Privacy Policy

1. Who is responsible

Sabi Networks Limited, 129 Iju Road, Lagos, is the data processor for hotel and guest data stored on Itura. Each hotel is the data controller for the personal data it collects about its guests. For account and billing data about the hotel itself, Sabi Networks acts as data controller.

2. What we collect

• Account data: names, email addresses and roles of hotel owners and staff, used for sign-in and access control.
• Hotel operations data: bookings, stays, room status, charges, point-of-sale tickets, cash-shift counts, bank-statement lines imported for matching, and reports derived from them.
• Guest data: names and contact details recorded at booking, and — where a hotel enables it — identity document type, number, nationality and a photograph of the document.
• Payment data: amounts, methods, references and confirmation states. We do not store card numbers; card payments are recorded by reference only.
• Wi-Fi session data: voucher codes linked to a stay, with issue and expiry times only. Itura does not record browsing activity, visited sites or connection content — ever.

3. How data is used

Data is used solely to operate the platform: running the front desk, billing, payments reconciliation, housekeeping, reports, risk flags, notifications, and providing support. We do not sell, rent or monetise any hotel or guest data, and we do not use it for advertising.

4. Who can see it

• Hotel staff see only their own hotel’s data, limited by their assigned role. Platform controls enforce this separation between hotels at the database level.
• Platform administrators may enter a hotel’s workspace in a visible support mode to resolve issues; every such entry and exit is recorded in an audit log.
• Service providers that host and operate our infrastructure process data only under contract and only to deliver the service.

5. Guest identity documents and retention

Identity document photographs are stored privately and are visible only to authorised staff of the hotel that captured them. By default a document photograph is deleted 30 days after the guest checks out, and the document number is permanently masked to its last two characters. Hotels may set a shorter or longer period in their operating rules, and duty managers may delete a document earlier. Every disposal — automatic or manual — is written to a tamper-evident disposal log showing the hotel, guest, period applied and time.

6. Retention of other data

Operational and financial records are retained for the life of the hotel’s account so that reports, audits and reconciliation remain accurate. On account closure, a data export is available for 30 days, after which the data may be deleted. Backup copies are removed on their normal rotation cycle.

7. Security

Access is authenticated per user, every hotel’s records are isolated by database-level access rules, connections are encrypted in transit, and sensitive files such as identity documents are stored in private, non-public storage with size and access limits.

8. Your rights under the NDPA

Under the Nigeria Data Protection Act, individuals may request access, correction, or deletion of their personal data, and may object to or restrict processing. Guests should contact the hotel they stayed with first, since the hotel controls that data; hotels (and anyone with questions about account data) can reach us at sales@sabinetworks.com. Complaints may also be lodged with the Nigeria Data Protection Commission.

9. Changes

We may update this policy as the platform evolves. Material changes will be announced in the app or by email before they take effect. The current version is always at itura.lovable.app/privacy.