Privacy Policy
What personal data we collect, why we are allowed to use it, who else sees it, how long we keep it, and how to make us stop.
Last updated: 5 September 2026
1. Who is responsible for your data
Y3NKO is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are the organisation you hold responsible for it. Our full identity and address are at the foot of this page.
For data-protection questions or to exercise any of the rights in section 7, email contact@y3nko.travel with “Privacy” in the subject line.
We are based in Ghana and are subject to the Data Protection Act, 2012 (Act 843). Where we offer our service to people in the United Kingdom or the European Economic Area, the UK GDPR and the EU GDPR also apply to us, and this policy is written to meet them.
2. What we collect
Information you give us
- Your name, email address and phone number when you register.
- Your password, stored only as a cryptographic hash — we never see it.
- Profile details you choose to add, including a photo, and your preferred display currency.
- Booking details: what you booked, the dates, the number of guests, and any note you leave for the host.
- Messages you send us through the contact form, the feedback form, or by email.
- Reviews and photographs you post.
- If you apply to become a host: your business details, payout details, an identity document, and a business licence where applicable.
We never receive your card number. Card details go directly to Paystack, our payment processor. We store only the booking amount, currency, a payment reference and whether the payment succeeded.
Information we collect automatically
- Your IP address, used to apply rate limits that stop automated abuse of our sign-up and contact forms.
- Basic technical information your browser sends, such as browser type and version.
- Session cookies that keep you signed in. These are described in the Cookie Policy.
We do not track you across other websites, we do not run advertising pixels, and we do not build behavioural profiles of you.
3. Why we are allowed to use it
Under the UK and EU GDPR we must have a lawful basis for each use. Here is ours, in full:
| What we do | Why | Lawful basis |
|---|---|---|
| Create and run your account | You cannot book without one | Performance of a contract with you |
| Take payment and confirm a booking | It is the service you asked for | Performance of a contract with you |
| Share your name and booking details with the host | The host has to know who is arriving and when | Performance of a contract with you |
| Send booking confirmations, changes and cancellations | You need to know the state of your booking | Performance of a contract with you |
| Verify a host's identity and business documents | So guests are not sold a listing by an anonymous stranger | Legitimate interests — preventing fraud and keeping the marketplace trustworthy |
| Rate-limit forms and block automated abuse | To keep the Platform working and stop spam | Legitimate interests — security of the service |
| Look into a complaint or a dispute | To resolve it fairly | Legitimate interests — running the business responsibly |
| Keep booking and payment records | Tax and accounting rules require it | Compliance with a legal obligation |
| Send marketing email or a newsletter | Only if you asked for it | Your consent — withdrawable at any time |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your privacy. You can object to any of it — see section 7.
4. Who else sees your data
We do not sell your personal data. We never have and we do not intend to. We share it in only two situations: with the host you booked with, and with the service providers below, who process it on our instructions and are not permitted to use it for their own purposes.
| Provider | What they do | What they see |
|---|---|---|
| The host you booked with | Provides the stay, event, activity or table | Your name, booking dates and party size, and any note you left. Not your card details, not your address. |
| Paystack | Processes card and mobile-money payments | Your card details, name, email and the amount. Paystack is the controller of the card data it holds. |
| Supabase | Hosts our database, sign-in system and uploaded files | Everything stored in your account, including host identity documents, which are kept in private storage. |
| Vercel | Hosts and serves the website | Request data including your IP address, in server logs. |
| Resend | Sends our transactional email | Your email address and the contents of the email we send you. |
| Upstash | Runs the rate limiter that blocks automated abuse | A short-lived, hashed record keyed on your IP address or account. |
| Google Maps | Draws the map on a listing page | Your IP address and the map you loaded, when a page with a map is opened. Google acts as its own controller for this. |
We will also disclose data where we are required to by law, or where it is necessary to establish or defend a legal claim. If we are ever compelled to hand over your data, we will tell you unless we are legally forbidden from doing so.
5. Where your data goes
We operate from Ghana. Our service providers operate infrastructure outside Ghana, including in the United States and in Europe. So if you are in the UK or the EEA, your personal data leaves your country.
