Privacy Policy

Last updated: October 2026

Covelet Test, a shortlet operated by Covelet Test ("we", "us", or "our"), operates the website stay.ebakeaaron.com. This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our website and book our shortlet apartment. We comply with the Nigeria Data Protection Act 2023 (NDPA).

1. Information We Collect

When you make a booking or enquiry, we may collect:

  • Full name
  • Email address
  • Phone number
  • Nationality / country of residence
  • Purpose of stay
  • Payment information (processed securely by Paystack — we do not store card details)

2. How We Use Your Information

We use your personal information to:

  • Process and confirm your booking
  • Send check-in instructions and booking-related communications
  • Respond to your enquiries
  • Improve our services and website
  • Comply with legal obligations

3. Data Sharing

We do not sell your personal data. We may share your information with:

  • Payment processor (Paystack) to securely process payments
  • Map data (OpenStreetMap Nominatim and Overpass), used only by us, from time to time, to look up places near our public address. Only the business address (or just the area) is sent; no guest or booking data ever is
  • Email service provider (Resend) to send booking confirmations and communications
  • Legal authorities if required by law

4. Data Security

We implement appropriate security measures to protect your personal information. Payment data is processed through PCI-DSS compliant payment providers and is never stored on our servers.

5. Cookies & Analytics

Where analytics is enabled on this site, we use Google Analytics 4 to understand how visitors use our website. It sets cookies and sends Google information about your visit, such as the pages you view, your device and browser, and your approximate location. This data is pseudonymous, not anonymous: it is tied to an identifier stored in your browser. You can opt out by adjusting your browser cookie settings.

Short links

We share some links to this site (for example on social media, in messages or on printed material) that pass through a short address on stay.ebakeaaron.com beginning with /go/. When you open one, we record: the website you came from (the host name only, not the full address), the time, the kind of device (mobile, desktop or automated), and a scrambled code made from your IP address. The code is made with a random key that is created fresh each day and deleted the following day; once the key is gone, the code can no longer be linked to your IP address or worked out from it, and codes from different days cannot be matched. Database backups can hold a deleted key together with the codes made with it until those backups expire. Within one day the same code lets us avoid counting one visitor several times. For this feature we do not store your IP address itself or your browser's identification string. (Our hosting and network providers may keep ordinary technical logs of connections to the site, which include IP addresses, under their own retention.) We use this to see which channels bring guests, so we can stop spending effort on the ones that do not. Because the code is tied to a visit, we treat it as personal data.

We keep these individual records for 90 days. After that they are deleted and only daily totals per link (number of visits, number of different visitors that day, and number of automated visits) are kept, from which no individual can be identified.

Covelet Test, which operates this site, decides why and how the personal data described in this policy is collected and is the data controller. Caramel Cove Limited provides the booking platform that stores and handles that data and does so only on Covelet Test's behalf, as its data processor.

6. Your Rights Under NDPA

As a data subject under the Nigeria Data Protection Act 2023, you have the right to:

  • Request access to (a copy of) your personal data
  • Request correction of inaccurate data
  • Request deletion of your data
  • Withdraw consent at any time

For access and deletion requests, use our self-service form at stay.ebakeaaron.com/my-data — enter your booking reference and email and choose "Download my data" or "Delete my data". You can also email .

7. Retention

Per the Federal Inland Revenue Service (FIRS) rules, booking financial records (reference, dates, amounts, payment reference) are retained for 7 years. When you exercise your right to deletion, your personal data (name, email, phone, ID document, IP, card metadata) is removed within 24 hours; only the de-identified financial record is retained for tax-audit purposes. Contact-form enquiries are retained for 6 months.

Your identity document (the passport, national ID or driving licence you upload at booking) is kept in our working storage for 2 years by default after your check-out date (or after the cancellation date, if your booking is cancelled, whichever is later). It is then moved, not deleted, to a separate restricted archive in the same private storage, so that we can still answer a payment dispute or a legal claim about your stay. Archived documents are never shown to guests or to our operations staff; only an administrator can retrieve one, only to deal with a dispute or claim, and each retrieval is recorded with who, when and why. Archived documents are permanently deleted 3 years by default after your check-out date (so 1 year in the archive). A document uploaded but never attached to a booking is deleted within 48 hours. We keep a document in working storage longer only while a payment dispute or an incident report about your stay is still open. Photographs taken by our team to record the condition of the apartment at turnover and inspection are kept for 12 months by default after your check-out date (photographs not tied to a booking are counted from the day they were uploaded) and are then archived in the same way and permanently deleted 5 years by default after your check-out date; they are photographs of the property, not of guests. The same holds apply to photographs: they stay in working storage while a payment dispute or incident about the stay is open, while a damage charge for the stay is unpaid, and for as long as a condition report we sent you that includes them exists. The apartment operator can choose longer periods than these defaults, within limits set by the platform (documents are archived after at least 12 months, photographs after at least 6; documents are deleted at most 7 years, and photographs at most 10 years, after check-out). Archiving does not override your right to deletion: when you ask us to delete your data, the archived copies that are linked to that booking at that moment (your identity document and any photographs linked to the booking) are deleted before the booking is anonymized. If we cannot delete them, nothing is anonymized and you can simply try again.

8. Contact

For any privacy-related questions or requests, please contact us at or via WhatsApp.

9. Changes

We may update this policy from time to time. The updated version will be indicated by the "Last updated" date at the top of this page.