Privacy Policy

We do not deliberately collect special-category data such as health or religious belief. Please do not include it in messages or listing descriptions.

Card payments are processed by Paystack, a licensed payment service provider. When you pay, your card details are entered directly into Paystack's secure form and transmitted to them — they do not pass through Aparte servers and we do not store them.

We receive and keep only what we need to reconcile a booking: the transaction reference, amount, currency, status, method type and the last four digits of the card. Paystack processes your card data as an independent controller under its own privacy policy.

For Hosts, we store the bank account number, bank code and verified account name needed to send payouts.

Other users. A booking requires both sides to know some things about each other:

• The Host sees the Guest's name, profile photo, booking details and the messages between them. They do not see the Guest's full contact details unless the Guest shares them.
• The Guest sees the Host's name, profile photo, listing details and, once a booking is confirmed, the address and any arrival instructions.
• Neither side ever sees the other's payment details, identity documents or password.

Service providers. We use a small number of processors, each bound by contract to use the data only on our instructions:

Authorities and legal. We disclose data where we are legally required to, or where it is necessary to establish or defend a legal claim, to prevent fraud, or to protect someone's life or safety.

Business transfers. If we are involved in a merger, acquisition or sale of assets, data may transfer to the successor. We will notify you before your data becomes subject to a different privacy policy.

Some of our providers store or process data outside Nigeria. Where that happens we rely on the transfer mechanisms permitted by the NDPA — an adequacy decision by the Nigeria Data Protection Commission, or contractual safeguards obliging the recipient to protect the data to an equivalent standard. You can ask us for details of the safeguards that apply to a particular transfer.

• Account data — for as long as your account is open, and up to 24 months after closure so we can handle disputes and repeat sign-up abuse.
• Booking, payment and payout records — at least 6 years after the booking, to meet accounting and tax obligations.
• Identity verification documents — the ID image and selfie are deleted 14 days after your check is approved. We keep only a record that the check happened: the type of document, who reviewed it and when. A submission that was not accepted is deleted 90 days after the decision, so you have time to query it. This applies to Guests and Hosts alike.
• Messages — for as long as the account is open, and for the duration of any dispute.
• Caution deposit records — kept with the booking record. The deposit itself is held only until release, 72 hours after the stay ends unless a claim is raised.
• Analytics and crash data — typically 12 months.

When a retention period ends we delete the data or irreversibly anonymise it so it can no longer identify you.

Under the NDPA you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data, where we have no overriding legal reason to keep it.
• Restriction — ask us to pause processing while a dispute about accuracy or legitimate interest is resolved.
• Portability — receive the data you gave us in a structured, machine-readable format.
• Object — object to processing based on legitimate interest, and to direct marketing at any time.
• Withdraw consent — where processing relies on consent, withdraw it without affecting what was done beforehand.

To exercise any of these, email privacy@stayaparte.com. We will respond within 30 days. We may ask you to verify your identity first — that check protects your data from someone impersonating you.

If you are unhappy with our response you may complain to the Nigeria Data Protection Commission (NDPC).

• Data is encrypted in transit with TLS, and at rest in our database and file storage.
• Passwords are stored only as salted hashes. Nobody at Aparte can read your password.
• Access to the Platform uses short-lived access tokens with separate refresh tokens, and we track known devices and active sessions so you can end one you do not recognise.
• Uploaded files — identity documents, listing photographs — are stored in private storage and served only through short-lived signed links.
• Administrative access is role-based and limited to staff who need it, and admin actions are recorded in an audit log.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the NDPC and affected users as the NDPA requires.

• Strictly necessary — keep you signed in, remember your session, and protect against cross-site request forgery. These cannot be turned off.
• Analytics — help us understand which features are used and where people get stuck. Set only with your consent where consent is required.

You can clear or block cookies in your browser settings, but blocking strictly necessary cookies will stop you from signing in. On mobile, you can reset the advertising identifier and revoke location permission in your device settings at any time.

The Platform is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact privacy@stayaparte.com and we will delete it.

We update this policy as the Platform and the law change. The revised version is posted here with a new effective date, and where a change materially affects how we use your data we will notify you by email or in the app before it takes effect.

For any question about this policy or your personal data:

• Privacy and data requests — privacy@stayaparte.com
• General support — support@stayaparte.com
• Aparte Technologies Limited (RC 0000000), Lagos, Nigeria

See also our Terms and Conditions.