Privacy & Cookie Policy

1Who we are#

Lemon Spaces operates serviced apartments for short and longer stays in Cairo, El Gouna and other areas of Egypt. For the personal data described here, we are the controller: we decide why and how it is used.

Company

Lemon Spaces for Real Estate Investment LLC

Commercial register

No. 113337, Cairo Investment Commercial Registry Office

Tax registration number

553-160-362

Registered address

Unit 608, Iconia Zamalek, Mohamed Thakeb Street, Zamalek, Cairo, Egypt

Data protection officer

Mohamed Ezz · [email protected]

When you book through Airbnb, Booking.com or Expedia, that platform holds your data too and is responsible for its own use of it, under its own privacy policy. This policy covers what we do with your data once it reaches us.

Back to contents

2What we collect#

We collect only what we need for the purposes in the next section. What that is depends on how you deal with us.

Your account

• Your name, e-mail address and mobile number (we need a mobile number before you can book), and a password, which we store only in a scrambled (hashed) form that cannot be read back.
• A profile picture, if you choose to add one. It is optional. We keep only a small square copy of it, written again without the place, device or time your camera recorded; only you and our team see it; and you can replace or remove it at any time on your profile page. It is deleted when you remove it and when your account is deleted.
• If you sign in with Google or Apple: the name and e-mail address that account shares with us (Apple may give us a private relay address). We never receive your Google or Apple password.
• Your preferred language, whether you have confirmed your e-mail address and, if you turn on two-factor sign-in, the secret your authenticator app uses and your backup codes.
• For each sign-in: when it happened, your IP address, and your browser and device, to keep your account secure.
• If you book with our team directly — by phone, chat or in person — we may open an account for you with the name, e-mail address and mobile number you gave us, so that your booking, its payment link and your stay's details reach you. The account has no password until you set one: you sign in to it with a code we e-mail to that address, and you can ask us to delete it at any time.

Your bookings and stays

• On our website: the space, your dates, the number of adults and children, the price, fees and exchange rate you accepted, your acceptance of the terms of stay and the cancellation policy, whether you chose to receive marketing, and where your booking and payment stand.
• Through Airbnb, Booking.com and Expedia: these platforms pass your booking to us through Hostaway, our property management system — your name and contact details (sometimes a relay e-mail address from the platform), your dates, the number of guests (adults, children, infants and pets), the price and payment status, the city, country and profile picture the platform shares, anything you wrote with the booking, and whether a rental agreement was signed.
• Bookings made with our team: the same details, entered by us.
• To recognise returning guests, we keep one guest profile, with a customer number, that brings your stays together by e-mail address or mobile number. If you have an account on our website, stays with the same e-mail address or mobile number appear in it.
• From our previous booking platform (the website and team dashboard we used before this one), if you stayed with us or had an account there: your account details, your gender, date of birth and nationality, your stays with their payments, cancellation reasons and the feedback you gave us, our front desk's check-in and check-out records, and the name, nationality, gender, date of birth and contact details of the guests who stayed with you. They are kept with your guest profile and your stays, and only our team sees them. We did not bring over passwords, payment cards, or copies or numbers of identity documents.
• Your wishes for a stay, if you give them — at checkout, on your booking page, or to our team: the options you pick from our list, such as an occasion (a honeymoon or a company event) or a diet (vegan), a note and the time you expect to arrive. Only our team sees them, to prepare your stay. They are optional, and your booking never depends on them.

