Privacy policy

Last updated 2026-10-15 · admin@sasleeps.com

Who is responsible

SASleeps, a South African private company (Pty) Ltd, is responsible for the personal information it uses to operate this website and handle accommodation requests. Write to admin@sasleeps.com for privacy questions or to exercise your rights. Our business contact page contains the published business contact details.

This notice covers website visitors, customer accounts, accommodation enquiries, guests, support conversations and property contacts who submit information to SASleeps. A feature described here only collects information when it is available and used; creating an account does not start a booking or payment.

Saved stays

If you choose to save or compare properties, your browser keeps their public listing identifiers locally. These selections expire 90 days after your last change and are cleared when you next visit. These choices are not linked to your customer account. When you open a saved list or comparison, the selected identifiers are sent to SASleeps to retrieve current published details. See Cookies and preferences for clearing these choices.

Information we use

Enquiries collect your name, email, required phone number, dates, room and guest counts, and any message you provide. A phone number is required when creating or updating account contact details so we can contact you about your stay. Accounts hold your contact details, password hash, verification status, policy acknowledgements and account security records. If you choose Google sign-in, Google provides your account identifier, verified email and basic name. We do not receive your Google password or request Gmail, Drive, contacts or calendar access.

Quotes, bookings and payments create records of the agreed stay, amounts, references, correspondence and payment status. Card entry is handled by the checkout provider when online checkout is enabled. Technical security processing may include IP addresses, browser information, sessions and failed access attempts. Do not send sensitive documents or card details in an enquiry.

Why information is needed

We use it to respond, check availability, administer your stay, authenticate your account, prevent misuse and handle support, financial records and disputes. Depending on the activity, processing is necessary to take steps you request before an agreement, perform an agreement, meet a legal obligation, or protect legitimate service and security interests. Where consent is the basis, you can withdraw it; that does not undo earlier lawful processing.

Required fields are necessary for the relevant service; without them we may be unable to complete registration or respond to a request. You can browse without an account. A contact phone number is required for email registration and profile completion; Google does not supply it, so a new Google customer is asked to add one. Additional message fields are optional. A request or account does not subscribe you to marketing.

Where information is stored

The live website uses SASleeps’ production database and private file storage on Hostinger. Customer profiles, requests, booking records, support messages, property submissions and payment references are held there. Public accommodation pages show only listing information and photos approved for publication; guest profiles, private messages and booking references are not public listings.

Passwords are stored as hashes rather than readable passwords. Email access codes are hashed, and temporary delivery payloads and certain private payment-link fields are encrypted. These protections do not mean every database field or backup is encrypted. Hosting and authorised operational access are needed to run and support the service. Protected backups may contain copies of records.

Service providers and Google sign-in

Hostinger provides website hosting. Account emails use the configured Google Workspace mail service and the recipient’s email provider. When you choose Google sign-in, Google authenticates you and SASleeps stores your Google account identifier, verified email and name alongside your customer record. We do not store your Google password or retain Google access, refresh or identity tokens after completing sign-in. Google does not become the storage provider for your SASleeps bookings.

When online payments are available, the configured checkout provider, Paystack, handles card entry. SASleeps keeps the amount, currency, payment reference and verification or refund status needed to administer the stay; it does not store full card numbers or card security codes. Each provider’s own privacy information applies to its service, including Google, Hostinger and Paystack.

Who receives it

Authorised SASleeps staff use the private operations system. Relevant accommodation suppliers receive information needed to check and provide your stay. Hosting, mail and payment providers process information needed for their services. Guest details are not public listings and we do not sell account details. Suppliers and providers may have their own privacy responsibilities. Records may be disclosed where legally required or necessary to protect lawful rights.

Homepage image and accommodation search

The coastal background is served by SASleeps. The homepage does not load Google Maps or Google place suggestions, and search text is sent to SASleeps to search its published listings. We do not request your device location. A previously saved map preference does not enable a map on the homepage.

Property location maps

A property page with an approved public map shows that location on Google Maps automatically. Your browser may delay loading the embedded map until you approach its section. When it loads, Google receives the public map location, your IP address, browser information and this website’s origin; it may use its own cookies and process information outside South Africa under its privacy policy. We do not send your account details, booking references, travel dates or guest counts to the map, and do not request your device location.

Public property maps do not use a saved SASleeps map preference. Leaving the page stops displaying that map, but does not undo information already received by Google or clear its cookies. Browser privacy settings or content blockers may prevent an embedded map from loading; the external Google Maps and directions links remain available. Opening those links takes you to Google’s service. Map results do not verify an address or arrival instructions; confirm those details with the property before travelling.

Optional supplier address lookup

When available in a private property form, “Find address on map” loads Google Maps and sends the typed property address for an address lookup. Google receives the map location, IP address, browser information and this website’s origin and may use its own cookies. We do not send supplier contact details, private invitation codes or form references to the map. The map is not loaded before that choice, and we do not request device location or send each typed character to Google.

You can choose an address match, drop a pin, or enter coordinates yourself. The selected Google place identifier or your chosen coordinates remain in the private submission for staff review; they are not automatically published. Changing the typed address clears its old pin. You can use the form without loading the map. Leaving the page stops that page’s map, but does not undo earlier requests or clear Google’s cookies.

Cookies and account sign-in

Essential cookies protect forms and private sessions. SASleeps does not install advertising or analytics scripts. Google sign-in contacts Google only when you choose it on the account page. Cookie details and controls.

Property submissions and support

Property contacts may provide their name, email, phone number, accommodation details and photos through a private invitation. These are stored for staff review; submitting a form does not automatically publish it. Support messages, privacy requests, staff replies and relevant review history are stored with the associated account or request. Avoid sending unnecessary health information, identity documents or financial credentials in free-text fields.

How long information is kept

Customer records remain available while an account is active. Closure ends sign-in and queues a review; it is not an automatic deletion of account, support, booking or financial history. We assess deletion or de-identification against the service purpose, legal and accounting obligations, unresolved complaints and disputes. There is no promise that all records disappear after a fixed number of days. Contact us for the retention position for a particular record.

• Email verification and password-reset links expire after 30 minutes. Temporary delivery secrets are removed after submission, uncertainty, cancellation, use or expiry processing. Expired token records are pruned after seven days when scheduled maintenance runs.
• Customer sign-in ends after two hours of inactivity or eight hours in total, and password changes or account closure revoke existing access. Expired server session files may remain until routine cleanup.
• Saved stays and comparisons remain in your browser for up to 90 days after your last change, as explained above.
• Security logs and backups may retain records separately until their operational retention or backup rotation ends. We do not treat a closed account as permission to erase evidence needed for an existing stay, legal obligation or dispute.

Security and international services

We use access controls, HTTPS, password hashing and protected sessions to reduce unauthorised access. No system guarantees absolute security. Hosting, Google and payment services can involve processing outside South Africa. The applicable provider and hosting arrangements determine the location; we do not promise South African-only storage. Cross-border processing must use an applicable POPIA basis and appropriate safeguards. Security incidents are assessed and notified as required by law.

Your choices and requests

You may ask for access, correction, deletion or object to processing, subject to applicable limits. We verify identity proportionately. Account holders can edit basic details, export records available in their dashboard and submit a privacy request. Email us for broader records or if you cannot sign in. You may complain to South Africa’s Information Regulator; its website provides current complaint channels and POPIA forms.

Children and changes

Accounts and booking arrangements are for adults. Initial enquiries ask for child counts, not children’s names or identity documents. We explain further supplier requirements before collection. Updated notices are published here; significant changes affecting existing information will be explained as appropriate.

Enquiry notice version: privacy-2026-10-15.