with your device permission, we access your approximate or precise location to calculate distance between you and nearby hostels and to support map-based search and driving directions. You can deny or revoke this permission at any time in your device settings; if denied, distance information is simply unavailable, and all other features continue to work normally.
• OTP Verification Data: when you register, reset your password, or update sensitive banking details, we send a one-time password (OTP) via SMS to your registered phone number to confirm it is really you.

4.3 Information From Third Parties

• Payment Confirmation Data: Korapay, our payment processor, sends us transaction status, amount, and a payment reference to confirm whether a booking payment succeeded, failed, or was refunded. We do not receive or store your full card number, CVV, or mobile money PIN.
• SMS Delivery Confirmation: our SMS gateway provider confirms delivery of OTP codes and notification messages sent to your phone number.
• Chatbot Interactions: if you use the AI-powered chat assistant embedded in UniStay (built on the Chatbase platform), the questions and messages you type are processed by Chatbase to generate a response. The chatbot does not access UniStay’s internal database, your booking records, or your account details — it can only see what you type into that conversation. Chatbase’s own privacy practices govern how it processes chatbot conversation content; see chatbase.co for details.

5. How We Use Your Information

We use the information described above to:

• create, authenticate, and secure your account (including OTP verification and password hashing);
• operate core Service features: hostel search, filtering, map display, booking, payment processing, in-app messaging, reviews, favourites, and notifications;
• verify Hostel Owner identity and legitimacy before approving listings, to protect Students from fraudulent or fake listings;
• process payments and payouts through Korapay, and process Owner withdrawal requests to the bank account details you provide;
• send transactional communications: booking confirmations, payment receipts, OTP codes, booking status updates, and messages from other users relevant to your booking;
• send service and account notifications based on your notification preferences (email and/or SMS);
• respond to support requests and help resolve disputes between Students and Owners;
• moderate content, including removing fraudulent listings, fake reviews, or content that violates our Terms of Service;
• maintain platform security, detect and prevent fraud, and investigate suspicious activity;
• generate aggregated, non-identifying statistics and reports for internal administration (e.g., total bookings, revenue trends) — visible only to Administrators, used to operate and improve the platform, and never shared with advertisers;
• comply with applicable legal, tax, and regulatory obligations.

We do not use your personal information for third-party advertising, and we do not sell your personal information to data brokers or advertisers.

6. Legal Bases for Processing

Where the Data Protection Act, 2012 (Act 843) of Ghana or another applicable data protection law requires a legal basis, we rely on one or more of the following: your consent (for example, for location access, which you can withdraw at any time); the necessity of processing to perform our contract with you (for example, to process a booking or payment you requested); our legitimate interests (for example, fraud prevention, platform security, and service improvement), balanced against your rights; and compliance with legal obligations (for example, financial record-keeping).

7. How We Share Your Information

We share information only as needed to operate the Service:

• With Hostel Owners: when you book or message about a hostel, the Owner receives the booking and contact details necessary to fulfil the reservation (e.g., your name, phone number, and booking details).
• With Students: an Owner’s business/contact information relevant to a listing is visible to Students browsing or booking that hostel.
• With Payment Processors: Korapay processes your payment and, for Owners, your withdrawal payouts. Korapay’s own privacy policy and PCI-DSS-compliant security practices govern the payment data it handles directly.
• With SMS Providers: our SMS gateway (which abstracts underlying providers such as Twilio or Africa’s Talking) delivers OTP codes and SMS notifications to your phone number.
• With the AI Chatbot Provider: Chatbase processes the text you type into the chatbot to generate responses, as described in Section 4.3.
• With Administrators: platform Administrators can access account, listing, booking, payment, and message data as necessary to approve listings, moderate content, resolve disputes, process refunds/withdrawals, and maintain the integrity of the platform.
• For Legal Reasons: we may disclose information if required by law, court order, or governmental request, or where necessary to protect the rights, property, or safety of UniStay, our users, or the public.
• Business Transfers: if UniStay is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy (or a policy that offers at least equivalent protection).

We do not share your personal information with third parties for their own independent marketing purposes.

8. Data Retention

• Account and profile data is retained while your account is active and is deleted or anonymized following a verified account deletion request (see Section 11).
• Booking, payment, and withdrawal records are retained for as long as required to comply with financial, tax, audit, and accounting obligations under Ghanaian law — generally up to six (6) years from the date of the transaction — even if you delete your account, because these records may be needed to resolve disputes, process refunds, or respond to a lawful request from a regulator.
• Owner KYC documents (Ghana Card images, selfie) are retained for as long as your Owner account is active and for a reasonable period after account closure, as required for fraud-prevention and regulatory compliance purposes, after which they are securely deleted.
• Activity and security logs are retained for a limited period sufficient for fraud detection and security investigations, and then deleted or anonymized.
• Messages tied to a booking may be retained as part of the booking record for dispute-resolution purposes even after the booking is complete.

