Privacy Policy

When you register for UseLodger, we collect:

• Full name, email address, phone number
• Password (stored as a bcrypt hash — never in plain text)
• Profile photo (uploaded to Cloudinary CDN)
• Date of birth (for age verification)
• Gender (optional)
• Address, city, state, country
• Government ID type and number (for property owners, for identity verification)

• Property name, address, GPS coordinates
• Property photos and videos
• Room descriptions, pricing, and availability
• Bank account details (for Paystack subaccount setup)
• Property policies and house rules

• Check-in and check-out dates
• Number of guests
• Total amounts, fees, and discounts
• Payment status and method
• Booking reference numbers
• Special requests and notes
• Guest reviews and ratings

We do not store full card numbers. Card payments are handled by Paystack and Flutterwave. We only store payment confirmation references returned by those gateways.

• IP address and device type
• Browser type and version
• Pages visited and time spent
• Login timestamps and session tokens
• Error logs and crash reports

• Support messages and emails sent to us
• Demo booking requests
• Notification preferences

• Create and manage your account
• Process bookings and payments
• Send booking confirmations, receipts, and reminders
• Enable check-in and check-out flows
• Generate invoices and financial reports
• Power the AI features (smart pricing, fraud detection)

• Send transactional emails and SMS via KudiSMS/Termii
• Send push notifications via Firebase FCM (if enabled)
• Respond to support and demo requests
• Notify you of product updates and policy changes

• Analyse usage patterns to improve features
• Debug errors and resolve technical issues
• Train and evaluate AI pricing and fraud models (using anonymised data only)

• Comply with NDPR 2019 and the Nigeria Data Protection Act 2023
• Respond to lawful requests from Nigerian regulatory authorities
• Maintain financial records as required by law
• Detect and prevent fraud and abuse

Paystack and Flutterwave receive transaction data necessary to process payments. Both are PCI-DSS compliant. Paystack processes Nigerian card transactions and subaccount settlements. Flutterwave handles pan-African and international payments.

• Cloudinary (media storage — property photos, room images, QR codes)
• Server hosting provider (Nigerian-based VPS for API data storage)

• KudiSMS / Termii (SMS delivery — phone number and message content only)
• SMTP email provider (email address and message content only)
• Firebase (device token for push notifications — no personal data stored by Firebase beyond the token)

When a guest makes a booking, their name, contact details, and stay information are shared with the property owner. Property owners are responsible for handling this data in accordance with NDPR. UseLodger provides a Data Processing Agreement (DPA) on request.

We may disclose personal data if required to do so by law, court order, or a Nigerian regulatory authority (including NITDA). We will notify you of such requests unless legally prohibited from doing so.

All UseLodger platform data (user accounts, bookings, financial records) is stored on servers located in Nigeria, in compliance with NDPR requirements for localised data storage. Media files (photos, videos) are stored on Cloudinary's global CDN, which includes servers outside Nigeria — this is disclosed in line with NDPR cross-border transfer provisions.

• Passwords hashed with bcrypt (never stored in plain text)
• All data transmission encrypted via TLS 1.3
• JWT tokens with 7-day expiry and per-device session tracking
• Two-factor authentication (TOTP) available for all accounts
• Database access restricted to application layer only
• Full audit log of all data changes with user, timestamp, and IP
• Regular automated backups with encrypted storage

In the event of a data breach affecting your personal data, we will notify affected users within 72 hours of becoming aware, as required by NDPR. We will also notify NITDA where required.