1. Scope & Data Controller

This Privacy Policy ("Policy") describes how Roominac Interactive Technologies (SMC-Private) Limited("Roominac", "we", "us", or "our"), acting as the Data Controller, collects, processes, stores, and protects your information when you interact with:

• Our public marketing website (roominac.com and subdomains).
• Our authenticated web application portal (app.roominac.com).
• Our native mobile applications for iOS (available on Apple App Store) and Android (available on Google Play Store).
• Our direct in-app messaging, reservation management, and customer support channels.

By using Roominac, you acknowledge that you have read, understood, and consented to the data collection and processing methodologies set forth herein.

2. Categories of Data Collected

To maintain an ecosystem of verified stays and accountable hosts, we collect distinct classes of information:

2.1 Information You Provide Directly

• Account Profile: Full legal name, verified email address, mobile phone number, profile portrait, and password hash.
• Identity & KYC Verification: Front and back scans of your Computerized National Identity Card (CNIC), NICOP, or Foreign Passport, along with your national identification number, father's/spouse's name, and date of birth as recorded with NADRA.
• Facial Liveness Data: A real-time captured video selfie or biometric frame used solely for 1:1 matching against your government ID photo.
• Host Property Listings: Property title, detailed physical address, precise GPS coordinates, photographic galleries, high-definition video reels, listed amenities, house rules, pricing, and bank account/IBAN details for payout disbursement.
• Direct Communications: Chat messages, voice notes, photos, and file attachments exchanged between hosts, guests, and Roominac Concierge via our real-time messaging system.

2.2 Information Collected Automatically

• Device & Telemetry Data: IP address, device hardware model, operating system version (iOS/Android), browser user agent, mobile device language, and unique push notification tokens (Expo Push Tokens).
• Log & Usage Diagnostics: Timestamped access logs, searched geographical areas, applied filter criteria, viewed property detail pages, and application crash reports.
• Precise Geolocation: Real-time GPS location collected strictly with your explicit operating system permission when using location-based search or checking in to a verified stay.

3. Lawful Grounds & Purposes of Processing

Under applicable data protection frameworks, including the Prevention of Electronic Crimes Act, 2016 (PECA), we process personal data under four distinct lawful bases:

4. NADRA KYC & Biometric Verification Architecture

Unlike unverified rental boards, Roominac takes physical safety seriously. All guests and hosts undergo mandatory identity verification prior to executing transactions:

• Storage Isolation: Identity document scans are segregated in private, encrypted vaults protected by strict role-based access control policies. Only credentialed compliance officers can access these records during active audits.
• Zero Public Exposure: Your CNIC number, date of birth, and document scans are never displayed to hosts, guests, or public search crawlers. Confirmed hosts only receive your verified full name, verified phone number, and verified profile badge.

5. Precise Geolocation Services & Permissions

Roominac provides location-aware discovery and security features through device GPS integrations:

• Nearby Discovery: With your permission, the mobile app uses your foreground coordinates to sort properties by physical driving distance and display neighborhood amenities.
• 24-Hour Check-in Verification: In the event of a check-in dispute (e.g., guest claiming the host was inaccessible or absent), the app may record a one-time coordinate check to confirm the guest's physical presence within the vicinity of the booked accommodation.
• Control & Revocation: You can grant or revoke location permissions at any time via your device settings (iOS Settings > Roominac > Location or Android Settings > Apps > Roominac > Permissions). Disabling location will not prevent booking or browsing.

6. Payment Processing Security & Merchant of Record

Roominac acts as the Merchant of Record (MoR) for all financial transactions, partnering with regulated banking channels and SBP-authorized payment clearing rails.

Zero Payment Vaulting on Roominac Servers: When you input card numbers, CVVs, or bank credentials, that data is transmitted directly over an encrypted TLS 1.3 tunnel to PCI-DSS Level 1 compliant gateway servers. Roominac only receives a secure cryptographic payment token, the card brand (e.g., Visa, PayPak, Mastercard), and the last 4 digits for billing receipt generation.

7. Data Security & Encryption Safeguards

We employ enterprise-grade defense-in-depth protocols to protect user records across our platform:

• Dedicated Enterprise Infrastructure: User accounts, listings, and messages are hosted in dedicated, isolated cloud server environments with continuous encrypted transport.
• Strict Access Isolation: Database records are shielded by strict row-level access control policies, ensuring users can only access data belonging to their verified identity.
• Encrypted Media Vaults: Public property imagery is served via high-speed distributed delivery networks, while confidential verification documents are vaulted in restricted, zero-public-access private storage.
• Encryption Standards: All data in transit is encrypted using TLS 1.3. All database records and storage repositories employ AES-256 hardware encryption at rest.

8. Authorized Subprocessors & Service Partners

To deliver a seamless cross-platform experience, we partner with specialized, vetted infrastructure providers:

9. Data Retention & Archival Schedule

We retain personal information only for the duration necessary to satisfy the purposes outlined in this Policy, unless a longer retention period is mandated by law:

10. Your Privacy Rights & One-Tap Account Deletion

You retain complete sovereignty over your personal data. In full compliance with Apple App Store Review Guideline 5.1.1(v) and Google Play Store Data Safety regulations, Roominac provides frictionless self-service data management:

10.1 Additional User Rights

• Right of Access & Portability: You may request a machine-readable JSON copy of your profile, listing data, and booking history.
• Right of Rectification: You may modify your email, phone number, and biographical details directly in your account settings.
• Marketing Opt-Out: You may unsubscribe from promotional email announcements at any time via the one-click unsubscribe link in any newsletter.

11. Cookies, Telemetry & Local Storage

We employ minimal, privacy-preserving storage mechanisms:

• Essential Authentication Cookies: Cryptographic session tokens that maintain your logged-in state across roominac.com and app.roominac.com.
• Mobile Secure Storage: On iOS and Android, authentication credentials and tokens are stored in hardware-backed secure enclaves using expo-secure-store (Keychain on iOS and Keystore on Android).
• Zero Cross-Site Tracking: We do not deploy third-party advertising tracking cookies (such as Meta Pixel or Google AdSense remarketing beacons) on our authenticated platforms.

12. Minors & Children's Privacy

Roominac is strictly restricted to individuals aged 18 years or older. We do not knowingly collect personal or biometric information from minors under the age of 18. If we discover that an account has been created by a minor, we will immediately terminate the account and permanently delete all associated records from our servers. Parents or guardians who believe a minor has registered an unauthorized profile may contact us at privacy@roominac.com.