Before you arrive: your details, identity documents and the rental agreement

• Your arrival details, which you give on the pre-arrival page we open once a booking on our website is paid, or which our team records: the lead guest’s full name, nationality, mobile number, e-mail address and, if you give them, occupation and how you heard of us; and every guest’s full name, nationality and whether they are under 18.
• A copy of a passport or national identity card for every guest — for a child, a passport or birth certificate — uploaded on that page or sent to us in a conversation. Egyptian law requires us to register who stays with us. We keep the copy itself and, with your stay, only the kind of document, the country that issued it, its expiry date, the holder’s date of birth and sex, the last four characters of its number and a one-way fingerprint of the number — never the number itself.
• Whether two of the guests are a married couple, and a copy of your marriage certificate where that is required under Egyptian law and the instructions of the competent authorities. We ask for it only then, and only with your agreement on the page.
• The rental agreement you sign: the agreement with your name, nationality, the last four characters of your document’s number, your contact details and your stay; your signature; and the record of signing — when, from which IP address and browser, and that the code we e-mailed you was entered. If you sign on paper, the photo or scan of the signed page you send us.
• At arrival, our team records the cash security deposit where a stay has one (collected, returned, or kept in whole or in part, and why) and that your stay was reported to the police as the law requires (the date and the station).
• Documents you send us are recognised and filed automatically by software on our own servers, which reads the machine-readable lines of a passport or identity card and the wording of a certificate or agreement. For this they are never sent to an AI provider. Whatever the software is not sure of, a member of our team checks. A stay is marked ready for check-in automatically once everything is in; nothing about your booking is decided by this alone.

Payments

Payments on our website are taken by Paymob, an Egyptian payment provider, on its own secure page. We give Paymob your name, e-mail address, mobile number and the amount. Your card details go to Paymob, never to us. Paymob tells us the result, its transaction reference, and the card type with its last four digits (for example, Mastercard ··2346).

Messages

• What you send us through the chat on our website, WhatsApp, Facebook Messenger, Instagram, e-mail, or the messaging of Airbnb, Booking.com and Expedia (which reaches us through Hostaway) — with any photos, voice notes and documents you attach, such as a payment receipt or a copy of an identity document.
• In the website chat, the name and the e-mail address or WhatsApp number you give us to start the conversation.
• An e-mail address you give us in a conversation — to start the website chat, on the request form, or in a message, including on Airbnb, Booking.com or Expedia — is kept with that conversation and your guest profile, to contact you about your enquiry or stay. It is never used for marketing unless you opt in on our website yourself: giving it to us through a booking platform never subscribes it. We keep it apart from the relay address a booking platform gives us, which we use only through that platform.
• If you leave the website chat before we answer, we e-mail you at that address — at most three a day, and no more than one every 6 hours unless you have been back to the chat: our replies themselves (up to three, with any door code removed) once the address is confirmed — by opening the chat from one of these e-mails in the browser where you started it, or with our team — otherwise only that we answered. Each e-mail has a link back to the conversation, which works once for 7 days (until the address is confirmed, only in the browser where you started the chat), and a link to stop these e-mails. We never send them about a conversation on Airbnb, Booking.com or Expedia.
• Notes our team keeps about your stay and your requests — including whether we look after you as a VIP guest — and our assessment of how likely an enquiry is to become a booking.

Reviews

After a stay booked with us directly, we may e-mail you an invitation to review it. If you write one, we publish your rating and your words on our website with your first name and the month you stayed. We show reviews from Booking.com and other channels in the same way. For Airbnb reviews we show only the rating, never the words. We never publish private feedback, booking references or exact dates.

Your visits to our website

• Only if you accept analytics cookies (see Cookies): your IP address; your browser, device and operating system, including whether you arrived in the in-app browser of Instagram, Facebook or another app; your approximate location (country, region and city) as our network provider reports it; your language, time zone, screen size and type of connection; where your visit came from — a Google search, a post or advertisement on Instagram or Facebook, an e-mail — including the campaign tags and advertising click identifiers in the link; the pages you view, the searches you make (area, dates, guests, bedrooms, budget) and the spaces you look at; and whether you start or hold a booking or create an account. When you are signed in, these records are linked to your account, including earlier visits from the same browser, and your recent searches with dates and the spaces you viewed are shown in your account on any device.
• Only if you accept preference cookies: your last search and the spaces you looked at most recently, kept in your browser so we can show them to you again. Clear on the website removes them and starts your account’s list afresh.
• We strip passwords, one-time links and other keys from web addresses before anything is recorded.
• When a page shows a map, your browser loads it directly from Google Maps (or OpenStreetMap), which receive your IP address and browser details, as any site you load content from does.

