ZyloStaysKey points
- We don't sell your dataWe use it only to run ZyloStays and keep it safe.
- ID documents stay lockedOnly our verification team can view CNIC images, and every view is logged.
- Deleted on scheduleCNIC images are deleted 90 days after verification.
- Told within 72 hoursIf a breach affects you, we tell you within 72 hours of confirming it.
1Who we are
ZyloStays is a short-stay accommodation marketplace for Pakistan, registered with the Federal Board of Revenue as a sole proprietorship based at Scheme 33, Karachi East, Karachi, Sindh, Pakistan. In this policy, "ZyloStays", "we" and "us" mean that business. For anything about privacy, write to privacy@zylostays.com.
2What we collect
When bookings open, we collect the following.
| Information | Who | Why we need it |
|---|---|---|
| Name, email, phone number and a password (stored only in hashed form) | Everyone with an account | To create your account and contact you about bookings |
| CNIC and other identity-verification (KYC) images | Hosts, and guests where verification is required | To verify identity and prevent fraud |
| Booking records: property, dates, number of guests, price | Guests and hosts | To run bookings, payouts and support |
| Payment records: PayFast transaction ID, amount and status | Guests and hosts | To take payments, issue refunds and keep accounts. We never store full card numbers |
| Messages sent through ZyloStays chat | Guests and hosts | To let you talk to each other and to resolve disputes |
| Device and log data | Everyone | For security, fraud prevention and legal record-keeping |
3This website during pre-launch
Today zylostays.com is a public information site with no accounts, forms or payments.
- Messages you send us. If you contact us by WhatsApp, phone or email, we receive your name, number or email address and what you write. We use it only to reply, to add you to our launch list if you ask, and to talk to you about listing your place.
- Technical logs. Our hosting provider (Vercel) records standard request data such as IP address, browser type, the page requested and the time, for security and to keep the site running.
- Fonts. The site loads the Inter typeface from Google Fonts, so your browser connects to Google's servers and shares your IP address with Google.
4Who can see your identity documents
- Only named members of our verification (KYC) team can view CNIC and KYC images.
- Everyone else, including support staff, hosts, guests and marketing, sees only a verified or not verified badge.
- No third-party system has access to the raw images.
- Every view of an identity document is logged.
6Property addresses
To protect hosts, a listing shows only its area and city until a booking is confirmed. The exact address is shared with the guest once the booking is confirmed.
7How long we keep information
| Information | How long we keep it |
|---|---|
| Booking and payment records | 7 years, as Pakistani tax and company record-keeping rules require. Kept separately, so they stay even if you delete your account |
| Account data | 24 months after your last activity |
| CNIC and KYC images | 90 days after verification, then deleted. If you need to re-verify later, we ask for the documents again |
| In-app chat messages | 24 months |
| Messages you send us during pre-launch | Up to 12 months after our last contact with you, unless you become a host or guest |
| Website technical logs | At least 1 year, as section 32 of the Prevention of Electronic Crimes Act 2016 requires, then deleted |
When a period ends, we delete the information or make it anonymous, unless the law requires us to keep it longer.
8How we protect information
- Everything is encrypted in transit with TLS, and CNIC and payment data are also encrypted at rest.
- Access is role-based, and every access to sensitive data is recorded in an audit log.
- If a confirmed data breach affects you, we tell you within 72 hours, explain what happened and what we are doing about it.
10Your choices and rights
You can ask us to show you the information we hold about you, correct it, delete it, or stop sending you updates. Write to privacy@zylostays.com or message us on WhatsApp at +92 322 2859675.
| Support questions | We reply within 24 hours |
|---|---|
| Privacy requests | Acknowledged within 7 days and resolved within 30 days |
We may need to keep some records where the law requires it, such as booking and payment records, and we will tell you when that applies. If you aren't satisfied with our reply, you can complain to the Pakistan Telecommunication Authority, the FIA Cyber Crime Wing or a consumer court. Your rights under Pakistani law are not affected by this policy.
11Children
ZyloStays is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you think a child has sent us personal information, tell us and we will delete it.
12Changes to this policy
For any material change, we post the new version here and give registered users at least 14 days' notice before it takes effect. The date at the top shows the current version.
13Contact
Privacy: privacy@zylostays.com
Support: support@zylostays.com
WhatsApp and phone: +92 322 2859675
Office: Scheme 33, Karachi East, Karachi, Sindh, Pakistan