Privacy Policy

This Policy applies to guests, hosts, partners, website visitors, and anyone who contacts us or interacts with Sajilo Stay online or by phone/email. It covers data processed in connection with bookings, accounts, marketing (where permitted), customer support, and Platform security.

• “Personal information” means information that identifies or can reasonably identify an individual — such as name, contact details, booking history, or payment references.
• Hosts receiving guest details for a stay must use that information only to fulfil the booking and applicable law, not for unrelated marketing without separate lawful basis/consent.
• Where we act as a Marketplace, some processing is done jointly or on behalf of hosts; we still apply security and confidentiality standards described here.

We collect information you provide, information generated by your use of the Platform, and limited information from partners (for example payment confirmation status from wallets or banks).

Information you provide

• Identity and contact data: name, email, phone, nationality (when relevant to a stay), and account credentials.
• Booking data: check-in/out dates, guest counts, property preferences, special requests, and confirmation codes.
• Host/business data: property details, licensing information you submit, payout details, and listing content.
• Support communications: messages, emails, call notes, and complaint materials you send us.
• Marketing preferences: opt-ins or opt-outs for newsletters and promotional messages.

Information collected automatically

• Device and log data: IP address, browser type, approximate location derived from IP, pages viewed, and referral URLs.
• Cookies and similar technologies used for session management, preferences, analytics, and security (see Cookies).
• Fraud-prevention signals such as unusual login patterns or payment risk indicators.

Sensitive data

We do not seek to collect sensitive categories (for example health data, biometric templates, or intimate personal life details protected under the Privacy Act, 2075) unless you voluntarily provide them for a booking need (e.g., accessibility requests) or law requires it. We will not publish such matters in a way that insults or unlawfully exposes personal life.

We use personal information to:

• Create and manage accounts; authenticate users; and provide customer support.
• Process bookings, modifications, cancellations, refunds, and related communications with you and hosts.
• Facilitate payments through licensed providers and reconcile commissions or payouts.
• Improve search relevance, listing quality, and Platform reliability for Nepal’s connectivity conditions.
• Detect, investigate, and prevent fraud, abuse, and cyber threats.
• Send transactional messages (confirmations, reminders) and, where you consent or law allows, marketing messages you can opt out of.
• Comply with legal obligations, respond to lawful requests, and enforce our Terms.

We process data on bases appropriate under Nepalese law — including your consent where required, performance of a booking contract, our legitimate operational interests (balanced against your privacy), and legal compliance.

We do not sell personal information. We share data only as needed to operate the Platform or as required by law:

• Hosts and property partners: guest name, contact details, stay dates, guest count, and special requests needed to honour the reservation.
• Payment processors and banks/wallets (e.g., eSewa, Khalti, card acquirers): limited payment metadata required to complete or refund a transaction under applicable NRB and provider rules.
• Service providers: cloud hosting, email delivery, analytics, customer-support tools — bound by confidentiality and processing limits.
• Professional advisors and auditors under confidentiality obligations.
• Authorities: when required by Nepalese law, court order, or to report suspected cybercrime, fraud, or threats to safety (including cooperation with the Cyber Bureau of Nepal Police where appropriate).
• Corporate transactions: if we restructure or transfer business assets, subject to continued protection of personal information.

Consistent with the Electronic Commerce Act, 2081 (2025), we maintain confidentiality of personal and identifying details related to electronic commerce, and do not disclose or use such information except as permitted by prevailing law or as needed among parties involved in fulfilling the purchase of the stay.

We use cookies and similar technologies to keep you signed in, remember preferences (including language), measure performance, and protect sessions.

• Essential cookies: required for login, security, and core booking flows.
• Analytics cookies: help us understand how travelers use search and listing pages (aggregated where feasible).
• Preference cookies: store UI choices such as currency display preferences when available.

You can control cookies through your browser settings. Disabling essential cookies may break booking or account features. A dedicated Cookie Policy may be published separately; until then, this section governs cookie use.

We implement administrative, technical, and organizational measures appropriate to the risk of hospitality booking data — guided by good industry practice and Nepal’s National Cyber Security Policy, 2080 (2023).

• Encrypted transport (HTTPS/TLS) for data in transit on our websites.
• Access controls, least-privilege staff access, and monitoring for suspicious activity.
• Secure password handling and protections against common web attacks.
• Vendor due diligence for processors that handle personal information.

No system is perfectly secure. Unauthorized access, damage to computer systems, or online fraud may constitute offences under the Electronic Transactions Act, 2063 (2008) and related criminal law. If you suspect a security incident involving your Sajilo Stay account, contact us immediately. You may also report cybercrime to the Cyber Bureau of Nepal Police.

We retain personal information only as long as needed for the purposes described above, including booking records, accounting, dispute resolution, and legal retention requirements under Nepalese company, tax, and consumer law.

• Active account data: kept while your account remains open and for a reasonable period afterward for reactivation or legal claims.
• Booking and payment records: retained for the period needed for refunds, audits, and statutory record-keeping.
• Support tickets: kept for service quality and fraud review, then deleted or anonymized when no longer needed.
• Marketing lists: retained until you unsubscribe or we purge inactive contacts.

Subject to the Individual Privacy Act, 2075 (2018), the Electronic Commerce Act, 2081 (2025), and other applicable law, you may request to:

• Access personal information we hold about you.
• Correct inaccurate or incomplete account or booking details.
• Withdraw consent for optional processing (such as marketing) where processing is consent-based.
• Request deactivation of account identity credentials / closure of your Platform account, subject to pending bookings and legal retention needs.
• Object to certain uses that are not strictly necessary for a confirmed booking or legal duty.

To exercise these rights, email [email protected] with sufficient detail for us to verify your identity. We will respond within a reasonable period consistent with Nepalese legal requirements and our operational capacity. Note that Privacy Act remedies and complaint timelines under Nepalese law (including district court routes where applicable) may apply independently of this Policy.

Sajilo Stay is directed at adults booking travel. We do not knowingly create accounts for children under 18. Bookings that include children as guests may list children’s ages or counts as needed for room configuration; such data should be limited to what is necessary. Online exploitation of minors is prohibited and may engage the Act Relating to Children, 2075 (2018) and criminal law — we will cooperate with authorities on credible reports.

Our privacy programme is informed by — and intended to operate consistently with — key Nepalese instruments governing digital services and personal data:

The Privacy Act’s definition of “residence” includes hotels, resorts, lodges, and similar places where a person stays overnight. We and our hosts treat guest stay-related personal information with corresponding care.

Sajilo Stay is based in Nepal and primarily serves bookings for stays in Nepal. International travelers may access the Platform from abroad. Our infrastructure or vendors may process data on servers outside Nepal.

• Where cross-border processing occurs, we take steps appropriate under prevailing law to protect confidentiality and security.
• By using the Platform, you understand that your information may be processed in Nepal and in other locations where our service providers operate, subject to this Policy.
• If future Nepalese rules impose specific cross-border transfer conditions, we will align our contracts and practices accordingly.

We may revise this Privacy Policy to reflect Platform updates, security improvements, or changes in Nepalese privacy, e-commerce, cyber, or IT law. The “Last updated” date at the top will change when we post revisions. Material changes may be highlighted on the Platform or sent by email where appropriate.

For privacy requests, questions, or complaints about how Sajilo Stay handles personal information:

If you believe a cyber offence or serious data misuse has occurred, you may also contact the Cyber Bureau of Nepal Police in addition to notifying us. This Policy is informational and does not replace advice from a licensed Nepalese legal professional.