Neither Ghana nor the United States as a whole benefits from a UK or EU “adequacy” decision. For those transfers we rely on the standard contractual clauses approved by the European Commission, together with the UK Addendum. These are incorporated into the data processing agreement each of the providers named above applies to our account. You can ask us which safeguard covers your data by emailing contact@y3nko.travel.
6. How long we keep it
| Data | How long | Why |
|---|---|---|
| Your account and profile | For as long as your account is open, then 30 days after you ask us to close it | The 30 days lets us reverse an accidental or fraudulent deletion |
| Booking and payment records | 6 years from the end of the tax year the booking falls in | Ghanaian tax and accounting record-keeping rules |
| Host identity and business documents | For as long as the host is active, then 6 years | Anti-fraud and record-keeping; we delete these on request once the retention period ends |
| Reviews you posted | Kept after account closure, with your name removed | Deleting them would misrepresent a host's rating history |
| Support and complaint correspondence | 3 years from the last message | So we can pick up a recurring problem, and defend a claim if one is brought |
| Server logs containing IP addresses | Retained by our hosting provider for a short operational period | Security and debugging |
| Rate-limiting records | Hours to days | They expire automatically; nothing is retained long-term |
7. Your rights, and how to use them
If you are in the UK or the EEA, you have the rights below. We extend the same rights to everyone who uses the Platform, wherever you live, because it is simpler and fairer.
- Access. Ask for a copy of the personal data we hold about you.
- Correction. Have anything inaccurate fixed. Most of it you can edit yourself in your profile settings.
- Deletion. Ask us to delete your data. We will, except where we must keep a record for tax or legal reasons — in which case we will tell you exactly what we are keeping and why.
- Restriction. Ask us to pause using your data while a dispute about it is resolved.
- Objection. Object to any use we base on legitimate interests. Object to marketing at any time and we will stop, no questions asked.
- Portability. Get the data you gave us in a machine-readable file, or have us send it to another provider.
- Withdraw consent. Where we rely on your consent, you can take it back. This does not undo anything done before you withdrew it.
To exercise any of these, email contact@y3nko.travel. We will answer within 30 days. We may ask you to confirm your identity first, so that someone else cannot obtain your data by asking for it. We do not charge for this.
8. If you are unhappy with how we handled it
Tell us first — contact@y3nko.travel — and give us a chance to put it right. If you are still not satisfied, you have the right to complain to a supervisory authority:
- Ghana: the Data Protection Commission.
- United Kingdom: the Information Commissioner’s Office (ICO).
- European Economic Area: the data protection authority in the country where you live or work.
Complaining to us first does not affect your right to complain to them.
9. Security
Passwords are hashed, never stored in readable form. Card details never reach our servers. Host identity documents sit in private storage that no browser can reach directly — only a short-lived, single-use link generated for an authorised reviewer. Traffic to the site is encrypted in transit.
No system is perfectly secure, and we will not pretend otherwise. If a breach happens that puts your rights at risk, we will tell you and the relevant regulator, within the deadlines the law sets.
10. Cookies
We use a small number of cookies, almost all of them strictly necessary to keep you signed in. The full list, what each one does, and how to control them is in the Cookie Policy.
11. Automated decisions
We do not make decisions about you by automated means alone that have a legal or similarly significant effect. Our rate limiter can temporarily block a form submission from an IP address, but it does not decide anything about you personally, and a person will lift it if you email us.
12. Children
The Platform is for adults. You must be 18 or over to hold an account. We do not knowingly collect data about children. If you believe a child has given us their data, email us and we will delete it.
13. Changes to this policy
If we change this policy in a way that matters to you, we will email account holders before it takes effect, not merely change the date at the top. The date at the top tells you when the current version came into force.
Who you are dealing with
Y3NKO is a trading name. The operating company is being registered in Ghana. We will publish the registered name, company number and registered office here as soon as registration completes, and we will tell existing account holders by email when we do.
Until then, contact us at contact@y3nko.travel. We operate from Accra, Ghana.