Privacy Policy

Last updated: 30 May 2026 · Royale Garden Hostel · support@royalegardenhostels.com

This Privacy Policy explains how Royale Garden Hostel (“Royale Garden”, “we”, “us”) collects, uses, shares and protects information about you when you use our mobile app and web portal (together, the “Service”).

1. Who we are

Royale Garden Hostel operates a private student residence and provides the Service to its residents and authorised staff to manage their stay, payments and maintenance requests. Contact us at support@royalegardenhostels.com.

2. The information we collect

2.1 Information you give us

• Account information: your full name, email, phone, and (where applicable) guardian/emergency contact and student information (institution, course, level, student ID).
• Profile information: any details you update in the app — phone, photo, password.
• Complaint and maintenance content: subject, description and any optional attachments you submit when reporting an issue.
• Communications: messages you send us, including emails to support.

2.2 Information we collect automatically

• Device push token: Firebase Cloud Messaging token, stored against your account so we can deliver notifications.
• Sign-in metadata: timestamps and device used to sign in, for security audit.
• Basic technical information: HTTP request metadata (IP, user agent) for security and abuse prevention.

2.3 What we do not collect

• We do not collect your location.
• We do not use third-party advertising or marketing trackers.
• We do not access your microphone, camera, contacts, health data, calendar, SMS or call logs.
• We do not store your card or bank details (see Payments below).

3. Payments

Rent and any penalties are paid through Paystack, a regulated payment service provider. When you tap “Pay now”, the app opens Paystack’s hosted checkout in a secure webview. Your card details are entered into and processed by Paystack and never reach our servers.

Paystack acts as an independent controller for the card data, governed by their privacy policy at paystack.com/privacy/merchant. We record only what we need to administer your tenancy: the transaction reference, amount, currency, payment type, date, and a link to your account.

4. How we use your information

• Create and operate your account and authenticate you.
• Show you your active rental and outstanding obligations.
• Process and record payments through Paystack.
• Accept, route and resolve the complaints and maintenance requests you submit.
• Send transactional notifications (rent reminders, payment confirmations, maintenance status, important announcements).
• Respond to your support requests.
• Maintain the security and integrity of the Service.
• Comply with applicable legal obligations (tenancy and tax record-keeping in Nigeria).

We do not use your information for advertising, and we do not use it to train any machine-learning models.

5. Legal basis

Where required (e.g. EU/UK GDPR), our bases are: performance of a contract(to provide the Service and process payments for your tenancy), legitimate interest(to keep the Service secure and improve it), consent (for push notifications) and legal obligation (record-keeping required by Nigerian tax and tenancy law).

6. Who we share your information with

• Paystack — to process card payments you initiate.
• Firebase Cloud Messaging (Google LLC) — to deliver push notifications. Only the device’s FCM token leaves our servers.
• Your hostel’s authorised staff — admins and the facility team see what they need to administer your tenancy.
• Hosting and infrastructure providers — cloud providers that operate our backend, processing data on our behalf under our instructions.
• Public authorities or law enforcement — only where legally compelled.

We do not sell your personal information and do not share it with advertisers or data brokers.

7. How long we keep your information

• While you are a resident: as long as you have an active rental, plus a reasonable period for final reconciliations.
• After you leave: transaction records are retained for the period required by Nigerian tax law (typically six years); other personal data is deleted within 30 days of the end of your tenancy or your verified deletion request.
• Push tokens: deleted when you uninstall the app or sign out.

8. Your rights

You may at any time:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Delete your account and personal data (subject to legal retention).
• Object to or restrict certain processing.
• Withdraw consent for push notifications.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email support@royalegardenhostels.com. We respond within 30 days.

9. Security

• All traffic between the app and our backend is encrypted in transit using TLS.
• Passwords are hashed with bcrypt (10 rounds).
• Access to admin features is enforced by role on every API request, and audited.
• Access to production data is restricted on a need-to-know basis.

If we ever become aware of a security incident affecting you, we will notify you within the timeframe required by law.

10. Children

The Service is intended for tertiary-education students aged 18+ and authorised hostel staff. It is not directed at children under 13 and we do not knowingly collect personal information from children under 13.

11. International transfers

Our hosting providers may process data outside Nigeria. Where so, we rely on appropriate safeguards (such as the provider’s standard contractual clauses) to protect your data to the same standard as under Nigerian law.

12. Changes to this policy

We may update this policy from time to time. When we do we change the “Last updated” date at the top and, for material changes, post a notice in the app and email you.

13. Contact

Email: support@royalegardenhostels.com
Security: security@royalegardenhostels.com