Privacy Policy

Effective date: 22 October 2026
Last updated: 22 October 2026

This Privacy Policy explains how Apptawn (the website at https://apptawn.com and the Apptawn mobile apps, together the “Services“) collects, uses, shares, stores and protects your personal data, and the choices and rights you have. Apptawn is a short-term rental marketplace for Ethiopia: guests search for and book stays, and hosts list properties for rent.

By “we“, “us” or “our” we mean the operator of Apptawn named in Section 1. By “you” we mean anyone who uses the Services, whether as a guest, a host, or a visitor who has not created an account.

1. Who we are

The Services are operated by:

• Operator: Apptawn (company registration in progress)
• Registered address and TIN: not available yet, because the company registration is still in progress. We will publish them here as soon as it is completed.
• Privacy requests: contact@apptawn.com (subject “Privacy request”)
• General contact email: contact@apptawn.com
• Phone: +251 91 197 6657 — every day, 8:00–18:00 East Africa Time (EAT)

We are the data controller for the personal data described in this policy. Online payment is not open yet. Once it is launched, our payment service providers will also act as independent controllers of the data you give directly to them (see Section 6).

2. Scope

This policy applies to personal data processed through the apptawn.com website, the Apptawn mobile apps (Android and iOS, once available), and our customer support channels. It does not cover third-party apps, payment pages or websites that we link to (for example, the payment pages or apps of our payment service providers); those are governed by their own privacy policies.

3. Personal data we collect

We only collect data that is needed to run the marketplace and keep it safe. “Required” means we cannot provide that feature without it; “optional” means you choose whether to provide it.

3.1 Data you give us

3.2 Payment and transaction data

Online payment is not yet available on Apptawn. Once it is launched, payments will be processed by our payment service providers, using the payment methods commonly used locally, and you will enter your card, bank or mobile-wallet details on the payment provider’s own page or app.

• We do not collect or store full card numbers, CVV codes, bank login credentials, mobile-wallet PINs or other wallet credentials.
• We receive from the payment provider and store: a transaction reference/ID, amount, currency (ETB), payment method type (e.g. mobile money, card, bank), the last digits of a card or a masked phone number where the provider supplies them, payment status (successful, failed, refunded), date and time, and the name, phone number and email you used for the payment.
• For hosts, we store payout records (amount, date, destination account type and masked account number).

3.3 Location data

• Approximate location: We may use your device’s approximate location, or your IP address, to show stays near you and set default search areas.
• Precise location: Only if you grant the location permission on your device, we use your precise (GPS) location to show stays near you on the map and, for hosts, to help place the listing pin accurately. We only access location while you are using the app; we do not collect location in the background.
• Listing address: A host’s exact property address is shown to a guest only after a booking is confirmed. Before booking, other users see an approximate area only.

You can refuse or withdraw location permission at any time in your device settings; you can still search by typing a place name.

3.4 Data collected automatically

• Device and app information: device model, operating system version, app version, language settings, mobile network/carrier, and app installation identifiers. We do not collect persistent hardware identifiers such as IMEI, IMSI or SIM serial numbers.
• Usage data: pages and screens viewed, searches, listings viewed, features used, clicks, time and date of use, and referring website.
• Crash and diagnostics data: crash logs, error reports and performance data (Firebase Crashlytics, provided by Google).
• Log and network data: IP address, browser type, and server logs.
• Cookies (website): We use only strictly necessary cookies to keep you signed in and secure, and Google reCAPTCHA to protect our forms against spam. We do not use analytics or advertising cookies. You can control cookies in your browser settings.
• Push notification token: If you allow notifications, a push token so we can send booking and message alerts.

3.5 Data from others

• Other users: A host may provide information about a guest (e.g. a review), and a guest may provide information about a host.
• Payment providers (once online payment is launched): they will send us payment confirmations and status updates.
• Sign-in providers: If you sign in with Google or Apple, they share the information listed above with us.
• Identity verification: done by hand by the Apptawn team. We do not use an outside verification provider.

3.6 Device permissions we request (mobile apps)

We explain why we need each permission before asking, and you can change permissions at any time in your device settings.

4. How we use your personal data and our legal bases

Under Ethiopia’s Personal Data Protection Proclamation No. 1321/2024, we must have a lawful basis for each use of your data. The table below sets out our purposes and the bases we rely on.

Automated decisions: We may use automated checks (for example, flagging unusually high-risk payments or suspicious accounts) to prevent fraud. If an automated check leads to a decision that significantly affects you, such as blocking your account, you may ask for a human review (see Section 10).

No sale of data, no third-party advertising: We do not sell your personal data, and we do not use it for third-party targeted advertising.

Providing account, booking and payment data is necessary to use the Services; if you do not provide it, we cannot create your account or process your booking. Providing optional data (profile photo, reviews, precise location, marketing consent) is voluntary.

5. Sensitive personal data

Ethiopian law treats some data as sensitive personal data, including biometric data (such as facial images used for identification) and communications data. We do not collect biometric data: we do not take or ask for photos of your face. Where we process sensitive data (for example, the content of messages you send on Apptawn), we do so only:

• with your explicit, purpose-specific consent, which we ask for before you start ID verification or use messaging; or
• where another condition provided by law applies (for example, to protect the life or health of a person, or to establish, exercise or defend legal claims).

You may withdraw your consent at any time (Section 10). Withdrawing consent for messaging means you will not be able to send in-app messages; withdrawing consent for ID verification may mean you cannot list or book where verification is required.

We do not knowingly collect data on racial or ethnic origin, health, religious beliefs or political opinions. Please do not include such information in listings, reviews or messages.

6. How we share personal data

We share personal data only as described below and only to the extent needed.

6.1 With other users (to make bookings work)

• Public profile and listings: Your first name, profile photo, reviews, the date you joined and (for hosts) listing details and the approximate listing area are visible to other users and website visitors.
• When a booking is confirmed: The guest receives the host’s name, phone number, email address, exact property address and check-in instructions; the host receives the guest’s name, profile photo, phone number, email address, number of guests and booking details.
• Messages are visible to the people in the conversation.

6.2 With payment providers

• Payment service providers licensed by the National Bank of Ethiopia, once online payment is launched, to process card, bank and mobile-money payments, refunds and payouts. We will share the amount, booking reference and your name, email and/or phone number. The list of our providers will be available on request at contact@apptawn.com.

Once online payment is launched, these providers will process the payment details you give them under their own privacy policies and the laws that apply to them, including National Bank of Ethiopia rules.

6.3 With service providers

We use trusted providers that process data on our behalf and under our instructions, under contracts that require confidentiality and security:

• Google (including Firebase) – Google sign-in, Firebase Cloud Messaging (push notifications), Firebase Crashlytics (crash reports) and reCAPTCHA (spam protection on the website). Google privacy policy: https://policies.google.com/privacy
• Apple – Sign in with Apple (Apple). Apple privacy policy: https://www.apple.com/legal/privacy/
• Mapbox – map display on the website. Mapbox privacy policy: https://www.mapbox.com/legal/privacy
• Website hosting, content delivery and security: reputable third-party cloud hosting and security providers that host the website, its database and files, and protect them against attacks. Their servers may be located in different locations (see Section 7). You can ask us for their names by writing to contact@apptawn.com.
• Email: the email service of our hosting provider. We do not use an SMS provider at this stage.

6.4 With authorities and for legal reasons

We may disclose personal data to courts, police, tax authorities, the Ethiopian Communications Authority, the National Bank of Ethiopia or other public bodies when we are legally required to (for example, by a court order or a lawful request), or when disclosure is necessary to protect the life, safety or property of any person, to prevent fraud, or to establish, exercise or defend legal claims. Where permitted, we will tell you about such a request.

6.5 Business transfers

If Apptawn is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred to the new owner, who will be required to respect this Privacy Policy. We will notify you before your data becomes subject to a different privacy policy.

6.6 With your consent

We will share your data for any other purpose only if you ask us to or give your consent.

7. Storage, hosting and cross-border processing

Where your data is stored. The Apptawn website, its database and uploaded files are hosted by reputable third-party cloud hosting providers. Traffic to the website also passes through a content delivery and security provider that protects the Services against attacks and helps them load quickly. Once online payment is launched, payments will be handled by our payment service providers on their own systems (see Section 6). These providers may store or process personal data on servers in different locations, which can include countries other than the one where you live.

How we protect it. We choose providers that commit to protecting personal data and to acting only on our instructions, and we apply technical and organisational safeguards, including encryption of data in transit (HTTPS/TLS), access controls limited to authorised people, and regular backups. Section 8 describes these measures in more detail.

Cross-border processing. When personal data is processed outside the country where it was collected, we do so only where applicable law permits it, for example where it is necessary to provide the Services you have asked for, or with your explicit consent after you have been informed of the possible risks. These risks may include that the other country does not offer the same level of protection, and that authorities there may be able to request access to the data. Where the law requires prior approval from the competent authority (for example, for sensitive personal data), we will seek that approval.

Your right to know. You can ask us at any time which providers we use, what data they process and where their servers are located, by writing to contact@apptawn.com. We will answer within 30 days.

We are committed to complying with applicable data protection law and will update this section if our hosting arrangements change.

8. How we protect your data

We use technical and organisational measures appropriate to the risk, including:

• encryption of data in transit using HTTPS/TLS between the apps, the website and our servers;
• passwords stored only as salted hashes;
• access controls, so that only authorised staff who need the data for their job can access it, under confidentiality obligations;
• ID-verification documents stored separately with restricted access and never shown publicly; we never publicly display financial information or government ID numbers;
• no storage of full card numbers, CVV codes or wallet PINs (payments are handled on our payment service providers’ pages);
• security monitoring, logging, regular backups and periodic testing of our security measures;
• contracts with service providers that require them to protect personal data.

No system is perfectly secure. If a personal data breach occurs, we will notify the Ethiopian Communications Authority within 72 hours of becoming aware of it, and we will inform affected users within 72 hours, as required by law, where the breach is likely to result in a high risk to them.

You help protect your account by using a strong password, keeping your mobile-money PIN private, and never paying or communicating outside Apptawn.

9. How long we keep your data

We keep personal data only as long as needed for the purposes in this policy, or as long as the law requires.

Backups are overwritten on a rolling basis within 35 days. When a retention period ends, we delete or irreversibly anonymise the data.

10. Your rights and choices

Under Ethiopia’s Personal Data Protection Proclamation No. 1321/2024, you have the right to:

• Be informed about how we process your data (this policy).
• Access your personal data and receive a copy, free of charge.
• Correct inaccurate or incomplete data. You can edit most account and listing data directly in your account.
• Erase your data, including by deleting your account.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Restrict processing in certain cases, for example while we check the accuracy of your data.
• Not be subject to decisions based solely on automated processing that significantly affect you, and ask for human review.
• Data portability: receive data you provided in a structured, commonly used, machine-readable format, and ask us to send it to another controller where technically possible.
• Withdraw consent at any time, without affecting processing that took place before withdrawal (for example, turn off location or notification permissions in your device settings, or unsubscribe from marketing using the link in our emails).
• Lodge a complaint with the Ethiopian Communications Authority (ECA), the data protection supervisory authority: https://eca.et

How to exercise your rights: Email contact@apptawn.com with the subject “Privacy request”. We may need to verify your identity before acting on a request. We will respond free of charge and without undue delay, and in any event within 30 days. Some requests may be limited where the law allows (for example, where data must be kept for legal reasons or disclosure would affect other people’s rights).

10.1 Deleting your account

You can delete your Apptawn account and associated data at any time. See our Delete your account page for step-by-step instructions, or email contact@apptawn.com from the address linked to your account with the subject “Account deletion request”.

• Your account is permanently deleted, not just deactivated. Your profile, listings, photos, saved searches, push tokens and preferences are deleted within 30 days.
• If you have an upcoming confirmed booking or an unpaid balance or payout, we will ask you to cancel or settle it first so that other users are not harmed.
• We keep only the limited data listed in Section 9 that we must retain for legal, tax, fraud-prevention or dispute purposes, and only for those purposes.

You can also ask us to delete some of your data (for example, photos or messages) without deleting your account by emailing contact@apptawn.com.

11. Children

Apptawn is not intended for anyone under 18 years of age. You must be at least 18 to create an account, book a stay or list a property. We do not knowingly collect personal data from children under 18. If we learn that we have collected data from a person under 18, we will delete it and close the account. If you believe a child has provided us with personal data, please contact contact@apptawn.com.

12. Third-party links and services

The Services may contain links to, or open, third-party services such as our payment service providers’ payment pages (once online payment is launched), Mapbox maps, Google sign-in or Sign in with Apple. Their privacy practices are governed by their own policies, and we encourage you to read them.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new “Last updated” date and, where the changes are significant, we will notify you on the website, in the app or by email at least 15 days before the changes take effect and, where required by law, ask for your consent again.

14. Contact us

If you have questions, requests or complaints about this Privacy Policy or our handling of your personal data, please contact:

Apptawn (company registration in progress)
Email: contact@apptawn.com
Phone: +251 91 197 6657
Support hours: every day, 8:00–18:00 East Africa Time (EAT)

We aim to reply to all enquiries within one (1) business day and to resolve privacy requests within 30 days. If you are not satisfied with our response, you may complain to the Ethiopian Communications Authority (https://eca.et).