Privacy Policy

1. Who we are and when we decide

Stay Bind Technologies Private Limited (CIN U62090TS2024PTC188422), AA Heights, Survey No. 93, Plot Nos. 25, 26 and 27, Indira Nagar, Gachibowli, Hyderabad, Telangana 500032, India, operates StayBind. Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") a "data fiduciary" decides why and how personal data is processed, and a "data processor" processes it on someone else's behalf. Which one we are depends on whose data it is:

• Operators and their team members (the businesses that use StayBind, and the people they invite): we are the data fiduciary.
• Travellers who create their own account with us, for example on a storefront, to see their trips and saved stays: we are the data fiduciary for that account.
• Guests of an Operator (booking, stay, messages, identity documents): the Operator is the data fiduciary, because it is the host you booked with. We process that data for the Operator, on its instructions, as its data processor.
• Visitors to our websites: we are the data fiduciary for the little we collect (section 9).

If you are a Guest and want to ask about your booking data, the quickest route is your host; you can also write to our Grievance Officer (section 14) and we will help or pass it on.

2. What we collect

Operators and team members

• Account details: name, phone number, email address, role, sign-in records.
• Business details: business and legal name, address, GSTIN, properties, rooms, rates, policies and photos.
• Billing details: plan, invoices, and payment status and references from Razorpay. Card and bank details are entered on Razorpay's pages; we never see them.
• Payment Account connection: when you connect a Razorpay account, your Razorpay account ID, the connection's status and permissions, the credentials that let StayBind act on it (stored encrypted), verification status, and the payment, refund, dispute and settlement records of bookings taken through StayBind.

Travellers with a StayBind account

• Name, phone number and email address you sign in with, and whether they are verified.
• The stays you saved and the bookings linked to your verified contact details.
• Reviews and messages you write.

Guests, on an Operator's behalf

• Name, phone number, email address and, where needed for an invoice, address and GSTIN.
• Booking and stay details: dates, rooms, guests, prices, payments, requests and messages.
• Identity documents, when the host asks for them: the document image, the details on it, and for foreign nationals the passport, visa and travel details Form C needs. Raw Aadhaar numbers are never stored: we keep a masked last four digits and a one-way fingerprint.

Automatically

• Device and usage data: IP address, approximate location from it, browser and device type, pages and features used, errors.
• Cookies and similar technologies (section 9).

3. Why we use it

• To provide the Platform: accounts, properties, calendars, bookings, storefronts, Channel connections, messages, payments, invoices and reports.
• To create orders, payment links and refunds on an Operator's own Payment Account, and to keep bookings in step with what was actually paid.
• To verify identity and prepare Form C, when a host asks for it.
• To bill for subscriptions and send invoices and account notices.
• To provide support, and to answer requests and complaints.
• To keep the Platform secure and to detect and prevent fraud and abuse.
• To understand how the Platform is used and to improve it, using analytics that mask booking and identity details.
• To meet legal, tax and accounting obligations, and to establish or defend legal claims.

We do not sell personal data, we do not use Guests' data for our own marketing, and we do not use it to build advertising profiles.

4. On what basis

We rely on your consent, given when you sign up, connect a service or submit a form, and on the "legitimate uses" the DPDP Act allows: data you give us voluntarily for a purpose (for example to make a booking), processing the law requires, and responding to emergencies. Where we rely on consent, you can withdraw it as easily as you gave it, by changing the setting, disconnecting the service or writing to us; that does not undo processing already done, and some features may stop working.

5. Who we share it with

Only as needed to run the Platform, always under contracts that require the recipient to protect it:

• Hosting, database, file storage and backups (Railway, Vercel, Cloudflare).
• Payments: Razorpay, for our subscriptions and, for an Operator who connects a Payment Account, for that Operator's Guest Payments. When an Operator connects or opens a Payment Account through StayBind, we share the details needed to open, verify and support it, and Razorpay shares account and transaction records back. Razorpay processes data under its own privacy policy and terms.
• Messaging: WhatsApp (Meta), SMS providers in India, email delivery (Resend), and Telegram where an Operator connects it.
• Channels the Operator connects (online travel agencies), through our channel connectivity provider, to exchange rates, availability and bookings.
• Identity: DigiLocker and Aadhaar verification services, when a Guest chooses them.
• AI: the AI model providers behind the assistant (Anthropic, Google), for the requests the assistant handles.
• Monitoring and analytics: error monitoring (Sentry) and product analytics (PostHog, Vercel Analytics).
• Authorities, courts or other parties where the law requires it, to protect rights and safety, or as part of a merger or sale of our business under the same protections.

