Privacy Policy
Effective date: 1 September 2026
1. About BookQayam
BookQayam operates an online hotel booking marketplace at bookqayam.com that serves two groups of users: travellers who search for and book accommodation across Pakistanand hotel partners who list and manage their properties through our platform.
This Privacy Policy explains what personal information we collect from each group, why we collect it, how we use and share itand the rights you have over it. Read the section that applies to your role, though all sections apply if you use the platform in both capacities.
2. Information We Collect- Guests
Information collected from travellers and anyone making a reservation:
Account Information
Full name, email address and password. Passwords are stored as a one-way cryptographic hash and cannot be read by our team.
Reservation Details
Check-in and check-out dates, number of guests, room type selected, special requests, dietary requirements or accessibility needs you choose to share.
Payment Information
Payments are processed by Paddle. We do not store your full card number, CVV or banking credentials. We retain only a transaction reference ID, the last four digits of your card, card type and the transaction amount for our records and for resolving disputes.
Contact Details
Phone number if provided, used only to share with the property so they can contact you about your arrival.
Reviews and Feedback
Written reviews, star ratings and any feedback you submit after a stay. Reviews are published on the property listing under your display name.
Communications
Messages sent to our support team, including complaints, refund requests and general queries.
3. Information We Collect- Hotel Partners
Information collected from hotel owners, managers and their staff accounts:
Business and Account Information
Business name, registered address, contact name, email address and phone number. This information is used to verify your property and to contact you about your account and listings.
Property Information
Hotel name, address, photos, room descriptions, pricing, amenities and availability data that you publish to your listing. This information is displayed publicly to guests.
Subscription and Billing Information
Your chosen subscription plan and billing cycle. Payment processing is handled by Paddle. We retain transaction references and invoice history for accounting and legal purposes.
Dashboard Activity
Actions you take within the management dashboard- room updates, reservation confirmations, pricing changes- logged for audit and security purposes.
Staff Accounts
Names and email addresses of staff members you invite to manage the property dashboardand their role assignments.
4. Information Collected Automatically
Collected from all users regardless of account type:
- Device data: IP address, browser type and version, operating system, screen resolution and device model.
- Usage data: Pages visited, search queries entered, filters applied, time spent on pages, links clicked and features used.
- Session data: Login times, session duration and logout events.
- Referral data: The source that referred you to our platform, such as a search engine or link.
5. How We Use Your Information
For guests:
- To process, confirm and manage your reservations.
- To send booking confirmations, pre-arrival information and check-out reminders by email.
- To share necessary booking details with the accommodation provider.
- To handle payment authorisation and issue receipts.
- To process refund requests and resolve booking disputes.
- To publish reviews you submit on property listings.
- To respond to your support queries.
- To detect and prevent fraudulent bookings.
For hotel partners:
- To create and manage your property listing on the platform.
- To notify you of new reservations, cancellations and guest messages.
- To process subscription payments and generate invoices.
- To provide booking analytics and occupancy reports within your dashboard.
- To verify your property and maintain platform quality standards.
- To send account notices, product updates and billing alerts.
For all users:
- To operate, maintain and improve the platform.
- To analyse usage patterns and improve search results.
- To detect security threats and prevent abuse.
- To comply with legal and regulatory obligations.
We do not sell your personal information. We do not use your data for targeted advertising or share it with data brokers.
6. How We Share Your Information
We share your information only where necessary to operate the platform:
Accommodation Providers
When you make a booking, we share your name, email address, phone number (if provided), check-in and check-out dates, number of guests and any special requests with the property so they can fulfill your reservation. Hotel partners do not receive your payment credentials.
Payment Processor (Paddle)
All payments- both guest bookings and hotel partner subscriptions- are processed by Paddle. Paddle receives the information required to complete your transaction and operates under its own privacy policy. We do not receive or store your full card details.
