Privacy Policy

1. Whose Data, and Who Decides

Ivory Key is software that hotels use to run their business. For hotel accounts and the people who use them, Ivory Key decides how that information is used, as this policy describes. For a hotel's guests, the hotel decides: Ivory Key handles guests' information on the hotel's behalf and on its instructions. Each hotel on Ivory Key has its own privacy notice for its guests.

2. Information We Collect

Ivory Key collects information you provide when creating an account (name, email), managing your hotel properties (property details, room configurations, pricing), and when guests make bookings (guest names, contact details, payment information).

In more detail:

• Hotel accounts: the administrator's name and email; the hotel's trading name; each property's name, address, email, phone, type and logo; staff accounts and their roles.
• Guests: names, contact details, stays, bills and payments, requests and their photos, the identity document a hotel records for a guest (its type, number and expiry), and the outcome of each identity check. The record of a check keeps only the last four characters of the number.
• Billing: for a card used to pay Ivory Key, its brand and last four digits. Card numbers are held by Paystack, never by Ivory Key.
• Your agreement: when you create an account, a record that you agreed to the Terms of Service and this policy, with the version, the time, and the network address and browser it came from.
• People who contact us: when you ask for a walkthrough, send the contact form or sign up on ivorykey.app, we keep your name, phone number, email if you give it, your hotel's name and number of rooms, what you wrote, and where your visit started (below), so we can reply and follow up.

On Ivory Key's own website, ivorykey.app, we count visits and button presses with Umami, an analytics tool we run on our own servers. It sets no cookies and does not keep your network address. For a visit it records the page, the site that sent you, your browser, the kind of device and your country (worked out from your network address, which is then discarded). A button press records only the button's name, its section and the page. Visitors whose browser sends Do Not Track are not counted; Global Privacy Control stops the button records and the first-visit record described in section 7.

3. How We Use Your Information

We use collected information to:

• Provide and maintain the Ivory Key platform
• Process bookings and payments
• Send transactional emails (booking confirmations, receipts)
• Reply to people who contact us, and follow up a free trial
• Improve our services and user experience
• Understand which public product and pricing actions are useful to hotel operators
• Ensure platform security

4. Data Sharing

We do not sell your personal data. We share information only with the services that make the platform work:

• Paystack, to process card payments: hotels' guest payments, and hotels' subscriptions to Ivory Key.
• Credipay, to process payments by transfer and at the till, for hotels that connect Credipay.
• Resend, to deliver transactional emails.
• Meta (WhatsApp Business), to send and receive guests' messages, for hotels that turn WhatsApp on.
• Cloudinary, to store and show images: hotels' photos and logos, and photos attached to requests.
• Voyage AI, when the guest assistant's search is switched on: a guest's question, to find the answer in the hotel's own information.
• Cloud infrastructure providers, to host the platform.

Some of these services process information outside Nigeria. Each receives only what it needs for its part. Website analytics (Umami) runs on Ivory Key's own servers; what it records is not shared with another company.

5. Opening or Connecting a Credipay Account

Ivory Key sends a hotel's business details to Credipay, to open or connect a Credipay account, only when one of the hotel's administrators asks it to and agrees at that moment. That agreement is recorded. The details are the administrator's name and email, the hotel's trading name, its properties' names, addresses, emails and phones, the type of property, its logo and its website.

Ivory Key never sends Credipay identity documents, BVN or NIN, company registration documents, tax numbers or bank account details, and holds none of these for a hotel or its owners. A hotel gives those to Credipay directly, on Credipay's own pages, and Credipay checks them. Credipay's own privacy policy governs what it does with them.

6. Data Security

We implement industry-standard security measures including encrypted data transmission (TLS), hashed passwords (bcrypt), and secure token-based authentication (JWT). Payment information is handled by PCI-compliant payment processors. Hotels' payment keys are stored encrypted, and changing one needs the administrator's two-factor code.

7. Cookies and Browser Storage

Ivory Key stores only what it needs to do what you asked. It sets no advertising or tracking cookies.

Cookies:

• accessToken, refreshToken: keep hotel staff signed in.
• activeOrgId: remembers which hotel group a staff member is working in, for 90 days.
• guestAccessToken, guestRefreshToken: keep a guest signed in to their guest account.
• stayAccessToken: opens a guest's stay from the link the hotel sent them.
• website-preview: lets hotel staff preview a website before it is published.

Browser storage, kept on your device:

• Choices you make: light or dark mode, dashboard layout, recently used commands, and on a hotel's website, light or dark and your answer about analytics.
• Work in progress: staff updates (kitchen, housekeeping, tasks and requests) made without a connection, kept until they can be sent.
• For the length of a payment page only: a key that stops the same payment being taken twice.
• On ivorykey.app only: where your visit started (the campaign tags in the link you followed, the first page you opened and the site that sent you), kept for 30 days and sent to us only with a form you submit or when you sign up. It is not kept if your browser sends Do Not Track or Global Privacy Control.

Hotel websites built on Ivory Key load their fonts from Ivory Key, not from a font provider. A map on a hotel's website is loaded from OpenStreetMap. If a hotel adds Google Analytics to its website, the website asks each visitor first and loads it only for those who allow it; that collection is the hotel's, described in the hotel's own privacy notice.

8. Your Rights

You have the right to access, correct, or delete your personal data, to object to how it is used, and to withdraw an agreement you gave, under the Nigeria Data Protection Act 2023 and, where it applies, the GDPR. Hotel administrators can manage guest data through the platform's GDPR consent tools. To exercise your rights, contact us at privacy@ivorykey.app. A guest asking about a stay should contact the hotel first, since the hotel decides about its guests' information. You may also complain to the Nigeria Data Protection Commission.

9. Contact

For privacy-related questions, contact us at privacy@ivorykey.app.