Privacy policy

Draft, last updated 7 November 2026. To be reviewed by the owner's lawyer before launch. Names in square brackets are placeholders.

This policy covers the personal data [Client legal entity name] collects through this website, and is written to meet India's Digital Personal Data Protection Act, 2023.

What we collect

When you request a booking: your name, phone number, email, the dates, the number of guests and any note you add. When you pay online, our payment processor Razorpay handles your card or UPI details. We never see or store them. At check-in we ask for photo ID as the law requires for every guest.

Why we use it

To answer your request, confirm and run your stay, take payment, meet legal duties such as guest registration, and resolve disputes. We do not sell your data and we do not use it for advertising.

Who we share it with

Razorpay to process payments, our hosting provider to run the site, Google and Microsoft for the site analytics described below, and authorities where the law requires it. Nobody else.

How long we keep it

Booking records for as long as tax and accounting law requires. Requests that never became a stay are deleted within 12 months.

Your rights

You can ask to see, correct or delete your data, or withdraw consent, by writing to stay@example.com. We reply within 30 days. Grievance officer: [name], stay@example.com.

Cookies and analytics

We use Google Analytics and Microsoft Clarity to understand how visitors use the site, such as which pages they read and where they click or scroll. Both set cookies and receive your IP address, browser and device details, and pages viewed. Clarity also records anonymised page interactions; it masks text you type into forms. We use this only to improve the site, never for advertising. Visitors in Europe are asked first and nothing loads until they accept. Anyone can change their choice with Cookie settings at the foot of every page, block these cookies in the browser, or install Google's opt-out add-on. The owner desk keeps a sign-in token in your browser session only.