MicoDev, Karachi, Pakistan · last updated 15 September 2026 · booking rules PILOT_1_0
What we collect. When you open a property page we set a cookie holding a random session id, so that we can tell which link brought you here. When you make a booking we set a second one, which proves this browser is the one that made it — that is what lets you back into your own booking without signing in, and what stops anyone else reading it. Neither identifies you to anyone else and neither follows you to other websites. If you book, we collect the name and WhatsApp number you type, the date and slot you chose, and the transaction reference you enter after you pay. We store the reference you type — we do not see your bank login, your balance, or any other transaction.
Why. The host needs your name and number to confirm your booking and let you in. The link you arrived through decides whether that host pays us a commission; it is used for that, and not for advertising.
Who sees it. MicoDev and the host of the place you booked. Not other hosts, not other guests, and no advertiser. We do not sell or rent it. The one other party is Anthropic, who run the assistant described below, and who see only the question you type — never your name, your number or your bookings.
WhatsApp. If you reach us through WhatsApp, Meta carries that message and their own terms apply to it. We keep the message id for seven days and then delete it — it exists only so that a hiccup on their side does not send you the same message twice.
How long. Booking records are kept while the pilot runs and for as long as tax records must be kept afterwards. The session cookie lasts 90 days. Ask us and we will delete what is not legally required.
The assistant. The question you type is sent to Anthropic, who run the model that reads it, together with the public details of the listing you are looking at. Your name, your number and your bookings are not sent. Anthropic process it to answer and do not train on it. The model itself is given no phone number, no bank account and no street address for any property — not filtered out afterwards, simply never given, which is the only version of that promise worth making. We keep the question and the answer so we can see which questions our listings keep failing to answer.
Messages to a host. If you ask a host something, we store the message and show it to that host and to nobody else. The host does not see your phone number, and you do not see theirs. We ask for your number only so their reply can reach you.
What we remove from messages. Phone numbers, e-mail addresses, web links, bank accounts and CNIC numbers are stripped out of every message in both directions, before the message is stored — so the number never reaches our database either. You are always told what was removed; nothing is deleted quietly. This protects you from a fake account number arriving in a chat, and it protects both sides from a booking made outside MicoDev, which we cannot stand behind.
When contact details are shared. Once a booking is confirmed, and not before. At that point you receive the host's number and the gate contact automatically, and the host receives yours. Neither of you has to ask.
If you leave a review. The morning after you check out we send one message asking how it went, and one reminder four days later if you have not answered. That is the most we will ever send, every message has a one-tap way to stop, and telling us to stop ends it for that stay. If you do review, we publish your first name only, the rating, what you ticked and what you wrote — never your number, and never your surname. Phone numbers and links are stripped from the text the same as anywhere else here. You can only review a stay you actually booked and paid for, which is the point of them.
Star ratings. A listing can carry two, and they are always labelled so you can tell them apart. Ours says "from guests who booked here" and is built only from stays paid for through MicoDev. The other is the place's own Google rating, written by anyone, which we show because a new pilot has few reviews of its own and a good farmhouse should not be punished for that. We will not borrow someone else's and call them ours. We read only the score, the number of ratings and the location from Google; we do not copy review text onto this site. Nothing about you is sent to Google when a listing is shown — we look the place up by its own Google id, not by anything of yours. Tapping through to read the reviews takes you to Google, where their terms apply.
The map. Switching the catalogue to map view loads map tiles from OpenStreetMap, so your browser contacts them and they see your IP address, as any website with a map would. It happens only when you open the map, never on the ordinary list, and we send them nothing about you or about what you searched for. We deliberately did not use an embedded Google map here, which would do the same thing on every page.
Alerts. If you switch on browser alerts, we store the address your browser gives us to deliver them to. It identifies a browser, not you, and turning alerts off in your browser stops it being usable. We use it only to tell you a host has replied.
The form on List your place collects your name, WhatsApp number, what you own, where it is, and what you say you charge. It is a request for a call. It is stored so a person can ring you, seen only by the MicoDev team, and it does not create an account or a listing — nothing about your property goes live before we have visited it.
If you decide not to proceed, tell us and we delete the enquiry.
What we collect. Your legal name, CNIC, NTN if you have one, your phone number, your bank account title and IBAN, your property details, your rates and calendar, photographs you upload, and the phone numbers of the existing customers you give us.
Your customer list. This is the sensitive one, so: it is used for exactly one purpose, which is recognising your existing guests so you are never charged for them. It is frozen when imported and cannot be added to afterwards. We do not contact the people on it, and we do not use it to market to them.
Your bank details. Your account title and IBAN are shown to a guest on the payment page for a booking they are making with you. That is the point of them: it is how a guest knows the account is really yours. They are not shown anywhere else.
Photographs. Every photo you upload is re-saved before it is stored, which removes the hidden location tags and device details your phone attaches. We do that whether or not you ask.
Questions from guests. A guest can ask you something before they book. You see their first name and their question; you do not see their number, and they do not see yours, until the booking is confirmed. Phone numbers, links and account numbers are removed from your replies too. That is not distrust — it means nobody can lean on you to take the booking off MicoDev, and it means a guest can never be handed a fake account number in a chat that looks like it came from you.
Your dashboard link. Your dashboard has no password — the signed link is the key. Anyone you forward it to can see your statement, so treat it like a key. Tell us if it gets out and we will issue a new one.
How long. While you are listed, and afterwards for as long as tax and accounting records must be kept. Leave, and we delist you and delete what we are not required to retain.
The database is not reachable from the internet. Traffic to this site is encrypted. Phone numbers are also stored as a one-way fingerprint so that matching a guest to a frozen customer list does not require reading the list. Access is limited to the MicoDev staff who run the pilot.
We are a small team, not a bank. We will tell you promptly and plainly if something goes wrong, rather than quietly.
Ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. We will do it, minus anything we are legally required to keep. Message us on WhatsApp +1 732-829-8296.