Privacy Policy
Hostel Cloud (https://hostelcloud.app) is a technology platform operated by Staurax. This Privacy Policy outlines the operational data flows, identification documentation handling, and data stewardship rules applicable to students, residents, and hostel administrators across Pakistan.
1. Scope & Operational Context
Hostel Cloud serves two distinct user groups within the student accommodation sector in Pakistan:
- Students & Residents: Individuals searching for accommodation, submitting booking inquiries, managing room assignments, or providing resident onboarding details.
- Hostel Operators & Administrators: Property owners, managers, wardens, and administrative personnel managing hostel listings, room inventories, resident rosters, dues vouchers, and facility records.
Because Hostel Cloud provides cloud software that records, hosts, and organizes resident documentation on behalf of accommodation providers, data is collected both directly from individuals and indirectly through authorized hostel administrators.
2. Personal Information Processed by Category
Information is collected to deliver software features, maintain account security, manage accommodation rosters, and facilitate administrative compliance:
A. Account Credentials & Contact Records
Data Elements: Full name, verified email address, mobile telephone number, account password (cryptographically hashed), and role assignment (student, contributor, hostel_admin, warden, super_admin).
Purpose: Authentication, session management, password resets, SMS/email verification OTPs, and system notifications.
B. Resident Identity & Academic Documentation
Data Elements: Computerized National Identity Card (CNIC) or Form-B numbers, uploaded CNIC/Form-B scanned images or photographs, student identification cards, university or college affiliation, and guardian contact details.
Purpose: Resident identification, room allocation verification, and facility recordkeeping maintained by hostel management.
Origin of Data: May be directly submitted by the student through digital check-in or uploaded into the management roster by the hostel owner/warden during manual onboarding.
C. Occupancy, Room & Facility Records
Data Elements: Assigned hostel, room number, bed identifier, check-in and check-out timestamps, room transfer logs, gate-pass records, and complaint logs.
Purpose: Operating room inventories, calculating occupancy rates, maintaining property registers, and resolving facility maintenance requests.
D. Financial, Fee & Voucher Records
Data Elements: Monthly hostel fee records, dues amounts, security deposit records, payment voucher reference numbers, and uploaded bank/online payment slips.
Purpose: Generating fee invoices, tracking payment statuses, and maintaining accounting ledgers.
Payment Gateway Notice: Full credit/debit card numbers or sensitive banking PINs are never stored on Hostel Cloud servers.
E. Technical, Telemetry & Security Logs
Data Elements: IP addresses, browser agent headers, session identifiers, timestamps of authentication events, failed login counts, and security telemetry.
Purpose: Protecting accounts against brute-force attacks, detecting credential theft, troubleshooting server errors, and preventing automated scraping.
3. Regulatory Roles & Data Custodianship
Data privacy roles in lodging and SaaS platforms depend on operational control and legal purposes:
Hostel Operators as Record Custodians
Individual hostel operators decide what documentation (CNIC copies, student IDs, parent consent) to collect from residents under their tenancy terms and provincial lodging rules. The operator acts as the primary data custodian for their resident directory.
Hostel Cloud as Software & Hosting Provider
Hostel Cloud hosts the database, processes form submissions, and indexes resident records on the instructions of the operator. Hostel Cloud does not assume independent ownership of resident identity records uploaded by operators.
4. Disclosure of Personal Information
Hostel Cloud does not sell or rent personal information to commercial marketing brokers. Information is shared strictly under the following circumstances:
- With Assigned Hostel Management: Information submitted during room inquiries or online check-ins is made accessible to the designated administrators of the specific hostel.
- With Infrastructure Sub-processors: Third-party hosting, database, SMS gateway, and transactional email providers that process data strictly on our instructions under confidentiality obligations.
- Under Statutory Process: Formal production orders, judicial warrants, or written orders issued under applicable law (such as Section 94 CrPC or PECA 2016) by authorized investigating authorities.
- Business Restructuring: In the event of a merger, acquisition, or asset transfer involving Staurax, account records may transfer to a successor entity subject to this Privacy Policy.
5. Technical Security Safeguards
Hostel Cloud implements rigorous technical, operational, and architectural safeguards to protect personal data across its platform:
Notice: While we maintain robust technical controls in line with industry standards, no internet-connected platform or electronic storage system can guarantee absolute invulnerability. Users share responsibility for protecting their account login credentials.
6. Retention, Archival & Account Closure
Data is stored for operational and administrative purposes under defined schedules:
- User Account Information: Retained while the account remains active, plus a 90-day grace period upon requested closure before hard deletion.
- Resident CNIC & Identity Uploads: Stored during the resident's active tenure, and archived or removed upon checkout clearance by the hostel administrator.
- Financial & Fee Vouchers: Fee vouchers and transaction records are maintained for up to 6 years in accordance with tax and commercial recordkeeping practices in Pakistan.
- Automated Cleanup: Inactive guest sessions, bot traffic, system error logs, and visitor analytics are automatically pruned via automated maintenance routines (pruning between 2 to 90 days depending on log category).
7. User Rights & Access Requests
Registered users may request access, correction, or deactivation of their personal information:
- Profile Correction: Profile details can be updated via account dashboard settings.
- Resident Record Updates: Because hostel rosters are managed by individual property operators, requests to rectify resident room logs or remove physical records should be directed to the respective hostel administrator.
- Formal Privacy Inquiries: Contact our designated privacy desk at [email protected].
8. Statutory Framework & Regulatory Context (Pakistan)
This Privacy Policy is designed in accordance with the enacted statutory framework of Pakistan:
-
Prevention of Electronic Crimes Act, 2016 (PECA 2016 - Act XL of 2016):
- Section 16 (Unauthorized use of identity information): It is an offense to obtain, use, or transmit another person's identity information without authorization. Users are prohibited from uploading or distributing third-party CNICs unlawfully.
- Section 38 (Service provider liability): Outlines statutory conditions governing service provider liability, specifying that exemption from liability requires absence of actual knowledge, lack of willful involvement, and prompt action upon receiving notice. This does not grant automatic or unconditional immunity.
- Section 41 (Confidentiality of information): Enforces strict confidentiality requirements regarding subscriber information handled by service providers and their personnel.
- Punjab Information of Temporary Residents Act, 2015 (Punjab Act VIII of 2015): Applies strictly to accommodation situated within the province of Punjab. Under Sections 4 and 5, the primary legal duty to collect guest identity information and submit it to the local police station rests upon the hostel owner and manager.
- Khyber Pakhtunkhwa Restriction of Rented Buildings (Security) Act, 2014 (KP Act No. I of 2014): Applies strictly to accommodation situated within Khyber Pakhtunkhwa. Section 5 mandates that owners and managers of student hostels and private hostels maintain complete records and produce them when demanded by authorized officers.
- Administrative Reporting Clarification: Hostel Cloud provides digital record management tools that hostel operators may access or print to assist with their independent statutory record-keeping and local police reporting obligations. Hostel Cloud does not operate an automated police reporting integration or governmental database feed.
- Legislative Status Notice: The Personal Data Protection Bill, 2023 remains draft/proposed legislation and is not cited as an enacted statute.
9. Policy Modifications
Staurax may update this Privacy Policy to reflect technical revisions or legislative developments. Material amendments will be notified via in-platform notices or registered email alerts.