Privacy Summary at a Glance
We never sell, rent, or monetize your personal information to third-party ad networks or data brokers.
Your details are shared solely with the specific hotel property you booked to fulfill check-in.
Our Android app does not access your background location, contacts, camera, or SMS inbox.
You can request complete deletion of your account and customer booking records anytime.
1. Introduction & Operating Entity
SwatStay (“we,” “our,” or “us”) is an authorized tourism accommodation booking service in Khyber Pakhtunkhwa, operated as a product of Sari Jehan Research Consultancy (Regd), having its principal operational desk in Mingora, Swat Valley, Pakistan.
This Privacy Policy explains how we collect, use, process, and disclose your personal information when you use our website (https://swatstay.com) and our Android mobile application (package identifier: swatstay.com).
By accessing our website, creating an account, or downloading the SwatStay mobile app, you consent to the data practices described in this document.
2. Information We Collect
We collect information necessary to provide verified hotel booking services, ensure room readiness, and comply with hospitality regulations:
- Primary Guest Information: Full legal name as stated on your National Identity Card or Passport, email address, and active Pakistani mobile or WhatsApp phone number.
- National Identity (CNIC / Passport Number): In accordance with government regulations in Khyber Pakhtunkhwa and hotel security protocols, primary guests must provide their 13-digit Pakistani CNIC number (or Passport number for foreign visitors) for hotel guest registry logs.
- Reservation Parameters: Chosen property name, room type, check-in and check-out dates, total nights, number of guests, special accommodation requests, and unique booking reference codes (e.g.
SS-XXXXX). - Payment & Transaction Records: Selected payment method (Cash on Arrival / Pay at Property, EasyPaisa, JazzCash, or 1-Link Raast) and user-submitted digital Transaction IDs (TID). Note: SwatStay does not collect or store credit card CVV codes, bank account PINs, or online banking passwords.
- Account Credentials: If you register a customer account, we store your email address and an encrypted, irreversibly salted password hash (via bcrypt).
3. Android Mobile Application Disclosures (Google Play Compliance)
For users of our official Android application (SwatStay, application ID: swatstay.com), we disclose the following device permissions and behaviors:
Requested Android System Permissions:
android.permission.INTERNET: Required solely to securely transmit booking searches, account logins, and reservations to our production servers (https://swatstay.com/api) over encrypted HTTPS connections.android.permission.ACCESS_NETWORK_STATE: Used to detect offline states and display friendly connectivity prompts without failing silently.
The SwatStay Android application does NOT request access to:
- Background or fine location tracking (GPS).
- Contact lists or address book data.
- SMS or call logs.
- Device microphones or ambient audio.
- Continuous camera or media libraries.
Local App Storage: The application uses secure local device storage (AsyncStorage) solely to preserve your login authentication token (JWT) and a local cache of your recently verified reservations so you can view your digital check-in passes without re-entering details each time.
4. How We Use Collected Data
We use your information exclusively for the following operational purposes:
- Reservation Fulfillment: Processing hotel bookings, locking atomic inventory to prevent double-booking, and issuing official reservation reference numbers.
- Digital Check-In Passes: Generating high-security QR verification tokens that hotel front desks scan to authenticate valid bookings.
- Automated Notifications: Transmitting transactional emails (Pending Confirmation, Booking Confirmation, Check-In details, and Post-Stay receipts) and WhatsApp reservation updates.
- Fraud Prevention: Verifying Pakistani mobile numbers and legitimate booking records to prevent fake bookings and financial abuse.
- Customer Support: Assisting travelers with road conditions, check-in coordination, and booking modifications across Swat Valley.
5. Sharing & Disclosure of Information
SwatStay values your privacy. We strictly limit data sharing to:
- The Booked Hotel Partner: We transmit your reservation details (Guest name, contact number, CNIC, room type, and dates) to the verified hotel manager of the property you booked, exclusively for room preparation and guest reception.
- Legal & Regulatory Mandates: We may disclose information if formally required by Pakistani courts, provincial law enforcement, or government tourism authorities under lawful legal process.
6. Account Deletion & Data Retention Rights
In compliance with global data protection standards and Google Play Developer Data Safety policies, travelers maintain full control over their personal data:
If you wish to permanently delete your SwatStay customer account, booking history, and personal details, you can submit a deletion request by emailing us at admin@swatstay.com with your registered email and mobile number.
Upon verification, your account record, profile credentials, and identifiable booking metadata will be permanently deleted from our active databases within 14 business days, except for financial transaction records required to be retained under statutory Pakistani tax audit regulations.
7. Data Security Measures
We implement comprehensive administrative, technical, and physical safeguards:
- Transport Layer Security: All client-to-server traffic is encrypted using modern TLS 1.3 / SSL over HTTPS.
- Database Protection: Production MariaDB storage runs behind isolated private networking with parameterized SQL prepared statements to prevent injection attacks.
- Strict Access Control: Access to customer reservation records is restricted strictly to authenticated session holders and authorized operational staff.
8. Contact Information & Privacy Queries
If you have any questions, concerns, or data requests regarding this Privacy Policy or our mobile application, please contact our Data Protection desk: