LarnaStay Legal
Privacy Policy
How LarnaStay collects, uses, and protects your personal data
Effective Date
1 June 2026
Version
1.0
Governing Law
Nigeria
1Who We Are and How to Contact Us
Smartsync Technologies Limited ("Smartsync", "Data Controller", "we", "us", "our") is incorporated in Nigeria and operates the LarnaStay short-term accommodation marketplace at larnastay.com.
As the Data Controller, Smartsync determines the purposes and means by which your personal data is processed. For all privacy-related enquiries, requests, and complaints, please contact our designated Data Protection Officer:
2Personal Data We Collect
2.1 Data You Provide Directly
- β’Registration data: full name, email address, phone number, password (stored in encrypted form only).
- β’Profile data: profile photograph, date of birth, address, nationality.
- β’Identity verification documents (Hosts): copies of government-issued ID, selfie photographs, utility bills, CAC documents β stored securely with restricted admin access only.
- β’Property listing data (Hosts): property address, GPS coordinates, photographs, amenity descriptions, pricing, bank account details for payout processing.
- β’Booking data: check-in and check-out dates, guest count, payment information, special requests.
- β’Payment data: transaction history, payout records. Card details are not stored by LarnaStay and are processed exclusively by PCI-DSS certified processors.
- β’Communications: messages sent through the Platform, support enquiries, complaints, and feedback.
- β’Reviews and ratings: publicly visible reviews and star ratings submitted after stays.
2.2 Data Collected Automatically
- β’Device data: IP address, device type, operating system, browser type and version.
- β’Usage data: pages visited, search queries, bookings viewed, time spent on pages.
- β’Location data: general location derived from IP address; precise GPS location where you grant permission through our mobile application.
- β’Cookies and tracking technologies: see Section 7 below.
2.3 Data Received from Third Parties
- β’Social login providers (Google) where you register or log in using a third-party account;
- β’Payment processors (Paystack, Flutterwave) who share transaction confirmation and fraud-screening data;
- β’Other users of the Platform (e.g., reviews about you from your booking counterparty).
3Legal Basis for Processing
LarnaStay processes your personal data on the following legal grounds as recognised under the NDPA 2023 and NDPR 2019:
| Legal Basis | Processing Activity | Applies To |
|---|---|---|
| Contract Performance | Processing bookings, payments, cancellations, and refunds | Hosts & Guests |
| Legitimate Interests | Fraud prevention, security monitoring, improving the Platform, transactional notifications | All Users |
| Legal Obligation | Compliance with NDPA, FIRS tax obligations, CBN payment regulations, court orders | All Users |
| Consent | Marketing communications, newsletters, promotional offers, analytics cookies | Where consent given |
| Vital Interests | Emergency situations involving safety of users or third parties | Where necessary |
4How We Use Your Personal Data
4.1 Operating the Platform
- β’Creating and managing your account;
- β’Enabling search, browsing, and discovery of Listings;
- β’Processing bookings, payments, refunds, and cancellations;
- β’Facilitating communication between Guests and Hosts;
- β’Sending booking confirmations, pre-arrival reminders, and post-stay receipts.
4.2 Trust and Safety
- β’Verifying Host and Guest identities to prevent fraud;
- β’Reviewing and moderating reviews, listings, and user content;
- β’Investigating complaints, disputes, and reports of prohibited conduct;
- β’Detecting, preventing, and responding to fraud, security incidents, and system abuse.
4.3 Legal Compliance
- β’Complying with applicable Nigerian laws including NDPA 2023, NDPR 2019, and CBN payment regulations;
- β’Responding to lawful requests from law enforcement, courts, and regulators;
- β’Retaining transaction and financial records as required by Nigerian tax law.
4.4 Platform Improvement and Analytics
- β’Analysing usage patterns to improve Platform functionality and user experience;
- β’Conducting research and analysis (using anonymised or aggregated data where possible);
- β’A/B testing, performance monitoring, and infrastructure optimisation.
4.5 Marketing and Communications (with consent)
- β’Sending promotional emails and offers where you have opted in;
- β’Recommending Listings based on your search and booking history;
- β’Sending loyalty programme updates and referral programme notifications.
You may withdraw your consent to marketing communications at any time by clicking "Unsubscribe" in any marketing email or by contacting privacy@larnastay.com.
5How We Share Your Personal Data
5.1 With Other Users
To facilitate bookings, we share limited personal data between Hosts and Guests:
- β’Guests see: Host's first name, profile photo, Verified status, and Listing details;
- β’Hosts see: Guest's first name, profile photo, guest count, and booking details (including phone number for check-in coordination after booking confirmation);
- β’Reviews submitted are publicly visible and attributed to the reviewer's first name and profile photo.
