This is a draft written for the Makanzaa pilot. It must be reviewed by a qualified lawyer in Pakistan before Makanzaa takes paying customers.
This policy explains what information Makanzaa stores, why, who can see it and the choices people have. Makanzaa is used by property management companies. Each company decides what to enter and who to invite.
Information we store
- Company and team: company name, logo and colour; names, emails and roles of admins, managers and cleaners.
- Property owners: name, email, phone, country and a short note about how they are paid.
- Properties: name, address, fees, check-in and Wi-Fi details, photos and calendar links.
- Guests: name and phone number, stay dates, amounts and payment method, and whether staff checked their ID in person.
- Operations: cleaning tasks and photos, expenses and receipt photos, owner statements.
- Security records: sign-in events and an audit log of sensitive actions such as role changes, deletions and statement payments.
Information we never store
- Copies or numbers of CNIC, passports or any identity document.
- Bank account, IBAN or card numbers. The database refuses notes that look like account numbers.
Who can see what
- Each company sees only its own information. This is enforced inside the database, not only on screen.
- Managers see bookings and operations but not owner details or statements.
- Cleaners see only the cleaning jobs assigned to them.
- Owners see only their own properties, guest first names and dates (never guest phone numbers), expenses with receipts, photos and their statements.
- Makanzaa staff look at a company's data only when that company asks for support, and only as much as needed to help.
Where it is kept and for how long
- Data is stored with our providers Supabase (database, sign-in and private file storage) and Vercel (website hosting). Data may be stored on servers outside Pakistan. Connections are encrypted.
- Photos and receipts are kept in private storage and opened through links that expire after one hour.
- We keep data while the company uses Makanzaa. After an account ends we delete it within 30 days of the export period, unless the law requires us to keep it.
Cookies
Makanzaa uses only the cookies needed to keep you signed in. Your browser also remembers whether you have seen the guided tour. We do not use advertising cookies.
Your choices
Guests, owners and staff who want to see, correct or delete their information should contact the management company that entered it. Companies can ask us to export or delete their data at hello@makanzaa.com.
If something goes wrong
If we learn of a security incident affecting your information, we will tell affected companies without undue delay and explain what happened and what we are doing about it.