Privacy Policy

Last updated 12 June 2026.

1. Data we collect

Property owners (operators)

• Account data: name, email address, password (stored only as a one-way hash by Amazon Cognito; we never see the raw password).
• Business data: organization name, property names, addresses, descriptions, photos, amenities, policies, paybill / payment account numbers, contact phone and email for guest enquiries.
• Operational data: reservations created, prices set, check-in / check-out events, internal notes you add.
• Technical data: IP address, browser type, page-load timing, error logs — for security and product improvement.

Guests (people booking a stay)

• Booking data: name, phone number, optional email, dates of stay, room type, total amount.
• Phone numbers are stored in normalized international (E.164) form so that property owners can contact you on WhatsApp / SMS about your stay.
• Optional identity fields (ID number, ID type, nationality) — only if entered.

Prospects (marketing form)

• Name, email, hotel / property name, room-count band, country — only what you provide on the "Request early access" form.

2. How we use this data

• Operate the service: show you your bookings, route payments, send confirmations, generate reports.
• Connect operators and guests: property phone numbers power WhatsApp click-through; guest phone numbers are visible to the operator they booked with.
• Email verification, password reset, transactional notifications — sent from support@lalapad.online via Zoho.
• Improve the product: aggregate, anonymized analytics on what features are used.
• Comply with the law and respond to lawful requests.

3. What we don't do

• We do not sell your data.
• We do not share guest contact details with anyone except the property you booked with.
• We do not run advertising trackers or third-party marketing pixels on the platform.

4. Service providers we use

We use a small number of vetted infrastructure providers:

• Amazon Web Services (AWS) — hosting, database, authentication (Cognito), email sending infrastructure. Data lives in the eu-west-1 region (Ireland).
• Zoho Mail — sends transactional and verification emails on our behalf.
• Cloudflare / Route 53 — DNS.
• HCP Terraform — infrastructure-as-code state storage.
• Safaricom Daraja (for M-Pesa) — handles payment messages; we do not see card data or M-Pesa PINs.

5. How long we keep data

• Active accounts: retained while the account is active.
• Closed accounts: personal data deleted within 30 days of a deletion request, except where law requires longer retention (e.g., financial records).
• Backups: encrypted backups are rotated daily, retained for 30 days, with monthly snapshots for 6 months.
• Logs: CloudWatch logs retained for 14 days.

6. Your rights

• Access: you can request a copy of the personal data we hold about you.
• Correction: log into your account and edit it directly, or write to us.
• Deletion: email support@lalapad.online from the address tied to your account.
• Export: on request we provide a machine-readable export of your bookings and properties.
• Complain: you may complain to the Kenyan Office of the Data Protection Commissioner (ODPC) or your local data protection authority.

7. Cookies and local storage

We use the browser's local storage to keep your sign-in tokens after you log in to the admin. We do not use third-party tracking cookies. The marketing page uses no cookies at all.

8. Security

Passwords are hashed by AWS Cognito. Database connections use TLS with certificate verification. The production database is in a private network and only reachable via the application. Backups are encrypted at rest.

9. Changes

We will update this page when meaningful changes happen. The "Last updated" date at the top tells you when. For material changes affecting how we use your data, we will email account holders.

10. Contact

Questions, deletion requests, or anything else: support@lalapad.online.