Privacy
Privacy policy
Written 26 October 2026
Draft. This has been written from what Xenia does today and has not yet been reviewed by a lawyer. It is not final and should not be relied on until this notice is removed.
This explains what personal information Xenia collects, why, how long we keep it and what you can ask us to do. It covers visitors to this website, hotel owners and staff who use Xenia, and the hotel's guests whose details a hotel keeps in Xenia.
Who is responsible
For the information about a hotel's guests and staff that a hotel keeps in Xenia, the hotel is the data controller and Xenia is the data processor. We act on the hotel's instructions, set out in our data processing terms.
For the information we hold about the people who sign up and pay for Xenia (their name, email, phone number, sign-in details and billing), and for visitors to this website, Xenia is the data controller.
The law that applies is Nigeria's Data Protection Act 2023, and the Nigeria Data Protection Commission is the regulator. [Company legal name and registered address to be confirmed.]
What we collect
| Who | What | Why |
|---|---|---|
| Visitors to this website | Pages visited and general location, counted without cookies by Cloudflare Web Analytics. If you choose to message us, the details you write in the message. | To see which pages help and to answer you. |
| People who sign up | Name, email address, phone number, a password (kept as a one-way hash), the devices you sign in from, and the hotel's name. | To create and secure your account and run the service. |
| People who pay | Plan, rooms, invoices and payments. Card payments are handled by Flutterwave; we keep a token to renew your subscription, not the card number. | To bill you and keep financial records. |
| A hotel's guests (for the hotel) | Name, phone, email, ID details and, where the hotel uploads them, ID images; stays, bills and payments. | To run the stay and meet the hotel's legal duties. Decided by the hotel. |
| A hotel's staff (for the hotel) | Name, role, sign-in history and an audit record of what they did in the system. | To control access and keep the hotel's money records trustworthy. |
How long we keep it
| Information | Kept for |
|---|---|
| Guest name, phone, email and ID details | While the hotel keeps the guest. Removed guests are hidden, and can be erased on request (see below). |
| Guest ID images | Until the hotel deletes them or the guest is erased. Deleting a file erases it at once. |
| Folio lines, payments and bookings | Seven years from the booking's check-out, for tax and audit duties. These cannot be erased on request while that period applies. |
| The audit trail | Permanently. It holds record numbers and codes, not names, phone numbers, ID numbers or file names, so a guest can be erased without breaking it. |
| Notifications | 90 days. |
How we protect it
Files such as ID images are stored encrypted in a private store and open only through links that expire in minutes. Each hotel's data is kept apart from every other hotel's by the database itself. We keep personal information out of our logs and out of the audit trail. The details are on our security page.
Who else sees it
We use a small number of other companies to run Xenia, such as hosting, email and payments. They process information only for that purpose. They are listed, with what each does, on our subprocessors page. We do not sell personal information and we do not use it for advertising.
Your rights
You can ask to see the information we hold about you, to correct it, to have it erased where the law allows, to object to how it is used, and to receive a copy. For a hotel guest, please ask the hotel first, because the hotel decides what its guests' information is used for; we will help the hotel to respond. If you are not satisfied, you may complain to the Nigeria Data Protection Commission.
If something goes wrong
If a breach exposes personal information, we tell the hotels affected without delay, and the Nigeria Data Protection Commission within 72 hours where the law requires it.
Contact
Questions about this policy, or requests about your information: use the contact page. [A named data protection contact and address to be added.]