If you own an apartment we manage

• Your name, e-mail address and mobile number or, for a company, those of its contact person.
• The units you entrust to us and the terms of our agreement: its dates, your share, any minimum guarantee or fixed rent, and a copy of the contract.
• From our unit records, where you have given them to us: whether you are an individual or a company, your gender and age, and how you came to us.
• The payouts we make to you and the expenses we charge, the dates you block for your own use, and the remarks and repairs we share with you.
• Your owner-portal sign-in, with two-factor sign-in, which is required for owners.

Back to contents

3Why we use it#

We use personal data only when the law gives us a basis to. In plain words, the bases we rely on are:

• Our agreement with you — to do what you ask of us: your account, your booking, your stay, your owner agreement, and the steps you ask for before booking.
• A legal obligation — for example keeping invoices and accounting records, and answering lawful requests from the authorities.
• Our legitimate interests — a genuine business reason, such as keeping our systems secure or improving our service, and only where it does not override your rights and freedoms.
• Your consent — for optional cookies and for marketing. You can withdraw it at any time.

Our AI assistant

Farah, our AI assistant, reads the messages that reach us, and listens to voice notes, to understand them and to draft or send a reply. Photos and documents you send us — a passport, an identity card, a certificate, a signed agreement — are never given to the assistant or to an AI provider; it only learns that a file arrived. A person from our team can step in at any time, and you can always ask to speak to one. Our assistant is instructed never to copy identity-document numbers.

We do not make decisions about you that have legal or similarly significant effects by automated means alone. Our assessment of enquiries only helps our team decide what to answer first.

Back to contents

4Who we share it with#

We don’t sell your personal data, and we don’t share it for other companies’ advertising. We share it with the service providers who help us run Lemon Spaces — they act on our instructions and must protect it — and with others only where your stay needs it or the law requires it.

Inside Lemon Spaces, each member of our team sees only what their role needs. Guests’ identity documents can be opened only by the roles that handle arrivals, marriage certificates only by the Owner and Admin, and every opening is logged.

Back to contents

5Transfers outside Egypt#

Our main database is kept by Neon in Frankfurt, Germany, in the European Union. Several of the providers above are based outside Egypt and may process data in other countries, including the United States.

We transfer personal data outside Egypt only as the Personal Data Protection Law allows: to a country that offers an adequate level of protection, or with the safeguards and licences that the law and the Personal Data Protection Centre require — and always under contracts that oblige the provider to keep it safe and use it only for us.

Guests in the EU/EEA: when your data leaves the EU/EEA, including to Egypt, we rely on safeguards the GDPR recognises, such as the European Commission’s standard contractual clauses or, for your booking itself, on the transfer being necessary to provide the stay you asked for. You can ask us for details of these safeguards.

Back to contents

6How long we keep it#

We keep personal data only as long as the purpose we collected it for needs it, or as long as the law requires. When that time ends, we delete it or make it anonymous.

Back to contents

7Cookies#

Cookies are small files a website keeps in your browser. We use only our own cookies, and no advertising cookies. Necessary cookies are always on, because signing in and booking don’t work without them. Every other cookie stays off until you turn it on, and the website works fully if you decline them.

The categories

• Necessary — keep you signed in, protect sign-in, and remember your cookie choice. Always on.
• Preferences — remember your last search and the spaces you looked at. Only with your consent.
• Analytics — help us understand how visitors find and use the website: where visits come from, which pages are read, which searches are made. Only with your consent.
• Marketing — cookies of advertising partners, to measure and tailor adverts. We don’t use any yet; if we add them, they will stay off unless you turn them on.

