Privacy policy

Last updated 10 November 2026. Operated by Muhammad Ibtisam Imran, an individual (sole proprietor) resident in Pakistan.یہ دستاویز انگریزی میں ہے۔ کسی فرق کی صورت میں انگریزی متن معتبر ہوگا۔ سوالات کے لیے واٹس ایپ کریں: +92 336 9099340

1. Who is responsible

ibnb is operated by Muhammad Ibtisam Imran, an individual (sole proprietor) resident in Pakistan, who is responsible for how your personal data is handled. Questions and requests: help@ibnb.com.pk or WhatsApp +92 336 9099340.

2. What we collect

• Account: email address (verified by one-time code), name, mobile number, language preference, and the date you joined.
• Bookings: the listing, dates, number of adults and children, the note you write to the host, amounts, and the payment method you chose.
• Payments: the reference you quote on your bank transfer and the matching entry on our bank statement (sender name, amount, date). If card or wallet checkout is added later, a transaction reference and status from that provider. Card numbers, wallet PINs and bank credentials are entered in your own bank or wallet app and never reach our servers.
• Verification (optional): an image of your CNIC if you choose to get the verified badge.
• Hosting: listing details, photos, address and map pin, house rules, caretaker name and phone, and the bank or wallet account for payouts.
• Reviews and messages you write on the site.
• Technical: IP address, browser type, pages visited and error logs, kept for security and to fix problems.

3. How we use it

• To create your account and send you login codes by email.
• To take bookings, collect payments, pay hosts, process refunds and keep the records that tax and payment rules require.
• To show hosts who is coming and let guests contact the host once a booking is confirmed.
• To verify identities, detect fraud, and keep the platform safe.
• To send you booking confirmations, reminders and important notices about your stay. We do not send marketing messages unless you opt in, and you can opt out at any time.
• To improve the site using aggregate statistics that do not identify you.

4. Who we share it with

• Hosts and guests. After a booking is confirmed, the guest's name, phone number, guest count and note go to the host (and the caretaker, if the host named one); the host's name, phone number and the property address go to the guest. Before confirmation only first names and the approximate location are shown.
• Payment providers: JazzCash (Jazz / Mobilink Microfinance Bank), Easypaisa (Telenor Microfinance Bank), Safepay and the banks involved, which receive the data needed to process a payment or refund under their own privacy policies.
• Message delivery: our email service (Resend) receives your email address and the content of login codes and booking emails; if SMS or WhatsApp notifications are switched on, that gateway receives your mobile number and the message.
• Hosting: the site and database run on Railway, a cloud provider, in its Singapore region. Uploaded photos are stored there or with a compatible object-storage provider. This means your data is processed outside Pakistan, under contracts that require it to be kept secure.
• Maps: map tiles come from OpenStreetMap servers, which receive your IP address when a map loads.
• Authorities: we disclose data when a court, the police or a regulator lawfully requires it, for example under the Prevention of Electronic Crimes Act 2016, and we may do so to protect someone's safety.
• We do not sell personal data and do not share it with advertisers.

5. Your CNIC

Uploading your CNIC is optional; it earns a verified badge that some hosts require for Instant Book. The image is stored encrypted, viewed only by the person doing the check, and deleted once the check is complete; we keep only the result (verified or not) and the date. We never share the image with hosts. Hosts may still ask to see your physical CNIC at check-in, as the law on guest registers requires; that is between you and the host.

6. Cookies

We use a small number of first-party cookies: one to keep you signed in, one to remember your language, and session cookies for the booking flow. We do not use advertising or cross-site tracking cookies. Blocking cookies will stop you signing in.

7. How long we keep it

• Account details: while your account is open, then up to 90 days after closure unless we must keep them longer.
• Booking and payment records: 6 years, because tax and payment regulations require it.
• One-time login codes: 10 minutes. CNIC images: until the check is done. Error logs: 30 days.
• Reviews: as long as the listing exists, with your name reduced to a first name if you close your account.

8. Your choices

• See and correct your details from your account pages.
• Ask us for a copy of the personal data we hold about you, or to delete your account, by writing to help@ibnb.com.pk from the number or email on the account. We answer within 30 days. Records we must keep by law (section 7) are kept but no longer used for anything else.
• Opt out of any marketing message by replying STOP or writing to us.

9. Security

Connections are encrypted (HTTPS). Login codes are stored as one-way hashes, rate-limited and expire quickly. Payment details are handled by licensed payment providers, never by us. Access to the database is limited to the people running the platform. No system is perfectly secure; if a breach affects your data we will tell you and, where required, the authorities.

10. Children

The site is for adults. We do not knowingly create accounts for anyone under 18. Children can be included in a booking only as guests of an adult.

11. Changes

We will post any change to this policy here and update the date at the top. If a change materially affects how we use your data we will show a notice on the site before it takes effect. The Terms of service explain the rest of the relationship between you and ibnb.