5.2 With Service Providers
We engage third-party service providers who process personal data on our behalf under strict data processing agreements. Each provider is contractually bound to process data only for specified purposes and in accordance with applicable law:
| Provider | Service | Data Processed |
|---|---|---|
| Supabase (PostgreSQL) | Database hosting | All personal and transactional data |
| Cloudinary | Image storage | Property photos, verification documents |
| Paystack / Flutterwave | Payment processing | Transaction data (no raw card data retained by LarnaStay) |
| Resend / SendGrid | Email delivery | Name, email address, booking references |
| Twilio | SMS/WhatsApp messaging | Phone number, booking information |
| Vercel | Application hosting | Web traffic data, IP addresses |
| Google Analytics | Usage analytics | Anonymised browsing and usage data |
5.3 Legal and Regulatory Disclosures
We may disclose personal data to law enforcement, courts, regulators, or other government bodies where required by applicable Nigerian law, or where necessary to protect LarnaStay's legal rights, investigate fraud, or protect the safety of users or third parties.
5.4 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of LarnaStay's business, personal data may be transferred to the acquiring entity. Affected users will be notified in advance of any such transfer.
6Data Retention
LarnaStay retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to any applicable legal retention requirements:
| Data Category | Retention Period |
|---|---|
| Active account data | Duration of account, plus 90 days after deletion request |
| Booking and transaction records | 7 years (FIRS tax compliance β CITA / PITA) |
| Identity verification documents | 5 years from last completed booking |
| Financial and payout records | 7 years (CAMA / FIRS requirement) |
| Marketing consent records | Until consent withdrawn, plus 12 months |
| Customer support correspondence | 3 years from resolution |
| Security and audit logs | 2 years |
| Anonymised analytics data | Indefinite (no personal identifiers retained) |
When your personal data is no longer required, it is securely deleted or anonymised in accordance with industry-standard data destruction procedures.
8Your Data Subject Rights
Under the Nigeria Data Protection Act 2023 and NDPR 2019, you have the following rights. Submit a written request to privacy@larnastay.com. We will respond within 72 hours of receiving a verified request.
| Right | What It Means |
|---|---|
| Right of Access | Request a copy of all personal data LarnaStay holds about you (Data Subject Access Request). |
| Right to Rectification | Request correction of inaccurate or incomplete personal data. |
| Right to Erasure | Request deletion of your data where it is no longer necessary for the purpose collected, subject to LarnaStay's legal retention obligations. |
| Right to Restriction | Request that we restrict processing of your data in certain circumstances (e.g., while a dispute is under investigation). |
| Right to Data Portability | Request your personal data in a structured, machine-readable format for transfer to another service. |
| Right to Object | Object to processing based on legitimate interests, including profiling and direct marketing. |
| Right to Withdraw Consent | Where processing is based on your consent, withdraw it at any time without affecting lawfulness of prior processing. |
| Right to Lodge a Complaint | Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe your rights have been violated. |
9Data Security
LarnaStay implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction:
- β’All data in transit is encrypted using TLS 1.2 or higher;
- β’All data at rest is encrypted using AES-256 encryption on our database infrastructure;
- β’Payment credentials are never stored by LarnaStay β processed exclusively by PCI-DSS certified processors;
- β’Identity verification documents are stored in a restricted environment with access controls limiting access to LarnaStay admin personnel only;
- β’All staff with access to personal data are trained in data protection obligations and bound by confidentiality agreements;
- β’Multi-factor authentication (MFA) is mandatory for all LarnaStay administrator accounts.
In the event of a data breach affecting your rights and freedoms, LarnaStay will notify the Nigeria Data Protection Commission and affected data subjects within 72 hours of becoming aware of the breach, in accordance with section 40 of the NDPA 2023.
10International Data Transfers
LarnaStay's primary operations and data storage are located in Nigeria. However, some service providers (including Cloudinary, Vercel, and Google Analytics) are located outside Nigeria and the ECOWAS region.
Where we transfer personal data outside Nigeria, we ensure adequate safeguards are in place as required by the NDPA 2023, including:
- β’Standard contractual clauses or data processing agreements with each recipient;
- β’Verification that the receiving jurisdiction provides an adequate level of data protection; or
- β’Other legally recognised transfer mechanisms as approved by the NDPC.
11Children's Privacy
The LarnaStay Platform is not directed to or intended for use by individuals under the age of 18. LarnaStay does not knowingly collect personal data from minors. If you believe that a minor has provided personal data to LarnaStay without parental consent, please contact privacy@larnastay.com immediately and we will take steps to delete that information promptly.
12Changes to This Privacy Policy
LarnaStay may update this Privacy Policy to reflect changes in our data practices, legal obligations, or business operations. Material changes will be communicated to registered users by email and/or prominent notice on the Platform at least fourteen (14) days before taking effect. The date of the most recent revision is displayed at the top of this document.
Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the changes. Where applicable law requires explicit consent for material changes, we will seek such consent before the changes take effect.
13Contact and Complaints
For any questions, requests, or concerns regarding this Privacy Policy or our data practices:
Also see our Terms of Service β which governs your use of the LarnaStay Platform and is incorporated into this Privacy Policy by reference.
Β© 2026 Smartsync Technologies Limited. All rights reserved. This Privacy Policy is effective as of 1 June 2026.
Β© 2026 Smartsync Technologies Limited Β· Lagos, Nigeria
For legal enquiries: legal@larnastay.com