A traveller who verifies their identity with one host may choose to let other StayBind hosts accept that verification, so they are not asked again. That is shared only with their consent, which they can withdraw at any time.

6. Where it is stored

Our main database and its backups are in Singapore. Files are stored with Cloudflare, error monitoring and analytics run in the United States and the European Union, and some of the providers in section 5 process data in other countries. The DPDP Act permits these transfers except to countries the Government of India restricts; we will stop any transfer the Government restricts.

7. How long we keep it

• Identity document images: deleted automatically 365 days after the host reviews them.
• Accounts: while the account is open. When an account or workspace is closed, we delete or anonymise its personal data, except what we must keep.
• Invoices, payment and tax records: for 8 years, as company, GST and income-tax laws require.
• Security and audit logs: for as long as needed to investigate incidents and meet legal obligations.
• Guests' booking data: as long as the Operator keeps it, and deleted when the Operator or the law requires.

8. How we protect it

Encryption in transit and at rest; Payment Account tokens encrypted separately; identity documents in private storage, reached only through short-lived links, with every viewing written to an audit record; role-based access inside every workspace; least-privilege access for our staff; and monitoring. No system is perfectly secure. If a personal data breach happens, we will tell the Data Protection Board of India and the people affected as the DPDP Act and its rules require, and when we process the data for an Operator, we will tell the Operator without delay and help it do the same.

9. Cookies and analytics

We use cookies that are needed to sign you in and keep the Platform secure, and analytics that tell us which pages and features are used and what errors happen. Analytics mask booking references, identity links and other tokens before anything is recorded. You can block cookies in your browser; signing in needs them.

10. Your rights

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and what we do with it, and the names of those we shared it with;
• have it corrected, completed or updated;
• have it erased, unless we must keep it by law;
• withdraw consent you gave;
• name someone to exercise these rights if you die or cannot;
• complain to us, and then to the Data Protection Board of India if you are not satisfied.

Write to our Grievance Officer (section 14). For data we hold for an Operator, we pass your request to that Operator and help it respond.

11. Children

The Platform is for adults. A traveller account must belong to someone aged 18 or over. A child's details reach us only as part of a booking an adult makes for them, and the host and that adult are responsible for that booking's information.

12. Payment Accounts in detail

When an Operator connects a Razorpay account, the Operator signs in to Razorpay and approves StayBind (accounts connected earlier used API keys instead). Either way we receive credentials that let the Platform create orders, payment links and refunds and read payments and settlements on that account; we store them encrypted and use them only for that Operator's bookings. When an Operator opens a new Razorpay account through StayBind, the verification details (such as PAN, bank account and identity documents) are entered on Razorpay's pages and held by Razorpay. The Operator can revoke our access at any time from Razorpay's dashboard, and we then stop using the credentials.

13. Changes to this policy

When we make a material change we update the "Last updated" date and tell account holders by email before it applies. The current version is always on this page.

14. Grievance Officer and contact

For a privacy question, a request about your data or a complaint, contact our Grievance Officer:

Grievance Officer

Praneeth Reddy Kuraparthi, Founder and Director

Email

contact@staybind.com

Phone

+91 8977629009

Post

Grievance Officer, Stay Bind Technologies Private Limited, AA Heights, Survey No. 93, Plot Nos. 25, 26 and 27, Indira Nagar, Gachibowli, Hyderabad, Telangana 500032, India

Response times

We acknowledge every grievance within 24 hours, give you a reference and a copy of the complaint as we recorded it, and resolve it within 15 days.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India.