Privacy Policy
1. Who we are
AALABU LIMITED (company number 16660516), registered office Office 13953, 182–184 High Street North, East Ham, London, United Kingdom E6 2JA, is the data controller for the personal data described in this policy.
2. What we collect
When you make a booking, we collect: your name, email address and phone number; your stay dates and guest composition (including children's ages, where relevant to pricing); whether you are travelling for work and your trip type, if provided; any special requests you choose to give us; your transfer selection, where applicable; messages you send us about your booking; and any review you choose to submit. aAlabu does not require you to create a customer account.
3. Payment data
Card details are entered directly into our payment provider's own secure interface and are not stored on aAlabu's systems. We do not store your full card number. We keep a payment reference from our payment provider so we can match your payment to your booking.
4. Booking recovery data
Because aAlabu does not require an account, we let you access a booking using your booking reference together with the email address you booked with, or a recovery link we send to that email. Your browser also stores a small, device-local recovery token so your booking stays accessible on that device.
5. Technical data
We collect standard technical and session information needed to operate the site securely. See our Cookie Policy for details of the specific technologies involved.
6. Special requests and sensitive information
The special-requests field on our booking form is free text intended for ordinary booking preferences (for example, a room location preference). We do not ask you for health, religious, or other sensitive information. If you voluntarily include information of that kind in a special request (for example, an accessibility need), we process it only to try to fulfil that specific request, and we ask that you share only what is necessary for us to act on it.
7. Why we use your data
We use your booking and stay details, and any special request you give us, because it is necessary to perform your booking (a contract with you). We use your payment reference because it is necessary to perform your booking and to meet our own accounting obligations. We do not use your data for marketing, and we do not currently offer a marketing opt-in.
8. Who we share it with
- The accommodation provider you book with, to the extent needed to fulfil your booking (for example, your name, stay dates, and any relevant request or transfer selection).
- Our payment provider, to process your payment.
- Our transactional email provider, to send booking confirmations, recovery links, and service messages about your booking.
- Our hosting and infrastructure providers, who store and run the platform on our behalf.
When you explicitly request a Google rating, our server sends the property’s Google Place identifier to Google to retrieve its current public rating and review count. This request does not send your booking or contact details. We do not retain Google ratings, review counts or review text in persistent storage for this feature. Opening a page does not automatically retrieve or refresh Google ratings.
If you follow a Google Maps or reviews link, you visit Google directly and Google may receive information from your browser. See the Google Privacy Policy.
9. International transfers
Where a service provider processes data outside the UK, we rely on the safeguards recognised under UK data protection law for that kind of transfer.
10. How long we keep it
We keep personal data only for as long as necessary for the purposes described in this policy, including to fulfil your booking, to meet legal, accounting, and tax record-keeping obligations, to handle disputes or fraud, and for reasonable operational purposes such as security logs. We are currently finalising the exact retention periods for each category of data as part of our launch preparation; this policy will be updated once those periods are confirmed.
Deleting your account. You can delete your aAlabu account yourself from your account page or in the app, or ask us to (see how account deletion works). When an account is deleted we remove your sign-in details, including any linked Google or Apple sign-in, and replace the name and email on the account so it can no longer be used. We keep booking records and the information attached to them: the details given when booking (such as name, email, phone number and special requests), payment and refund records, and messages sent about a booking. If you reviewed a stay, your name is removed from the review but the review stays. If the account used Sign in with Apple we show you how to remove aAlabu from your Apple Account. Deleting an account does not cancel a booking or refund a payment. We keep only a minimal record that the account was deleted, which contains no name or email. We do not yet apply a fixed period after which booking details are removed or anonymised; that is part of the retention periods we are still finalising.
11. Your rights
Under UK data protection law you have the right to access, correct, delete, restrict, or object to our use of your personal data, and the right to receive certain data in a portable format. Contact aalabu@aalabu.com to exercise these rights.
12. Complaints
If you believe we have mishandled your personal data, you can complain to the Information Commissioner's Office (ico.org.uk), the UK's data protection regulator.
13. Changes to this policy
We will update the version and effective date shown above if this policy changes materially.