Privacy Policy

1. Information we collect

Account data you give us: your name, email address, and password (stored only as a secure hash). Workspace data you create: properties, iCal feed URLs, bookings, owner records, statements, cost settings, and support messages. Payment data: plan purchases are handled by Paystack; we receive confirmation and status, not your full card number. If you save a card for renewals, we keep only the card type, last four digits, expiry date and issuing bank so you can recognise it; the card itself is stored by Paystack. Technical data: basic request and usage information (e.g. IP address, device/browser, aggregate analytics) collected to run and secure the Service.

An email address and password are required to create an account; without them we cannot provide the Service. Other workspace information is provided voluntarily, but some features (such as owner statements) will not work without it.

Find a stay ID checks: a host whose property is not on a booking site may send us the owner's identity document and a recent proof of address, with the owner's permission, so we can check the listing is genuine before it goes live. We keep them in private storage, use an automated (AI) tool only to help our staff read them, make the decision ourselves, and delete both files as soon as we have decided. We keep only the outcome, the owner's name, the property address and the date. They are never shown to guests.

Find a stay listings: if a host chooses to list their business on our public Find a stay page, we publish only the details they type into the listing (such as business name, town or area, phone, email and website). Where the host is an individual, these may be personal information. We display them based on the host's consent, which they can withdraw at any time by hiding the listing in Settings; it is then removed from the page straight away. A host may also show an availability calendar (free and booked days only). Guests can then send a booking request with their name, email, optional phone number, number of guests and a message. We store the request and email it to the host so they can reply, accept or decline; for these requests the host is the responsible party and StayKnit acts as their operator. Requests are kept in the host's account and removed when the host deletes their account. Guests can also contact the host directly instead.

2. How we use it

To provide and operate the Service (syncing calendars, generating statements), to authenticate you and secure your account, to process payments, to respond to support requests, and to comply with legal obligations. We do not sell your personal information.

Service and product emails: we email account holders about their account, billing, and changes to the Service, Terms or prices — these are part of the Service and are not marketing. Occasional product news is sent to existing customers about similar services, as permitted by section 69 of POPIA. Every product-news email has an unsubscribe link, and you can opt out at any time in Settings or by emailing us. We do not send marketing to anyone who is not a customer without their prior consent.

3. Legal bases

We process data to perform our contract with you (providing the Service), to comply with legal obligations, and for our legitimate interests in securing and improving the Service, consistent with applicable data-protection law. Where required, non-essential processing (such as analytics) relies on your consent, which you can withdraw.

4. Who we share it with

We share data only with the service providers needed to run StayKnit:

• •Vercel Inc. — Application hosting, file storage (such as staff report photos), analytics, and content delivery
• •Neon Inc. — Managed PostgreSQL database storage and backups
• •Paystack Payments Limited — Payment processing for plan purchases
• •Namecheap (Private Email) — Transactional email delivery
• •Functional Software, Inc. (Sentry) — Error monitoring — receives technical data such as IP address, browser/device details and the page where an error happened
• •Channex.io — Direct (API) channel connections (included in StayKnit Pro, add-on on other plans) — only for hosts who switch it on; receives listing availability and booking details such as guest names, dates and amounts

These providers process data on our behalf under contract as operators, or, in the case of payments, as independent responsible parties. We may also disclose data where required by law.

Some personal information may be processed and stored outside South Africa by these providers. We rely on contractual safeguards and comparable data-protection standards to comply with section 72 of the Protection of Personal Information Act, 2013 for cross-border transfers of personal information.

StayKnit is run from South Africa and is built around POPIA. If you use StayKnit from the European Union or the United Kingdom, local data-protection laws (such as the GDPR) may give you additional rights; contact us and we will respond to your request in line with the law that applies to you.

5. Retention

We keep your data for as long as your account is active. You can delete your account at any time from Settings, which permanently erases your data. Profiles left inactive for 12 months are deleted automatically, as set out in our Terms of Service. We email the account address at least 30 days before this happens, and signing in keeps the profile. Some records may be retained longer where the law requires it (for example, payment records for tax purposes).

Owner and guest information entered by a host is kept for the host and deleted on the host’s instructions — when the host removes it, deletes their account, or their account is deleted for inactivity under the agreed Terms. A host can ask us to delete or return this information at any time.

Backups: for disaster recovery our database provider keeps encrypted backups. Deleted data can remain in these backups for up to 7 days until they expire on their normal cycle. Backups are not used for any other purpose and are only restored to recover the Service.

Guest reviews, complaints and their photos (including any name or email the guest chose to give) are kept for 24 months from the day they were sent, then permanently deleted. Before that, the host receives three email reminders, starting about a month ahead, with a link to export a copy.

Photos added to staff reports (cleaning, inspections, damage and maintenance) are kept for 24 months, then permanently deleted. The host is emailed at least 30 days before. The written report is kept with the host's other records. When a report, listing or account is deleted, its photo files are deleted too.

6. Your rights

Subject to applicable law, you may access, correct, export, or delete your personal information, and object to or restrict certain processing. StayKnit provides self-service export and deletion in Settings. To exercise any other right, contact us at support@stayknit.org.

Guests and owners: where a host has entered or imported your information, the host is the responsible party. Please contact the host first; StayKnit will assist the host in responding to your request. You may also contact us at support@stayknit.org and we will direct your request appropriately.

Complaints: if you believe your personal information has been processed unlawfully, please contact us first at support@stayknit.org so we can try to resolve it. You also have the right to lodge a complaint with the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Email: POPIAComplaints@inforegulator.org.za

7. Cookies and tracking

StayKnit uses essential cookies for authentication, error monitoring to keep the Service working, and — only with your consent — privacy-friendly analytics to understand usage. See our Cookie Policy for details and your choices.

8. Security

All connections to StayKnit are encrypted in transit using HTTPS, and our database provider encrypts stored data at rest. Passwords are hashed, sessions use HttpOnly cookies, and data is scoped per account. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

9. Data breaches

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected users as soon as reasonably possible, as required by section 22 of the Protection of Personal Information Act, 2013. Where the affected information was entered by a host, we will also notify that host.

10. Contact

StayKnit (Pty) Ltd
Registration number: 2026/740258/07
Pai Nosso Close, Paternoster, Western Cape, 7381, South Africa
Information Officer: Johan Pawson
support@stayknit.org