1. Interpretation and Definitions
Words with capitalised initial letters have the meanings defined below. These definitions apply whether the terms appear in singular or plural form.
- Account means a unique account created for You to access our Platform or parts of our Platform.
- Company (referred to as "We", "Us", or "Our") refers to AfriStay LTD, Agatare, Gacuriro, Kinyinya, Gasabo, Umujyi wa Kigali, Rwanda. TIN: 156020688.
- Country refers to Rwanda.
- Device means any device that can access the Platform, such as a computer, a mobile phone, or a digital tablet.
- Guest means an individual who uses the Platform to search for and book accommodation listings.
- Owner means an individual or entity that lists accommodation properties on the Platform.
- Personal Data is any information that relates to an identified or identifiable individual.
- Platform refers to the AfriStay website, accessible at https://afristay.rw.
- Service Provider means any natural or legal person who processes data on behalf of the Company to facilitate or support the Platform.
- You means the individual accessing or using the Platform, whether as a Guest, Owner, or visitor.
2. Who We Are
AfriStay LTD is a Rwanda-registered company (Registration Date: 17th March 2026, TIN: 156020688) operating a digital hospitality platform at afristay.rw. The Platform connects Guests with accommodation listings across Rwanda managed by property Owners. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy in Rwanda.
3. Data We Collect
AfriStay collects only the personal data necessary to operate the Platform. We collect data in the following categories:
- Account data: Full name, email address, phone number, and account role (Guest or Owner), collected when You register on the Platform.
- Booking data: Check-in and check-out dates, guest count, and booking status, collected when You make or receive a booking.
- Listing data: Property name, address, description, pricing, availability, amenities, and images, submitted by Owners when creating a listing.
- Contact form data: Name, email address, and message content submitted through our Contact page.
We do not collect payment card details, mobile money credentials, or any payment-related data. All payments are processed externally through IremboPay, an independent payment platform. We do not log IP addresses or track browsing behaviour on the Platform.
4. How We Collect Your Data
We collect your personal data directly from you in the following ways:
- When you create an Account on the Platform.
- When you make or manage a booking as a Guest.
- When you create or update a listing as an Owner.
- When you submit a message through our Contact page.
5. Why We Collect Your Data
We use your personal data only for the following purposes:
- To create and manage your Account on the Platform.
- To facilitate accommodation bookings between Guests and Owners.
- To send booking confirmations, status updates, and platform notifications by email.
- To respond to enquiries submitted through our Contact page.
- To comply with applicable legal and regulatory obligations in Rwanda.
We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes.
6. Data Sharing
We share your personal data only where strictly necessary:
- Supabase: Our database and authentication infrastructure provider. Your data is stored securely on Supabase servers. A Data Processing Agreement is in place with Supabase.
- Resend: Our email delivery provider, used to send booking confirmations and platform notifications. A Data Processing Agreement is in place with Resend.
- Property Owners: When you complete a booking as a Guest, the relevant Owner receives your name and phone number to coordinate your stay. Owners are bound by the AfriStay Terms of Service and may not use this information for any other purpose.
- Guests: When an Owner receives a booking, the Guest's name is displayed in the Owner's dashboard.
- Public authorities: Where required by Rwandan law, a court order, or a lawful request from a government authority.
All Service Providers are required to process your data only for the purposes specified and in accordance with applicable data protection law.
7. Transfer of Data Outside Rwanda
Your personal data is stored on servers operated by Supabase, which may be located outside Rwanda. AfriStay has obtained, or is in the process of obtaining, authorisation from the National Cyber Security Authority (NSCA) for the transfer of personal data outside Rwanda, in accordance with Law N° 058/2021. We ensure that any international transfer of your data is subject to appropriate safeguards, including Data Processing Agreements with our Service Providers.
8. Data Retention
We retain your personal data only for as long as is necessary for the purposes described in this Policy:
- Account data is retained for as long as your Account remains active. If you request deletion of your Account, your personal data will be erased within 30 days, except where retention is required by law.
- Booking records are retained for a minimum of 5 years to comply with legal and financial obligations.
- Contact form submissions are retained for as long as necessary to respond to your enquiry and for a reasonable period thereafter.
9. Security of Your Data
We take reasonable technical and organisational measures to protect your personal data, including encrypted data transmission (HTTPS), access controls limiting who can view personal data, and the use of secure, reputable infrastructure providers. However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.
10. Your Data Protection Rights
In accordance with Law N° 058/2021 of 13/10/2021, you are entitled to the following rights:
- Right to access: You have the right to request a copy of the personal data we hold about you.
- Right to rectification: You have the right to correct inaccurate or incomplete personal data. You can update most of your information directly from your profile settings.
- Right to erasure: You have the right to request the deletion of your personal data under certain conditions.
- Right to object: You have the right to request that we stop processing your personal data under certain conditions.
- Right to data portability: You have the right to request that we transfer your personal data to you or to another organisation, where technically feasible.
- Right to restriction of processing: You have the right to request that we restrict the processing of your personal data under certain conditions.
- Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing of your personal data.
- Right to designate an heir: You have the right to designate an heir to your personal data, under conditions provided by law.
To exercise any of these rights, please contact us at info@afristay.rw. We will respond within 30 days of receiving your request.
11. Cookies and Local Storage
AfriStay does not use third-party advertising or tracking cookies. We use browser localStorage to store your session state, account role, and authentication preferences to keep you signed in across page visits. This data is stored locally on your device and is not transmitted to third parties. You can clear your browser's local storage at any time through your browser settings, which will sign you out of your Account.
12. Children's Privacy
The AfriStay Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe that a child has provided us with personal data without appropriate consent, please contact us at info@afristay.rw and we will take steps to delete that information promptly.
13. Links to Other Websites
Our Platform may contain links to third-party websites, including the IremboPay payment platform. AfriStay has no control over and assumes no responsibility for the content, privacy policies, or practices of any third-party sites or services. We strongly advise you to review the Privacy Policy of any site you visit.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify registered users of any material changes by email and by posting the updated Policy on this page. The "Last updated" date at the bottom of this page reflects the most recent revision. We encourage you to review this Policy periodically.
15. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, you can contact us at:
Last updated: 14th May 2026