Privacy policy.

• Anonymous usage events: screens you open, searches you run, places you view, and actions like Call or Get directions. These are tied to a random device identifier, not your identity, and you can turn them off anytime in Profile.
• Your location, only while using the app: used to sort places by distance and show nearby results. Coordinates are sent with place queries and are not stored as a location history.
• Your email address, only if you create an account: used to sign you in and sync the places you have viewed across devices.
• Booking details, only when you book: the name, phone number, and ID details a front desk needs to hold a room for you.

• Contacts, photos, microphone, or background location.
• Advertising identifiers. Tulo does not track you across other apps or websites.
• Card numbers or mobile money PINs. Payments are handled by our payment provider; Tulo never sees or stores them.

Usage data helps us improve place coverage and ranking, understand what people search for, fix bugs, and measure which features matter. Booking data is used to hold your room and to send your confirmation and gate code by SMS and WhatsApp. We do not sell your data to anyone.

The property you book receives your name and arrival details, because it needs them to let you in. Our payment provider handles the reservation fee payment. Nobody else receives your personal data unless the law requires it.

Data is stored on managed cloud infrastructure. Passwords are stored hashed, and personal fields are encrypted at rest. Analytics events from signed-out sessions are explicitly labeled anonymous on our servers.

If you claim a listing as its owner or operator, we collect what we need to verify that: your name, role, email, and phone; your registered business name, PACRA number, ZRA TPIN, and trading address; and the documents you upload (business registration and TPIN certificates, an ID, a proof of premises, and a letter of authority where it applies). We use this only to check the claim, a person reviews it, and the uploaded documents are held privately and deleted within 90 days of the decision. The record of the decision itself is kept. You give consent under Zambia's Data Protection Act No. 3 of 2021 when you submit, and you can withdraw a claim any time before it is decided.

You can see, correct, or delete your data under Zambia's Data Protection Act No. 3 of 2021. Delete your account in the app under Profile, then Delete account: this removes your account, sign-in identity, and place history. Records needed for operations, for example anonymized booking rows, are kept without any link to you. We answer written requests within 30 days.