Privacy Policy

• Your account — your email address, and if you add them, your name, phone number and preferred language. When you signed up and which version of our terms you accepted.
• Sign-in — for each device you’re signed in on: the browser and system, your IP address, and when it was last used.
• Bookings and stay requests — the stays you book, host or ask for: dates, guests, area, budget and price.
• Payments — a record of each payment and refund, and for saved methods a token held by the payment provider and a masked label. We never store a full card number, security code or wallet PIN.
• If you host — your listings and photos, your CNIC number and photos of your CNIC for identity checks, and the bank account your payouts go to.
• What you write — messages, offer and request notes, reviews and replies.
• Listing views — we count how often a listing is opened, using a daily, one-way code made from your connection. It can’t be turned back into your address and is discarded after a day.

• To run the bookings and payouts you ask for: creating and confirming bookings, taking payment, issuing refunds and paying hosts. (Needed to provide the service.)
• To send sign-in codes and messages about your bookings, payouts and account security. (Needed to provide the service.)
• To verify hosts’ identity and bank accounts before money is paid out, and to meet tax and record-keeping duties. (Legal obligation and fraud prevention.)
• To keep Ravaaq safe: we automatically remove phone numbers, emails, links and bank details from messages, notes, listings and reviews, and record attempts to move bookings or payments off Ravaaq. (Legitimate interest in preventing fraud and protecting both sides of a stay.)
• To show hosts how their listings are doing, using counts that don’t identify you. (Legitimate interest.)
• To send news and offers by email, only if you opt in. You can opt out at any time from your profile. (Consent.)

• Before you book, a listing's location is shown only approximately — within about 300 metres. The exact address is shared with a guest only for a paid stay, and is withdrawn if the stay is cancelled.
• Hosts and guests see each other by first name and last initial. Email addresses are never shown to other people.
• Phone numbers are shown to your host or guest only from 24 hours before check-in until check-out.
• You and your host can message each other from when a stay is paid until two weeks after check-out.
• Reviews are public and show your first name.
• A small Ravaaq team can see account details to check listings, identities and payouts and to help with problems. Every look at identity documents is logged.

We share information only where a stay or the law requires it:

• Payment providers — Easypaisa, JazzCash and our card processor — to take and refund payments.
• Our email provider, to send you email, and Cloudflare, which carries traffic to our apps securely.
• Your host or guest — the details needed for the stay you have booked, as described above.
• Authorities — where Pakistani law requires us to.

We do not sell your information, and we do not use advertising trackers.

• Connections to Ravaaq are encrypted. CNIC numbers and bank account numbers are also encrypted in our database.
• Photos are re-saved when uploaded, which removes hidden information such as the location a phone photo was taken.
• Your sign-in session is kept in a secure cookie that pages can’t read, and ends when you sign out or delete your account.
• We tell you by email when your payout bank account changes, when your data is downloaded, and when your account is scheduled for deletion.

• Sign-in codes: a day. Signed-in devices: until you sign out or the session ends (30 days).
• Photos of your CNIC: 30 days after your identity is verified, or 90 days after a rejection. The CNIC number itself is kept, encrypted, while you host.
• Notifications: 6 months once read, a year otherwise.
• Notes on stay requests: a year after the request closes.
• Records of removed contact details: two years.
• Uploads you never used: a day.
• Bookings, payments, refunds and payouts: as long as tax and accounting law requires, even after your account is deleted — but without your name or contact details.

Ravaaq uses one cookie, to keep you signed in. It is only used by Ravaaq. The apps also remember, in your browser, the search and dates you last picked and the name shown in the header, so they are still there when you come back. There are no analytics or advertising cookies.

Maps, fonts and place search are served from Ravaaq’s own servers, so where you look on the map is not sent to an outside service.

• See and correct your name, phone number and language on your profile.
• Get a copy of your data: “Download my data” on your profile gives you everything in a file.
• Delete your account from your profile. It is deleted 14 days later unless you sign in again; then your name, contact details, identity documents, bank details, photos, saved stays and messages are removed. Reviews you wrote stay on listings without your name.
• Withdraw consent to marketing email at any time.
• Object or complain — contact us through the Help Centre. You can also complain to the data protection authority where you live.

Ravaaq is for people aged 18 and over, and we don’t knowingly collect information about children.

For anything about your information, visit the Help Centre. We’ll tell you here, and ask you to accept, if this policy changes in a way that matters.