Privacy policy

Data collected

Most of the data we hold, you give us. Additional data we hold is created as a by-product of your use of the Service.

• Your account: your name, your email address and, if you sign in with Google, the profile picture your Google account carries. If you sign in with a one-time code instead, we hold your email address and the code until it is used or expires.
• Your profile: a phone number, a short description and, for hosts, the documents that show who you are and that you may let the property you list. Before a guest’s first booking, we ask for identification and a verified phone number.
• Listings: the address, photographs, description, house rules, prices and calendar of each property a host lists.
• Bookings and stays: the dates, the room or property, the price, the people staying, check-in and check-out, and what each side says about the stay afterwards.
• Other people in a booking: a guest gives us the names of the people in the party and, by giving them, confirms that each of them, or a parent for a child, has agreed to their name being given. We use the names for that stay only.
• Payments: the amount, currency, date, reference and status of every payment and payout. Card and wallet details go to our payment provider, Peach Payments, and never reach us; a bank transfer reaches us as a bank record with a reference. We never hold a full card number. For hosts, we hold the bank, Juice or my.t money account that payouts go to.
• Messages: what guests and hosts write to each other through the Service, and what either writes to us.
• Technical data: the address your device connects from, the browser it uses, the pages you open and when, kept in our logs to run the site safely and to find faults.

Data use

We use personal data for these purposes and no others:

• To run the Service: to show listings, take bookings, confirm them, and let guests and hosts reach each other about a stay.
• To take and make payments: a guest pays us and we pay the host, so we must know who paid what for which stay.
• To check who hosts and guests are, so that a property is let by someone entitled to let it and stayed in by the person who booked it. One of our people decides every identity check and every dispute; neither is decided by a machine alone.
• To answer you when you write to us, and to tell you about your bookings, your listings and your account. These messages are part of the Service and continue while you use it.
• To keep the site and your account safe: to find and stop fraud, abuse and attacks.
• To meet the law: tax, accounting, anti-money-laundering and consumer rules in Mauritius.
• To send you news or offers only when you have asked for them; every such message says how to stop them.

The law allows each of these uses for a reason it names. Most of them carry out the contract between you and us, or meet a legal obligation. Keeping the Service safe and running well is what the law calls our legitimate interest. News, offers and anything else optional rest on your consent, which you can withdraw at any time.

Google sign-in data

When you sign in with Google, Google tells us your name, your email address, your profile picture and an identifier for your Google account, and nothing else. We use them to create your account, to recognise you when you return and to show your name and picture to the host or guest you have a booking with.

We do not use Google user data to show you advertising, we do not sell it, and we do not share it with anyone except as this policy says. MauPad’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can take our access to your Google account away at any time at myaccount.google.com/permissions; Google then shares nothing further with us. To delete your account and what we already hold, subject to ‘Data retention’ below, write to legal@maupad.com from the email address of your account.

Data sharing

Personal data is shown to or shared with:

• The other side of a booking. A host sees a guest’s name, picture and what the guest wrote; a guest sees a host’s name, picture and listing and, once the booking is confirmed, the address and how to reach the host. Neither side sees the other’s payment details.
• Peach Payments, which processes card and wallet payments under its own privacy policy, and the banks that carry transfers and payouts.
• The companies that run our infrastructure under contract with us: Vercel, which serves the site; Neon, which hosts the database; Spaceship, which carries our email; and Google, for sign-in. Each may process your data only to provide its service to us.
• Our accountants and lawyers when they need it, and a court, a regulator or the police when the law requires it or a person’s safety depends on it.
• A buyer of the business, if it is sold, under this policy.

We never sell personal data, and we never share it with advertisers.

Data residency

Our database runs in Singapore and the site is served from Vercel’s network; the other providers above work from their own regions. Data therefore leaves Mauritius. Vercel, Neon and Spaceship receive it under data-processing terms that bind them to protect it as this policy does. Peach Payments and Google handle it under their own policies. Write to us for a copy of the safeguards that apply.

Data retention

• Your account and profile: while your account exists, and for ninety days after it closes, so that a disputed stay or a payment still in flight can be settled.
• Bookings, payments and payouts: for as long as Mauritian tax and accounting law requires business records to be kept.
• Identity documents: until the check is decided, and then for the period the law requires of us; a document we no longer need is deleted.
• Messages: with the booking they belong to; a message to us about anything else, for one year.
• Logs: no more than ninety days.

When a period ends, the data is deleted or made anonymous.

Data security

Connections to the site are encrypted. There is no password for your account: you sign in through your Google account or with a one-time code sent to your email address. Card numbers never reach us. Access to the database and the logs is limited to the people who run the Service, and is recorded. No system is perfectly safe; if a breach affects your data we will tell you, and the Data Protection Office, as the law requires.

Your rights

Under the Data Protection Act 2017, and under the General Data Protection Regulation or the UK GDPR where they apply, you may:

• Ask what personal data we hold about you, and receive a copy.
• Have something inaccurate corrected.
• Have your data deleted, where we no longer need it for a stay, a payment or a legal duty.
• Have its use restricted, or object to a use that rests on our legitimate interest.
• Receive the data you gave us in a form you can take elsewhere.
• Withdraw a consent you gave; this does not undo what was done before.

Write to legal@maupad.com from the email address of your account. We answer within 15 Mauritian business days, and ask for nothing more than is needed to be sure it is you. You may also complain to the Data Protection Office of Mauritius, at dataprotection.govmu.org, or to the data protection authority of your own country.

Cookies and browser storage

We set a cookie that keeps you signed in, and a cookie that remembers an access code where a page asks for one. Your choice of light or dark display is kept in your browser’s local storage. There are no advertising cookies and no third-party trackers. Blocking cookies signs you out.

Children

The Service is for adults. You must be 18 or older to hold an account. A booking may name children in the guest’s party; their details are used only for that stay and kept with the booking. If we learn that a child holds an account, we close it and delete its data, except what the law requires us to keep.

Changes to this policy

When this policy changes, the version and the date at the top change with it, and a change that matters to you is announced to the email address of your account before it takes effect.

Contact

Write to legal@maupad.com with any question about this policy or about your data.