Summary: We collect only what we need to run RealStay India. We never sell your personal data. We use industry-standard encryption. You can request deletion of your data at any time.
SECTION 01
Information We Collect
When you use RealStay India — whether as a tenant searching for a PG or a PG owner listing your property — we collect the following categories of information:
- Account Information: Name, email address, phone number, and password (stored as an encrypted hash) when you register.
- KYC Documents: Government-issued ID (Aadhaar, PAN, Passport) uploaded by PG owners for verification purposes only.
- Listing Data: Property address, photos, videos, pricing, amenities, and contact details submitted by PG owners.
- Payment Information: Subscription plan, transaction ID, and amount. We do not store card numbers — payments are processed by Razorpay (PCI-DSS compliant).
- Usage Data: Pages visited, search queries, clicks, device type, browser, and approximate location (city-level, from IP address).
- Communication Data: Messages sent via our in-app chat, inquiry forms, and support tickets.
- Location Data: GPS coordinates (only if you explicitly grant location permission) to show nearby PGs.
SECTION 02
How We Use Your Information
We use your information only for legitimate, stated purposes:
- To create and manage your account on RealStay India.
- To display your PG listing to prospective tenants (for owners).
- To process subscription payments and issue invoices.
- To verify PG owners through our KYC process, ensuring platform safety.
- To send booking inquiries, chat messages, and notifications you have requested.
- To send transactional emails (payment receipts, listing approval/rejection notices, OTP verifications).
- To improve our platform through anonymised analytics.
- To prevent fraud, spam, and misuse of the platform.
- To comply with applicable Indian laws and regulatory requirements.
Note: We do not use your data for targeted third-party advertising. We do not sell, rent, or trade your personal data to any external party for commercial purposes.
SECTION 03
Sharing of Your Data
We share data only in the following limited, necessary circumstances:
- Between Tenants and PG Owners: When a tenant makes an inquiry, their name and message are shared with the relevant PG owner. The owner's contact number is shared with the tenant upon inquiry.
- Payment Processor: Razorpay receives your billing details to process subscription payments. Razorpay is PCI-DSS Level 1 certified.
- Cloud Infrastructure: We use AWS / Cloudflare for hosting. Data is stored in servers located within India.
- Legal Compliance: We may disclose your information to law enforcement or government authorities when required by Indian law (e.g., under the IT Act, 2000 or court orders).
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you via email before such a transfer occurs.
SECTION 04
Cookies & Tracking
We use cookies and similar technologies to make RealStay India work smoothly:
- Essential Cookies: Required for login sessions, CSRF protection, and core platform functionality. Cannot be disabled.
- Preference Cookies: Remember your settings such as Women Safe Mode, location, and search filters.
- Analytics Cookies: Help us understand how users navigate the platform (e.g., which cities are most searched). Data is aggregated and anonymised.
- Third-party Cookies: Google Maps embeds on listing pages may set their own cookies, governed by Google's Privacy Policy.
You can control non-essential cookies via your browser settings. Disabling them may affect some features.
SECTION 05
Data Security
We take the security of your personal information seriously and implement the following measures:
- All data is transmitted over HTTPS with TLS 1.2+ encryption.
- Passwords are hashed using bcrypt (never stored in plain text).
- KYC documents are stored in encrypted cloud storage with restricted access.
- Database access is restricted by IP whitelist and role-based permissions.
- Regular security audits and vulnerability assessments are conducted.
- In the event of a data breach, we will notify affected users within 72 hours and report to CERT-In as required by law.
SECTION 06
Data Retention
We retain your data only as long as necessary:
- Account Data: Retained for the duration of your account. Upon deletion request, permanently removed within 30 days.
- KYC Documents: Retained for 5 years as required by Indian KYC regulations (RBI/SEBI guidelines for financial platforms).
- Payment Records: Retained for 7 years as required by the Income Tax Act, 1961.
- Chat Messages: Retained for 1 year, then automatically purged.
- Analytics Data: Retained in anonymised, aggregated form indefinitely.
SECTION 07
Your Privacy Rights
Under the Information Technology (Amendment) Act, 2008 and the Digital Personal Data Protection Act, 2023 (DPDPA), you have the following rights:
- Right to Access: Request a copy of all personal data we hold about you.
- Right to Correction: Request correction of any inaccurate or incomplete data.
- Right to Erasure: Request deletion of your account and associated personal data (subject to legal retention requirements).
- Right to Data Portability: Request your data in a machine-readable format.
- Right to Withdraw Consent: Withdraw consent for marketing communications at any time via account settings or by emailing us.
- Right to Grievance Redressal: File a complaint with our Grievance Officer (details in Section 10).
SECTION 08
Children's Privacy
RealStay India is not intended for children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child under 18 has provided us with personal information, please contact us immediately at support@realstayindia.com and we will delete such data within 7 business days.
SECTION 09
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will:
- Update the "Last Updated" date at the top of this page.
- Send an email notification to all registered users at least 7 days before the changes take effect.
- Display a banner on the platform for 30 days after the update.
Your continued use of RealStay India after the effective date constitutes acceptance of the updated policy.