Your choice

On your first visit we ask which categories you accept: all of them, only the necessary ones, or a choice of your own. You can change your mind at any time with Cookie settings at the bottom of every page. When you turn a category off, we delete its cookies; withdrawing consent does not affect what was done before. We keep a record of each choice — a random reference, what you chose and when, and a shortened form of your IP address — for 3 years, as proof of consent.

The cookies we use

Our website chat keeps its conversation in your browser’s local storage, which works like a cookie but is never sent to us automatically.

Maps are loaded from Google Maps or OpenStreetMap, which may use their own cookies under their own policies. You can also block or delete cookies in your browser’s settings; if you block the necessary ones, you won’t be able to sign in or book.

Back to contents

8Our mobile app#

Our app for iPhone (and later Android) lets guests browse and book our spaces, see their stays, send what we need before arrival and chat with our team, and lets owners follow their apartments. Everything in this policy applies to it too; this section says what is particular to the app.

What the app collects

• Your account: your name, e-mail address and mobile number, as on the website (see What we collect), and, if you sign in with Apple or Google, what that account shares with us. Owners sign in with their e-mail address, password and authenticator code.
• Before you arrive: your arrival details and the photos of passports, identity cards and certificates you take or choose for a stay's registration, handled exactly as described above. The app takes no selfie and makes no face match.
• Messages you send our team in the app's chat, your reviews and feedback, and, if you apply to have us manage your home, your contact details and the property's address and description.
• A push notification token, only if you turn notifications on: an identifier of the app on your phone that Expo, the service that sends our notifications, gives us, so that our notices reach it.
• Your bookings, add-ons and service requests, as on the website.

Permissions on your phone

• Camera and photos — only when you photograph or choose a document for your stay's registration, or a profile picture. The app reads only the pictures you pick.
• Notifications — asked only when you turn them on in the app's settings, never at launch. You can turn each kind (bookings, messages, arrival) off in the app or switch notifications off in your phone's settings.
• The app never asks for your location, contacts or microphone.

Notifications

Our notifications go through Expo's push service (Expo, in the United States) and on to Apple Push Notification service or Google's Firebase Cloud Messaging, which deliver them to your phone. They receive the token, the notice's fixed title and short text (which may name your booking reference) and the app screen it opens, and nothing else. A notification never contains a door code, a key-box code, a Wi-Fi password or what a message says: it says only that something is ready and opens the app. The list of notices in the app is kept 180 days; the token is deleted when you sign out, when the app leaves your phone or when your account is deleted.

AI in the app's chat

Before your first message, the chat tells you that replies may be written by Farah, our AI assistant, with AI from OpenAI, Anthropic or Google, and asks for your OK. It works as described in Our AI assistant: photos and documents are never given to an AI, and a person from our team can step in at any time.

No tracking

The app contains no analytics, advertising, attribution or crash-reporting software, does not track you across other companies' apps or websites, and does not ask to. Your recent searches and saved homes stay on your phone and are never sent to us. Your sign-in is kept in your phone's secure storage (the iOS Keychain).

Deleting your account

A guest can delete their account in the app, in Profile → Settings → Delete my account, after confirming it is them. We then delete it as described in How long we keep it, keeping only what the law requires. An owner's account is closed by our team: write to [email protected]. Delete your account gives every way to ask for it, with or without the app.

Back to contents

9Your rights#

Whoever you are — guest, visitor or owner — you have these rights over your personal data:

• To know and access — to know whether we hold personal data about you, what it is and how we use it, and to receive a copy.
• To correct — to have inaccurate or incomplete data corrected or updated.
• To erase — to have your data deleted, unless the law requires us to keep it.
• To withdraw consent — at any time, for anything we do because you agreed to it, such as optional cookies and marketing.
• To object or restrict — to object to our use of your data, or ask us to limit it to a specific scope, in particular where we rely on our legitimate interests.
• To be told of a breach — if a breach of security affects your personal data.
• To complain — to the Personal Data Protection Centre (PDPC) in Egypt (see Contact and complaints).

