Last updated: 4 November 2026.

This policy explains what Devcity ("we", "us"), based in Malé, Maldives, collects through Luzo Suite — the website at luzosuite.com, the booking pages and websites it publishes, and the Luzo Suite mobile app — why we collect it, who can see it and how long we keep it.

There are two kinds of people in it. Account holders are the guesthouses and hotels that use Luzo Suite and their staff. Guests are the people those businesses take bookings for. For a guest's information, the guesthouse decides why it is collected and we process it on the guesthouse's behalf, so a guest who wants to see or change it should ask the guesthouse first.

• Account details: your name, email address and role, and a password that we store only in hashed form, never as typed.
• Business details: your company and property names, address, contact details, and a Tax Identification Number if you choose to enter one.
• Activity records: which user did what and when (for example issuing a document or changing a rate), so that mistakes can be traced.
• Mobile app details: the device name you give or the phone reports, its platform, the app version, a sign-in token for that device, and the notification token the phone's push service issues. Sign-in tokens last at most 90 days.
• Photos: only if you take or attach one, for example of a maintenance problem. The app asks permission for the camera or photo library at that moment and uses it for nothing else.
• Messages to us: what you write when you use a contact form or email us.

A guesthouse records what it needs to run a stay: a guest's name, contact details, booking dates, room and rate, how many people are in the party, details needed to apply tax rules (for example whether a guest is exempt from Green Tax because of age or residence), charges and payments on the guest's bill, restaurant orders charged to a room, and any notes the guesthouse adds. Booking pages ask a guest for the details the booking needs. Guest documents, such as an invoice or a booking confirmation, are saved as they were issued.

To provide Luzo Suite: to sign you in, take and manage bookings, calculate tax, produce documents, send the emails and notifications the product is designed to send, keep the service secure and fix faults, and answer you when you contact us. We do not sell personal data and we do not use it for advertising.

If you allow notifications in the app, we send short alerts, for example a new booking request or a maintenance report. They carry names, dates, room or table details and counts. They never carry payment amounts. Alerts are delivered through Google's Firebase Cloud Messaging and, on iPhone, Apple's push service, so those providers handle the notification and your phone's notification token. You can turn notifications off in your phone's settings at any time.

We use only the cookies the service needs: a session cookie that keeps you signed in and a security cookie that protects forms. We do not use advertising or cross-site tracking cookies. The booking page and website count visits in aggregate, without building a profile of a person.

• Our hosting provider, which runs the servers Luzo Suite is on.
• Google and Apple, for push notifications as described above.
• An email delivery service, which carries the emails the product sends, such as booking confirmations.
• Services a guesthouse connects, such as an online travel agency, but only if the guesthouse sets that up.
• Authorities, if the law requires us to.

We do not share guest data between guesthouses. Each business sees only its own.

• Account and business records are kept while the account is open, because bookings, folios and invoices are financial records.
• Contact-form messages left on a guesthouse's website are deleted after 90 days. Enquiries to us through luzosuite.com are kept for up to 12 months.
• Activity records are deleted after about 12 months.
• A free account that is not renewed is archived after 30 days and permanently deleted 180 days after its term ended, with reminders before deletion. An archived account is read-only.
• Mobile sign-in tokens expire after 90 days and are removed when you sign out of the app or a device is revoked.

After deletion, copies may remain in backups for a short time until they are overwritten.

Connections to Luzo Suite use HTTPS. Passwords are hashed. Each business's data is separated from every other's, and what a person can see follows their role, so a cleaner's login cannot open financial screens. Phone sign-ins can be revoked one device at a time, and links to guest documents are signed and expire. No system is perfectly secure, and we cannot promise that nothing will ever go wrong; if we learn of a breach that affects you, we will tell you.

You may ask us, at support@luzosuite.com, to show you the personal data we hold about you, to correct it, or to delete it, and we will answer within a reasonable time. We may need to keep some records where the law requires it. If you are a guest of a guesthouse, please contact the guesthouse first, because it is the one that holds your booking; we will help it respond.

To delete a Luzo Suite account and its data, the account owner can email us.

Luzo Suite is not aimed at children and children do not create accounts. A guesthouse may record a child's age as part of a booking because tax rules depend on it.

We may update this policy; the date at the top shows the latest version, and we will tell account owners about significant changes. Questions: support@luzosuite.com, Devcity, Malé, Maldives.