Privacy Policy

Stayza is a verified accommodation discovery and lead-generation marketplace for Pakistan. We help students and travellers find verified hostels, shared apartments, private rooms, and flats, and connect them with property owners through inquiries. Stayza is not a booking or rental agent — we do not take bookings or collect rent on an owner's behalf.

Stayza ("Stayza", "we", "our", or "us") is an online platform operated by the Stayza team, based in Pakistan. This Privacy Policy explains how we handle your personal data when you use our website and Services.

If you have any questions or concerns about how your data is handled, you can reach our privacy team at legal@stayza.pk.

To keep this policy clear, the following terms have specific meanings:

User

Any person who accesses or uses Stayza, including students/seekers and property owners.

Student / Seeker

A user who browses listings and sends inquiries to find accommodation.

Property Owner

A user who lists and manages accommodation on Stayza.

Personal Data

Any information that identifies, or can be used to identify, an individual.

Processing

Any operation performed on personal data — collecting, storing, using, sharing, or deleting it.

Listing

An accommodation published on Stayza by a property owner.

Inquiry

A contact attempt: a student tapping WhatsApp or Call on a listing to reach its owner directly.

Services

The Stayza website, search tools, inquiry system, owner dashboard, and related features.

We collect information you give us directly, content you create, and a limited amount gathered automatically by your device. We only collect what we genuinely need to run a trustworthy marketplace.

• Information you provide — account details and support messages.
• Contact attempts — when you tap WhatsApp or Call on a listing, we record the listing, the channel (WhatsApp or call), the time, and the pre-filled WhatsApp message. If you are signed in, this record is linked to your account.
• Listing and verification information — for property owners, the details needed to publish and verify a listing.
• Content you create — reviews, ratings, and messages.
• Automatic data — device type, IP address, approximate location, referrer, and the pages you view, used to keep the service secure and reliable.
• Cookies and similar technologies — as described in the Cookies and Analytics section.

When you create an account, we collect the personal identifiers needed to operate it and keep it secure:

• Full name and preferred title
• Email address — for communication and security alerts
• Phone number — for inquiry confirmations
• Profile picture (optional)
• Account role — whether you are a student/seeker or a property owner

To protect students from ghost listings, predatory landlords, and electronic fraud, all property owners must complete identity verification before listings are published.

• Data Collected & Minimization — 13-digit National Identity Card (CNIC) details and verification photos submitted by property hosts. Owner identity photographs are kept in private storage for as long as your account exists, as evidence if a listing is later reported as fraudulent, and are deleted when you delete your account. Rejected submissions are kept for one year, and abandoned uploads are deleted after 7 days. Student verification photos are deleted 30 days after our decision. We never store your CNIC number in readable form — it is kept encrypted, with a partially masked identifier shown to staff (e.g., CNIC ending in 1234), so that one identity cannot be used to open duplicate or banned accounts.
• Purpose — To verify legal authority, deter ghost listings, and maintain platform integrity.
• Sensitive Identity Data Controls — Only authorised verification staff can view identity documents. Their access is time-limited and must be justified, every document they open is logged, and each viewing link expires after 10 minutes. CNIC numbers are encrypted with AES-256-GCM before they are stored, all stored files are encrypted at rest by our infrastructure provider, and identity data never appears in application logs or analytics.
• Restricted Storage Buckets — Files are held in private, non-public storage buckets protected by database Row-Level Security (RLS) and are never displayed publicly.
• AI Data Protection — Sensitive identity documents are never transmitted to third-party artificial intelligence or external vision models.
• Video Call Verification — Most listings are verified through a live video call between an authorised Stayza reviewer and the property owner, who shows the property on camera. We do not record these calls; we retain only the reviewer's written checklist, notes, and the call date, never a video or audio file.

For property owners, we collect the details needed to list and manage accommodations: the property address and location, registration details, amenities, pricing, room configurations, and photographs. Some photos are captured by our team during verification visits; others are provided by owners.

Most listing information is shown publicly so students can make informed decisions. Do not include private information in public fields such as descriptions or photo captions.

Owners pay plan fees by transfer to Stayza's JazzCash, EasyPaisa or bank account, then upload a screenshot or photo of the receipt as payment proof. Your mobile-wallet provider or bank processes the transfer under its own terms. We never ask for or store card numbers, PINs, or wallet passwords. We keep the invoice, the payment reference, and the proof you upload so we can confirm the payment, manage your plan, and handle refunds. Payment proofs are stored privately and only authorised staff can view them.

