Privacy Policy
In short: We collect only what we need to run booking websites, take payments safely and keep the platform secure. We never sell personal information and we never see or store your full card details. Hosts see the details of the guests who book with them. You can ask us for access, correction or deletion at any time.
1. Who we are
Cirrocore Technologies Limited ("SikaStay", "we") runs the SikaStay platform. Our address: D41 Gray ST, Oyibi Accra. You can reach us at derekasa@cirrocore.com or through the contact form. We aim to follow the principles of Ghana's Data Protection Act, 2012 (Act 843).
Two roles matter here:
- For hosts' account, billing and security data, we are the controller. We decide why and how it is used.
- For guests' booking data, the host is the controller because the host decides why guests' details are used, and we process it on the host's behalf to provide the service. We are also a controller for the limited data we need to prevent fraud, keep the platform secure and meet our own legal duties.
2. What we collect
| Who | What | Where it comes from |
|---|---|---|
| Hosts | Name, email address, phone number, a hashed password, business and site name, listings and prices, a link to an Airbnb listing and the verification code placed on it, the private calendar link you connect from Airbnb (stored encrypted) and the dates it shows as booked, the name of the bank and last four digits of the payout account, record of accepted terms, whether your phone number has been confirmed, and, if you sign in with Google, your Google account's ID, name and email. If you order a domain through us, the owner's name, email, phone number and address. | You, when you sign up and use the dashboard |
| Guests | Name, email address, phone number, booking dates, number of guests, any note you write, the payment reference and amount, the terms and cancellation policy you accepted. For car rentals also the pickup place and destination. | You, when you book |
| People who contact us | Name, email address and what you tell us when you report a concern or ask for help. | You |
| Everyone | Technical data such as IP address and browser details in server logs, used for security and to prevent abuse. | Your device |
We do not see or store full card numbers or mobile money PINs. Payments are completed on Paystack's secure page. Paystack holds the full payout account details that hosts give it.
3. Why we use it
- To provide the service: run booking websites, hold dates, take payments, send confirmations and let hosts manage bookings. This is needed to carry out the contract with you.
- To keep people safe and prevent fraud: verify hosts, limit repeated attempts, block abuse, investigate reports. This is in our legitimate interest and that of hosts and guests.
- To meet legal duties: accounting, tax, responding to lawful requests.
- To communicate with you: booking and account emails such as confirmations, password resets and security notices. We do not send marketing email.
- With your consent where the law requires it, which you can withdraw at any time.
4. Who we share it with
- The host you book with receives your booking details so they can host you.
- Paystack processes payments and payouts.
- Resend delivers our emails.
- Arkesel delivers the text messages with sign-in and confirmation codes, so it receives your phone number and the code.
- Google confirms who you are if you choose to sign in with Google. We receive your name, email and Google account ID; we never see your Google password.
- A domain registrar receives the owner's details when we register a domain for a host, as the registry rules require.
- Cloudflare provides our domain name service and, where switched on, a security check (Turnstile) that tells people from bots.
- Hetzner hosts our servers and database.
- Authorities and advisers where the law requires it, to protect rights and safety, or to our professional advisers, under a duty of confidentiality.
- A buyer or successor if our business is transferred, with the same protections.
We do not sell personal information, and we do not share it for advertising.
5. Sending information abroad
Some of these providers process data outside Ghana. Our servers are in Germany, in the European Union, and other providers may use systems in other countries. We choose established providers and expect them to protect information properly.
6. How long we keep it
- Booking and payment records are kept for up to seven years for accounting, tax and dispute purposes.
- Account details are kept while your account is open, and afterwards for as long as we need to keep records for the same purposes.
- Reports of concerns are kept for as long as needed to handle them and any follow-up.
- Server logs are kept for a limited time and rotated automatically.
- When we no longer need information, we delete or anonymise it.
7. How we protect it
- Connections are encrypted with HTTPS.
- Passwords are stored as one-way hashes, never in plain text.
- Password reset and email confirmation links are single-use and expire.
- Signing in is rate limited and password changes sign you out on other devices.
- Access to systems and data is limited to what is needed, and the database is not reachable from the internet.
No system is perfectly secure. If a breach affects you, we will tell you and the relevant authority as the law requires.
8. Cookies
We use only the cookies needed to keep hosts and administrators signed in. They are protected so scripts cannot read them. We do not use advertising or analytics cookies. If the Cloudflare security check is shown, Cloudflare may set its own cookies or use browser storage to do its job.
9. Your rights
You can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong or incomplete;
- delete your information, unless we must keep it, for example for accounting;
- stop or restrict certain uses, and withdraw consent you gave.
To use these rights, You can reach us at derekasa@cirrocore.com or through the contact form. For a booking, you may also ask the host, who controls that information. If you are not happy with our response, you can complain to the Data Protection Commission of Ghana.
10. Children
SikaStay is not meant for people under 18, and we do not knowingly collect their information. Hosts must not collect more than they need about children travelling with a guest.
11. Changes
We may update this policy. We will change the date at the top, and for important changes we will tell you by email or in your dashboard.