Email Service (Hostinger)
Used to deliver transactional emails: booking confirmations, invoices, receipts and account notifications. Hostinger’s mail servers process only the email address and message content required to send each email.
Infrastructure (Supabase, AWS)
Our database and application run on Supabase infrastructure hosted on AWS. Both operate under data processing agreements that require them to protect your data and prohibit them from using it for their own purposes.
Analytics (Google Analytics)
We use Google Analytics to understand how the platform is used in aggregate. This does not identify you personally. You can opt out using the Google Analytics opt-out browser extension.
Law Enforcement and Regulators
We disclose information when required by law, court order or government authority. Where permitted, we will notify you before disclosing your information.
7. Payment Data and Security
BookQayam does not process card payments directly. All payment transactions are handled by Paddle, which is a Payment Card Industry Data Security Standard (PCI DSS) compliant payment processor. Your card number, expiry date and CVV are entered directly into Paddle's secure form and never pass through our servers.
We retain the following payment records for each transaction: a Paddle transaction reference, the last four digits of the card used, the card network (e.g. Visa, Mastercard), the transaction amount and dateand the billing outcome (success or failure). These records are used to verify payment, issue refunds and respond to billing disputes.
If you believe a payment was taken from you in error, contact us at billing@bookqayam.com with your booking reference and we will investigate within two business days.
8. Data Security
All data transmitted between your device and our platform is encrypted using Transport Layer Security (TLS 1.2 or higher). Data at rest is stored on Supabase with row-level security policies that ensure each user can only read and write their own records. Production database access requires multi-factor authentication and is restricted to authorised personnel.
Hotel partner dashboard sessions use secure, short-lived tokens. Staff accounts have role-based access so that each team member can only access the data their role requires.
No system is completely secure. If you suspect your account has been compromised, change your password immediately and contact security@bookqayam.com. If we become aware of a data breach that affects your personal information, we will notify you by email without undue delay.
9. Data Retention
Guest Accounts
Kept for as long as your account is active. If you close your account, personal profile data is deleted within 30 days. Booking records are retained for 7 years to meet tax and accounting requirements.
Hotel Partner Accounts
Kept for as long as the subscription is active. After account closure, business records and invoices are retained for 7 years. Property listing content is removed within 30 days of account closure.
Reviews
Reviews you submit remain on the platform after your account is closed unless you request their removal before closing your account.
Support Correspondence
Retained for 3 years after resolution to assist with any follow-up disputes.
11. Your Rights
You have the following rights over your personal information at any time:
- Access: request a copy of all personal data we hold about you.
- Correction: ask us to correct information that is inaccurate or incomplete.
- Deletion: request deletion of your personal data, subject to our legal retention obligations. Booking records may be retained for the required 7-year period even after deletion of your account profile.
- Portability: receive your data in a structured, machine-readable format (JSON or CSV).
- Restriction: ask us to pause processing while a concern is being investigated.
- Objection: object to processing carried out on the basis of legitimate interests.
- Withdraw Consent: where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
Submit requests to privacy@bookqayam.com. We respond within 30 days. We may ask you to verify your identity before acting on any request.
12. Marketing Communications
We may send you promotional emails about BookQayam offers, new features or properties in cities you have searched for. You can unsubscribe from marketing emails at any time using the unsubscribe link in any email we send, or by updating your notification preferences in your account settings.
Unsubscribing from marketing emails does not stop transactional emails such as booking confirmations, receipts and account security notices, which we send regardless of your marketing preference.
13. Children
The platform is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has registered or made a booking through our platform, contact us atprivacy@bookqayam.com and we will remove the information promptly.
14. Changes to This Policy
We will notify registered users by email at least 14 days before any material changes to this policy take effect. Minor clarifications may be made without notice. The effective date at the top of this page reflects when it was last updated.
15. Contact
For privacy questions, data requests or to report a concern:
BookQayam Privacy Team
Privacy: privacy@bookqayam.com
Billing: billing@bookqayam.com
Security: security@bookqayam.com