We use your data to provide and maintain the Services, and to keep the marketplace safe and trustworthy. Specifically, we use it to:

• Operate your account and deliver the features you request
• Verify listings and owner identities before they go live
• Connect students with owners through inquiries
• Personalise and rank search results, including AI-assisted search
• Send transactional messages such as confirmations and security alerts
• Detect fraud and protect our community
• Measure usage in aggregate to improve the platform
• Comply with our legal obligations

We never sell your personal data.

Stayza processes personal data only where a lawful or legitimate basis exists, guided by principles reflected in Pakistan's draft Personal Data Protection Bill (PDPB), applicable domestic legislation, and, where applicable to international users, recognized data protection frameworks (including GDPR Article 6 and CCPA principles):

Contractual Necessity

To provide discovery services, process user inquiries, manage accounts, and administer listing subscriptions.

Explicit Opt-In Consent

For optional features, talent applications, ambassador signups, marketing communications, and non-essential cookies.

Legitimate Business Interests

To verify property listings, enhance platform integrity, prevent spam or deceptive conduct, and maintain cybersecurity.

Compliance with Legal Process

To respond to lawful court orders, statutory investigative requests from law enforcement agencies, or tax and regulatory obligations under applicable Pakistani law.

Scope of International Frameworks

Where and to the extent processing involves data subjects protected under the EU GDPR or California CCPA, Stayza applies corresponding privacy principles on a conditional basis. These frameworks do not govern Stayza's purely domestic Pakistani operations.

Some Stayza features, including AI Search, use automated and AI-assisted techniques to understand your query and recommend relevant listings. To do this we process your search inputs and certain usage signals.

Search runs on our own systems. Your search text is not sent to Google Gemini or any other outside AI service: the language model that helps match what you mean runs inside the infrastructure of our database provider, Supabase. Please still don't type personal details into the search box.

We do not use your data to make legally significant decisions about you through fully automated means.

We use cookies and similar technologies to keep you signed in and keep the site secure. With your permission, we also remember what you viewed and searched, and measure how the site is used. Our network provider, Cloudflare, counts visits and page speed for every visitor without cookies and without storing anything on your device. Our Cookie Policy lists every item.

When you first visit, our cookie banner lets you accept or reject optional cookies with one tap each, or choose category by category. Nothing optional runs before you choose. We keep your choice for 12 months, then ask again, and you can change it at any time from Cookie Preferences in the footer. Essential cookies cannot be switched off, because the platform cannot function without them.

Even if you reject analytics, we count four service events that owners' listing statistics depend on: listing views, appearances in search results, taps on Call or WhatsApp, and inquiries sent. These counts store nothing on your device and carry no session ID, account link, referrer, or location. Separately from these counts, each tap on Call or WhatsApp is saved as a contact record (see Information We Collect), and that record is linked to your account if you are signed in. We rely on our legitimate interest in giving owners accurate figures for the service they use.

We send two kinds of messages:

• Transactional (service) messages — inquiry confirmations and notifications, owner lead alerts, plan and payment confirmations, verification status updates, security and account alerts, plan-expiry reminders, and important service announcements. These are part of the Services and cannot be turned off while you have an account.
• Marketing messages — price-alert matches, review reminders, and new-listing digest emails. These are opt-in where required, and every marketing email includes a one-click unsubscribe link.

When you post reviews, ratings, photos, or other content, you retain ownership of what you create. By posting, you grant Stayza a non-exclusive licence to host, display, and distribute that content as part of operating and promoting the Services.

Reviews and ratings are shown publicly alongside listings, so please don't include personal or sensitive information in them. We may remove content that is fraudulent, defamatory, or violates our community guidelines.

Stayza does not sell your personal data. We share information only where necessary:

• With the other party to an interaction — when you tap WhatsApp or Call on a listing, the owner sees that a contact attempt happened, on which listing and channel, and when. We do not give the owner your name, phone number, email, or account. Your WhatsApp number or phone number reaches the owner only because you message or call them yourself.
• With service providers who process data on our behalf, under contract.
• To comply with the law, enforce our terms, or protect users' rights and safety.

Our service providers fall into these categories:

Database, auth & storage

Supabase, which holds our database, sign-in system, and uploaded files.

Payments

The mobile wallet or bank you use to pay us (e.g., JazzCash, EasyPaisa, your bank) processes your transfer. We do not send them your Stayza data.

