Privacy Policy

Comfy Inn Eldoret ("Comfy Inn Eldoret", "we", "our", or "us") respects your privacy and is committed to protecting the personal information you provide when using our mobile application and website.

This Privacy Policy explains what information we collect, why we collect it, how we use it, how we protect it, and the choices available to you. It applies to our mobile application (available on Google Play) and to our website at www.comfyinneldoret.com.

1. Information We Collect

When you create an account or use our application, we may collect the following categories of personal information:

1.1 Personal Information

• Name – to identify and communicate with you.
• Phone number – to contact you regarding your orders, bookings, account verification, and payment prompts. Your phone number also serves as your unique user identifier within our system.
• Email address (optional) – for booking confirmations and receipts.
• City – to assist with customer service and order-related services.
• Location / Area – to facilitate food delivery and provide location-relevant services. When you use the location picker for food delivery, we collect the coordinates and address you select.
• Password – to authenticate your account. Passwords are hashed using industry-standard algorithms before storage.

1.2 Transaction & Activity Information

• Order information – food purchases, items, quantities, prices, and order timestamps.
• Room booking information – check-in/check-out dates, room type, package, guest count, and total amount.
• Payment transaction references – the Paystack reference, payment status, and payment channel used. We do not store your full card number or M-Pesa PIN.
• Loyalty points and related account information – to manage our customer loyalty program.

1.3 Technical Information

• Device type, operating system version, and app version (collected automatically for security and compatibility purposes).

We only collect information that is reasonably necessary to provide and improve the services offered through the application.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To create and manage your customer account.
• To process and manage food orders.
• To process and manage room bookings.
• To provide and manage customer loyalty points.
• To process payments for purchases and bookings.
• To send order notifications, booking notifications, and payment prompts via SMS and email.
• To communicate with customers regarding their orders, bookings, or account.
• To provide customer support and improve our services.
• To maintain the security and proper operation of our application.
• To comply with legal obligations and enforce our terms.

Your information is not used for purposes unrelated to the services described in this Privacy Policy unless we notify you and, where required, obtain appropriate consent.

3. Payments

Payments made through the application are processed using Paystack, a third-party payment service provider. Paystack is PCI-DSS compliant and handles mobile money and card payment processing on our behalf.

When you make a payment, information necessary to process the transaction — such as your phone number and transaction amount — is shared with Paystack in accordance with their privacy practices. You can review Paystack's privacy policy at paystack.com/privacy.

Comfy Inn Eldoret does not use the application to perform transactions other than the purchase of food and room bookings, unless additional transaction services are introduced in the future.

We do not store customers' full payment card details, M-Pesa PINs, or similar financial credentials in our own database.

4. Data Storage

Information collected through the application is stored in our database infrastructure provided by Neon (serverless PostgreSQL). Data is encrypted at rest and in transit.

We take reasonable technical and organizational measures to protect customer information against unauthorized access, alteration, disclosure, or destruction. These measures include password hashing, HTTPS/TLS encryption for data in transit, and access controls on our backend systems.

However, no method of transmitting or storing information electronically can be guaranteed to be completely secure. We encourage users to protect their account credentials and notify us immediately of any suspected unauthorized access.

5. Data Sharing

We do not sell or rent your personal information to third parties.

We may share information with service providers where necessary to provide our services. These currently include:

• Paystack — payment processing.
• Neon — database hosting and storage.
• SMS gateway provider — to deliver order and booking SMS notifications.

We may also disclose information where required by applicable law, legal proceedings, or a lawful request from an authorized authority, or to protect the rights, property, or safety of Comfy Inn Eldoret, our guests, or the public.

6. Notifications and Communications

We may use your phone number and other relevant account information to communicate with you about:

• Food orders and their status.
• Room bookings and their status.
• Payment confirmations.
• Account verification codes.
• Customer service matters.
• Other information directly related to services you have requested.

We do not use your personal information for unrelated marketing communications without appropriate permission where such permission is required. Transactional messages (order updates, booking confirmations, payment receipts) are always sent because they are necessary to deliver the service you requested.

7. Loyalty Program

We use certain account information and transaction information to manage customer loyalty points. Loyalty points are earned on eligible purchases (currently 1 point per KSh 100 spent) and can be redeemed for rewards such as complimentary meals and room stays.

Loyalty points are associated with your account and are displayed in the app. The loyalty program may be updated or changed as our services develop. Points have no cash value and are non-transferable.

8. Data Retention

We retain personal information for as long as reasonably necessary to provide our services, maintain customer and transaction records, manage loyalty points, resolve disputes, maintain security, and comply with applicable legal or regulatory requirements.

Specific retention periods:

• Account information — retained while your account is active, and deleted within 30 days of an account deletion request.
• Transaction records — retained for a minimum of 7 years to comply with financial record-keeping obligations, but disassociated from your personal identifiers where technically feasible.
• SMS / communication logs — retained for up to 12 months for support and audit purposes.

9. Your Privacy Rights

Depending on applicable law (including the Kenya Data Protection Act, 2019), you may have the following rights regarding your personal information:

• Right to access — request a copy of the information we hold about you.
• Right to correction — request correction of inaccurate information.
• Right to deletion — request deletion of your account or personal information (see Section 10).
• Right to object — object to certain processing activities.
• Right to complain — lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

To make a privacy-related request, please contact us using the contact information in Section 14 below.

10. Account and Data Deletion

You have the right to delete your Comfy Inn Eldoret account and the personal data associated with it at any time.

10.1 How to Delete Your Account

You can request deletion of your account and associated data in two ways:

1. In-App: Open the Comfy Inn app, navigate to the Profile page, and tap "Delete Account". Confirm the deletion when prompted. Your account and personal data will be scheduled for removal.
2. Web Request: If you cannot access the app, you can submit a deletion request using the form at the bottom of this page, or by emailing us at info@comfyinneldoret.com with the subject line "Account Deletion Request" and your registered phone number.

10.2 What Data is Deleted

When you request account deletion, we will permanently remove:

• Your account profile (Name, Phone, City, Location, Email).
• Your password and authentication credentials.
• Your loyalty points balance and history.
• Any app-specific preferences tied to your account.

10.3 What Data May Be Retained

Certain transactional records (completed bookings, food orders, and payment references) may be retained for a limited period as required by financial and legal regulations (typically up to 7 years). These records are disassociated from your identity where technically feasible, meaning your name and contact details are stripped out and only the anonymous transaction metadata remains.

10.4 Processing Time

We will process your deletion request within 30 days of receiving it. You will receive a confirmation once the process is complete.

11. Children's Privacy

Our application is not specifically directed toward children under the age of 18.

We do not knowingly collect personal information from children where such collection is prohibited by applicable law. If you believe that a child has provided personal information to us without appropriate authorization, please contact us so that we can take appropriate action, including deleting the information.

12. Third-Party Services

Our application may use third-party service providers to provide certain functionality. These may include:

• Paystack — payment processing (mobile money, cards). Privacy Policy
• Neon — database infrastructure and data storage. Privacy Policy
• SMS gateway provider — to deliver transactional SMS notifications.

Third-party providers may process information in accordance with their own privacy policies and terms. We encourage you to review their policies before using our services.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time as our application, services, or legal requirements change.

When we make changes, we will update the effective date shown at the top of this page, and where the changes are significant, we will notify users through the app or by SMS.

We encourage users to review this Privacy Policy periodically. Continued use of the application after an update constitutes acceptance of the revised policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact: