Privacy Policy

1. Who this policy covers

This policy explains how Skychateau handles personal data across its website, mobile app, support channels and related services. It applies to guests, registered students, parents and guardians, landlords, event hosts, place owners, contributors and anyone who contacts support.

Once you leave Skychateau for WhatsApp, maps or another provider's website, that service's privacy terms apply instead.

2. Information we collect

Depending on how you use Skychateau, we may process:

• Account details such as your name, username, email address, sign-in provider, role and account timestamps.
• Profile information including a photograph, biography, university, language, general location and preferences.
• Social activity such as connection requests, accepted connections, blocks, reports, saved items and notification status.
• Catch Ups, captions, listing photographs and other content you choose to publish.
• Property, place and event information, including prices, amenities, dates, locations and provider details.
• Support messages, complaints, report evidence and moderation decisions.
• Technical information such as app version, device details, authentication events, request times, error logs and security signals.
• Limited guardian and consent records where a child account requires adult involvement.

Skychateau does not currently process rent, accommodation deposits, payment-card details or bank credentials. Never send passwords, PINs, one-time codes or unnecessary identity documents through a profile, Catch Up or support message.

3. Where information comes from

Most information comes directly from you when you register, edit a profile, publish content, save a listing, connect with someone or contact support. We may also receive information from a guardian, another user making a report, an authorised listing provider, platform administrators, security logs or public business sources used for discovery listings.

4. How we use information

We use personal data to provide accounts and discovery features, display content you choose to publish, open contact channels you select, respond to support requests, prevent fraud, investigate reports, moderate unsafe content, protect children, diagnose technical problems and meet legal duties. Essential account, safety and policy notices may be sent when needed. Optional marketing should only be sent where the required choice or consent has been obtained.

5. Our legal grounds

The legal basis depends on the activity. It may be consent, performance of the user agreement, compliance with a legal duty, a legitimate and proportionate operational or safety interest, or protection of someone's vital interests. Where consent is used, it may be withdrawn for future processing. Some limited records may still be kept where another lawful reason applies.

6. Children's privacy

Skychateau is designed for a mixed audience. Where the law requires it, a child account must have verifiable consent from a parent, guardian or person with parental responsibility before personal data or optional social features are enabled.

• Only the minimum age and guardian details needed to apply appropriate safeguards should be collected.
• Precise location, public phone numbers and unrestricted messaging should remain unavailable to child accounts.
• A verified adult should control whether social features and personal-information exchange are available.
• Children's data must not be used for personalised advertising, data brokerage or unrelated profiling.
• Reports involving exploitation, impersonation, unsafe contact or exposure of a child's information should receive priority.

If data has been collected without consent that was required, the account may be restricted while Skychateau verifies the situation and deletes or lawfully regularises the information.

7. What other people can see

Usernames, profile photographs, biographies, listings and published Catch Ups may be visible to other users. Check the intended audience before publishing. Do not post home addresses, school timetables, real-time locations, financial information, identity documents or information about another person without permission.

Catch Ups are intended to leave ordinary public display after about 24 hours. Copies may remain temporarily in protected backups, reports, caches or screenshots made by other people.

8. When information is shared

Skychateau does not sell personal data. Limited information may be shared with another user when you publish it or choose to connect; with a guardian managing a child account; with service providers that run the platform; with professional advisers under confidentiality; or with authorities where disclosure is legally required or necessary to address a serious safety concern.

9. Technology providers

The current architecture uses Google Firebase for authentication, profiles and related app services; Render and Neon for the Strapi service and database; Cloudinary for uploaded media; and Expo/EAS for app building, updates or diagnostics where enabled. WhatsApp is an independent service used only after you choose to open it.

10. International processing

Some providers operate outside Zambia, so information may be stored in or accessed from another country. Skychateau should assess each provider, limit transfers to what is necessary and use the contractual, security, consent or regulatory safeguards required by applicable law.

11. How long information is kept

• Account and profile data: while the account is active, then deleted or de-identified within the approved deletion period.
• Catch Ups: removed from ordinary display after about 24 hours; residual secured backups or logs may take up to 90 days to expire unless preservation is required.
• Security logs: normally up to 90 days, with longer restricted retention for an active investigation or legal requirement.
• Support and complaint records: normally up to 24 months after closure, or longer for a dispute, child-safety issue or legal duty.
• Listings, guardian consent and enforcement records: retained only for the approved operational, safety and legal period.

Deleting information from active systems may not remove it immediately from encrypted backups or a third party's independent systems.

12. Account deletion and your rights

After appropriate identity checks, a user—or an authorised guardian acting for a child—may ask for access, correction, deletion, restriction, objection, withdrawal of consent or portable data where the law provides that right. Deleting a Skychateau account does not delete a separate Google or WhatsApp account.

Use the Contact page for a privacy or deletion request and include enough information for the team to identify the account safely. Skychateau will not disclose another person's data while handling a request.

13. Security and incidents

Skychateau uses measures such as authenticated administration, role-based database access, encrypted connections, managed hosting, restricted secrets, logging and incident response. No online system is completely secure. Protect your device and account, keep verification codes private and report suspected compromise promptly.

14. Complaints and policy changes

Privacy concerns can be raised through the Contact page. Users may also contact Zambia's Data Protection Commission using the current procedure published at dataprotection.gov.zm. This policy may change when the platform, providers or law changes. A new effective date will be shown, and material changes will be communicated where required.