Privacy

Who we are

Zuri is a travel platform for Uganda and the rest of Africa, operating at zuritrips.com. For anything on this page, write to [email protected].

What we collect

• Your account. Name, email address and password. The password is stored only as a bcrypt hash — we cannot read it, and neither can anyone who obtains the database.
• What you ask for. Booking requests, flight quote requests and room requests: the route or property, dates, how many people are travelling, your phone number if you give one, and anything you write in the message box.
• What you publish. Stories, reviews and photos you upload, along with the name on your account. These are public by design.
• Messages. Conversations between you and an operator about a booking, which both of you and Zuri can read.
• Server logs. Ordinary web server records — IP address, time, page requested — kept briefly for security and debugging.

We do not ask for your passport number, date of birth or payment card details, and there is nowhere on Zuri to enter them.

Cookies

Zuri sets one cookie of its own, zuri_session. It keeps you signed in, lasts 30 days, is signed so it cannot be edited, and is marked HttpOnly so scripts on the page cannot read it. It holds nothing but your account identifier. There is no analytics or tracking cookie on this site.

Advertising

Zuri has applied to show advertising through Google AdSense. No ads are running yet. If and when they appear, Google and its partners set their own cookies to select and measure them, which may include ads based on your previous visits to this and other sites. You can turn personalised advertising off at Google My Ad Center and opt out of many other advertisers at optout.aboutads.info. Those controls are Google's, not ours, and they work whether or not you have a Zuri account.

Who else sees your information

We do not sell your data, and we do not share it for anyone else's marketing. It reaches these parties because the site cannot work otherwise:

• The operator or hotel you are booking. When you send a booking request, the business receives your name, your dates, the number of guests and your message, because they are the ones answering it. If you use the WhatsApp button, that conversation happens on WhatsApp under Meta's terms, not ours.
• Resend delivers our email. It handles the recipient address and the contents of the message — confirmations, quotes and alerts.
• liteAPI (Nuitée) powers partner hotel and flight search. Searching sends only the destination and dates. Making a partner booking also sends the lead guest's name and email, because the hotel needs to know who is arriving.
• Railway hosts the site and stores the database and uploaded photos, on servers in the United States.
• Cloudflare provides DNS for zuritrips.com and routes mail sent to our addresses.
• OpenStreetMap serves the map tiles. When a map loads, your browser requests those images directly from OpenStreetMap, which means it sees your IP address.
• Google, for advertising, if and when ads are enabled — see above.

Zuri does not yet take payment from travellers. When it does, a payment provider will handle your card or mobile money details directly and Zuri will hold only a reference to the transaction, never the numbers themselves. This page will be updated before that goes live, not after.

How long we keep it

Account details and bookings are kept while your account exists, and afterwards only as long as needed to settle anything outstanding or meet a legal obligation. Stories and reviews you published stay up unless you ask for them to come down. Server logs are short-lived. Ask us to delete your account and we delete it — see below.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and its data. Email [email protected] from the address on the account and we will act within 30 days. There is no charge, and asking will not affect a booking already made — though a booking you have already made with an operator may need to stay on record until the trip and any refund are finished.

Uganda's Data Protection and Privacy Act, 2019 applies to Zuri. If you are in the EU or UK, the GDPR gives you these rights too, along with the right to complain to your national data protection authority. Because our servers are in the United States, using Zuri from elsewhere means your information is transferred there.

Children

Zuri is not intended for anyone under 18 and we do not knowingly collect their information. If you believe a child has created an account, tell us and we will remove it.

Changes

If this policy changes in a way that affects what we do with your information, we will change the date at the top and, for anything significant, tell account holders by email rather than expecting anyone to notice a quiet edit.

Related

Booking terms covers who is responsible for what when you book. Cancellations and refunds covers changing your mind.