Maps

OpenStreetMap supplies map images and receives your IP address when a map loads. Google Maps is used only if you choose to open a location there.

Analytics

Our own first-party analytics, plus Vercel Web Analytics and Speed Insights (cookieless). geojs.io estimates your city from your IP address. All of these run only if you allow Analytics.

AI Search

Runs on our own systems inside Supabase. Search text is not sent to an outside AI provider.

Email

Resend delivers account and listing emails. Zoho Mail hosts our staff inboxes, so it holds any email you send us.

Password safety

When you choose a password, Have I Been Pwned checks whether it has appeared in a data breach. Only the first five characters of a scrambled (hashed) version of the password are sent, never the password itself.

Hosting & delivery

Vercel hosts the website. Cloudflare delivers and protects it, and measures visits and page speed without cookies. Both process standard request data such as your IP address.

Our service providers are based outside Pakistan, mostly in the United States, and several run servers in other countries. So your information is transferred to, stored in, and processed outside Pakistan.

Where we transfer data internationally, we take reasonable steps to ensure it remains protected to a standard consistent with this policy and applicable law.

We keep personal data only as long as necessary for the purposes set out in this policy. In practice:

• Account Profile Data — Retained while your account remains active; removed or anonymized within 30 days of account closure.
• Identity Verification Documents — Property owners' identity photographs are kept for as long as the account exists, for fraud prevention and lawful requests, and are deleted when you delete your account. Rejected owner submissions are kept for one year, abandoned uploads for 7 days, and student verification photos for 30 days after the decision. If an active dispute, legal claim, or fraud investigation involves your account, we keep them until it is resolved.
• Verification Status & Audit Logs — Verification outcome status, review timestamps, video call reviewer checklists and notes (never a recording), and partially masked identifiers (e.g., CNIC ending in 1234) retained as necessary to prevent duplicate banned accounts and preserve marketplace integrity.
• Invoices and Financial Records — Retained as required by applicable tax, commercial, and statutory accounting periods.
• Contact Attempts — Records of WhatsApp and Call taps are kept for 12 months, then deleted.
• Usage Analytics — Kept as long as needed for owners' listing statistics and to improve the Services. We plan to set an automatic deletion limit and will publish it here.
• Security Logs — Rate-limit records are deleted within hours. Records of actions our staff take on accounts, listings, and identity documents are kept longer, so misuse can be investigated.

Depending on your location, you have rights over your personal data, including the right to:

• Access the data we hold about you
• Correct or update inaccurate data
• Delete your data (erasure)
• Receive your data in a portable format
• Restrict how we process your data
• Object to certain processing
• Withdraw consent for consent-based processing
• Lodge a complaint with us or a relevant authority

You can correct your details and delete your account yourself in account settings, and change your cookie choices from Cookie Preferences in the footer. For a copy of your data, or any other request, email legal@stayza.pk from the email address on your account. We reply within 30 days. We will never ask you to send your CNIC or bank details by email.

You can delete your account at any time from your account settings, or by contacting us at legal@stayza.pk. Here's what happens:

• Deleted immediately — your profile is deactivated and removed from public view, including listings and reviews tied to it.
• Removed within ~30 days — your personal data is permanently deleted or anonymised from our active systems.
• Retained where required — certain records (such as invoices and fraud/security logs) are kept for the limited periods described in Data Retention to meet legal obligations.

Stayza is intended for adults. The Services are not directed to children under 16, and we do not knowingly collect their data.

Users under the age of 18 may use Stayza only with the involvement and consent of a parent or legal guardian, who remains responsible for their use of the Services. If we learn we have collected a child's data without appropriate consent, we will delete it promptly.

We may review, edit, or remove listings and content to protect users — including fraudulent or duplicate listings, misleading information, and illegal or prohibited content. These rights are described further in our Terms & Conditions.

This Privacy Policy, and any dispute relating to it, is governed by the laws of Pakistan. Subject to applicable law, the courts of Islamabad, Pakistan have jurisdiction over such disputes.

We may update this Privacy Policy from time to time as our platform and legal obligations evolve. The "Last updated" date at the top of this page always reflects the most recent revision.

For material changes, we will notify registered users by email and/or with an in-app notice at least 14 days before the changes take effect.

If you have questions, requests, or a privacy complaint, our team is here to help — reach out and we'll get back to you.

For formal complaints, email legal@stayza.pk with the details. We aim to acknowledge within 5 business days and resolve within 30 days.