Guests in the EU/EEA also have the right to data portability — to receive the data you gave us in a machine-readable format — and may complain to the data protection authority of the country where they live or work.

How to use them

Write to [email protected], preferably from the e-mail address on your account or booking, and tell us what you would like. If we need to confirm that it is you, we will ask. We acknowledge every request within 6 working days and tell you what we will do and by when.

You can also switch optional cookies on or off yourself with Cookie settings at the bottom of every page, and clear your remembered searches and viewed spaces with Clear on the website.

Back to contents

10Marketing#

• We e-mail you new homes and offers only if you have asked us to on our website. At checkout the box is unticked unless you tick it, and your booking never depends on it. If you sign up with the form at the foot of our pages or with “Alert me” on the search page, we first send one e-mail to that address asking you to confirm, and nothing more unless you do; a sign-up nobody confirms is deleted 30 days after the last such e-mail. We never subscribe an address because it reached us through Airbnb, Booking.com or Expedia, or their messages: only your own opt-in on our website counts.
• You can withdraw at any time on your account page, or by writing to [email protected]. Every marketing e-mail we send will say that it is marketing, name us with our full address, and include an Unsubscribe link and a link to change what we send you; mail apps that support it also show a one-click Unsubscribe button.
• We keep a record of when and how you gave your consent, and of when you withdrew it, for 3 years from the last marketing e-mail we sent you or from your withdrawal, whichever is later, so we can show that it was given. The areas, bedrooms and budget you chose are deleted as soon as you withdraw.
• E-mails your account or booking needs, such as the booking confirmation, are not marketing and are sent whatever you choose. Nor is the invitation to review a stay; if you would rather not receive one, tell us.

Back to contents

11Children#

Our website and our bookings are for adults. We don’t knowingly collect personal data from children, and a child should not create an account or book. When you book for a family, the booking records only how many children and infants are staying, not their names. Before arrival, Egyptian law requires us to register every guest, children included: the parent or guardian travelling with a child gives the child’s name and nationality and a copy of their passport or birth certificate, and confirms on the page that they do so as parent or guardian. If you think a child has given us personal data, write to [email protected] and we will delete it.

Back to contents

12Security#

• Payments are made on Paymob’s secure page; your card details never reach us.
• Passwords are stored only in hashed form. Two-factor sign-in is open to every guest and required for owners and our staff.
• Our team’s access depends on their role, and staff actions in our systems are logged.
• Door and key-box codes, and the credentials of the services we connect to, are encrypted in our database.
• Guests’ identity documents, certificates and signed agreements are kept in a private, encrypted store of their own, apart from photos and chat files; marriage certificates under a separate key. Every opening is logged, and they are deleted automatically when their time is up.
• The link to your pre-arrival page is long and random and its key is taken out of the address at the first visit; what you typed before is shown, and the agreement signed, only after a code sent to your e-mail address.
• One-time links are removed from our copies once sent, and keys are stripped from web addresses before a visit is recorded.
• Connections to our website are encrypted.

No system is completely secure. If a breach affects your personal data, we will notify the Personal Data Protection Centre within 72 hours of becoming aware of it, and tell you without undue delay what happened, what it means for you and what we are doing about it.

Back to contents

13Changes to this policy#

We will update this policy whenever what we do with personal data changes; the date at the top shows the latest version. If a change is significant, we will tell you on the website or by e-mail before it takes effect.

Back to contents

14Contact and complaints#

Privacy requests

[email protected]

Data protection officer

Mohamed Ezz

By post

Lemon Spaces for Real Estate Investment LLC, Unit 608, Iconia Zamalek, Mohamed Thakeb Street, Zamalek, Cairo, Egypt

If you are unhappy with how we have handled your personal data, please tell us first — we would like the chance to put it right. You can also complain to Egypt’s data protection regulator, the Personal Data Protection Centre (PDPC). Guests in the EU/EEA may also complain to the data protection authority of the country where they live or work.

Back to contents