9. Data Security

We take reasonable technical and organizational measures to protect your information, including: hashing passwords with bcrypt (we never store passwords in plain text); using parameterized/prepared database queries to prevent SQL injection; requiring a secure HTTPS connection for authentication cookies; role-based access controls so Students, Owners, and Administrators can only access information relevant to their role; and OTP-based verification for sensitive actions such as registration, password resets, and banking-detail changes. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and relevant authorities as required by applicable law.

10. Your Rights

Subject to applicable law, including the Ghana Data Protection Act, 2012, you have the right to:

• access the personal information we hold about you;
• request correction of inaccurate or incomplete information (most of this can be done directly in your Profile settings);
• request deletion of your account and associated personal information (see Section 11);
• object to, or request restriction of, certain processing of your information;
• withdraw consent at any time where processing is based on consent (e.g., turning off location access or SMS notifications), without affecting the lawfulness of processing before withdrawal;
• request a copy of certain personal information you provided to us, in a portable format, by emailing our support address.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before actioning certain requests, and we may decline or limit a request where we have a legal obligation or legitimate interest to retain the information (for example, the financial records described in Section 8).

11. Account Deletion

You can delete your UniStay account at any time by going to Profile > Delete Account within the app. When you delete your account:

• your profile information, saved favourites, and stored login credentials are permanently deleted or irreversibly anonymized;
• if you are an Owner, your listings are removed from active search results;
• certain records — specifically completed booking history, payment/transaction records, and withdrawal records — are retained for the period described in Section 8, because we are legally required to keep financial records and because these records may be needed to resolve an open dispute, refund, or chargeback;
• account deletion is generally processed immediately upon confirmation in the app; the retained financial and legal records described above are kept in a restricted, non-active state and are not used for any purpose other than legal, compliance, or dispute-resolution needs.

If you are unable to complete deletion in-app for any reason, you may request deletion by emailing [email protected] from your registered email address; we will process such requests within a reasonable time, generally no later than 30 days.

12. Children’s Privacy

UniStay is not directed at children under 16, and you must be at least 16 years old to create an account (see our Terms of Service for additional requirements applicable to users aged 16-17). We do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from a child under 16, we will delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact [email protected].

13. Cookies and Tracking Technologies

UniStay uses a session cookie to keep you logged in, and, if you select “Remember Me,” a separate cookie storing a hashed authentication token so you don’t need to log in every visit (this cookie requires a secure connection and can be cleared by logging out or clearing your browser/app data). We do not currently use third-party advertising or cross-site tracking cookies. If this changes in the future, we will update this Policy and, where required, request your consent.

14. Location Services

UniStay may request access to your device’s location (through your Android or iOS system permission prompt) to show nearby hostels, calculate distance and directions, and improve map-based search. Location access is optional — you can deny the permission or later revoke it in your device settings, and the Service will continue to function without it (distance information will simply not be shown).

15. Third-Party Services and Links

UniStay integrates with third-party services to operate core features, including: Korapay (payments), our SMS gateway provider (OTP and notifications), Chatbase (AI chatbot), and OpenStreetMap, Leaflet, and OSRM (maps, geocoding, and route calculation). These providers process certain data as necessary to perform their function and are subject to their own privacy policies, which we encourage you to review. UniStay is not responsible for the privacy practices of these independent third parties.

16. Reporting Inappropriate Content

UniStay is committed to providing a safe and respectful environment for all users. If you encounter any content on the platform that you believe violates our Terms of Service—including but not limited to offensive messages, fraudulent listings, inappropriate reviews, or any other form of prohibited conduct—you may report it by emailing us at [email protected].

When you submit a report, please include:

• The type of content you are reporting (e.g., listing, review, message, profile).
• The specific content or a description of the issue.
• Any relevant screenshots or additional context.

Our administrators will review all reports promptly and take appropriate action, which may include removing the content, issuing a warning, or suspending the user account. All reports are handled confidentially and in accordance with this Privacy Policy.

17. International Data Transfers

Some of our service providers (including Korapay, our SMS gateway, and Chatbase) may process or store data outside Ghana. Where this occurs, we take reasonable steps to ensure that these providers offer an appropriate level of protection for your information, consistent with applicable data protection law.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or legal requirements. If we make material changes, we will notify you through the app or by email before the changes take effect. The “Effective Date” at the top of this Policy indicates when it was last revised. Continuing to use UniStay after changes take effect constitutes acceptance of the revised Policy.

19. Contact Us