Privacy Policy

1. Introduction

This Privacy Policy explains how JaipurBNB (“we”, “us”, “our”) handles personal data collected through jaipurbnb.com. It should be read together with our Terms & Conditions.

We process personal data in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. For the purposes of the DPDP Act, JaipurBnB is the Data Fiduciary and you are the Data Principal.

2. What data we collect

2.1 Data you give us directly

• Host account details, full name, email address, mobile number and a password (stored only as a one-way cryptographic hash, never in readable form).
• Property listing details, property title, description, neighbourhood, address, stay type, tariff, amenities, house rules and up to fifteen photographs per listing.
• Contact number for guest enquiries, the mobile number you nominate is displayed to guests on your listing so they can reach you by WhatsApp or call.
• Calendar feed URL, if you choose to connect an external availability calendar (for example an Airbnb iCal link), we store that URL in order to read availability from it.
• Correspondence, anything you send us by email or telephone.

2.2 Data we collect automatically

• Listing engagement data, when a visitor views a listing page or taps its WhatsApp or Call button, we record the event type and time so hosts can see how their listing is performing. These records are used for aggregate counts shown in the host dashboard.
• Technical data, IP address, browser type and version, device type, operating system, referring page and pages visited, collected through standard server logs.
• Session data, a session identifier used to keep you logged in.

2.3 Data we do not collect

We also do not knowingly collect data from children. The platform is intended for users aged 18 and above. If you believe a child has provided us with personal data, please contact us and we will delete it.

3. Why we use your data and on what basis

We process personal data for the following purposes, on the basis of the consent you give when you create an account or submit a listing, and for the legitimate uses permitted under section 7 of the DPDP Act, 2023:

• To provide the service, create and authenticate your account, publish your listing, and display your contact details to prospective guests.
• To verify listings, our team manually reviews each submitted listing before it goes live, as described in the Host Listing Terms.
• To process subscription payments, take payment for listing plans and maintain a record of transactions.
• To provide analytics to hosts, show you how many people viewed your listing and tapped through to contact you.
• To communicate with you, send transactional emails such as listing approval or rejection notices, payment confirmations, expiry reminders and password reset links.
• To keep the platform secure, detect and prevent fraud, abuse, spam and unauthorised access.
• To comply with law, meet our obligations under Indian tax, accounting and information technology law, and respond to lawful requests from authorities.

We do not sell your personal data, and we do not use it to serve third-party advertising.

4. Cookies and similar technologies

We use a small number of browser cookies. We do not use advertising or cross-site tracking cookies.

• Strictly necessary cookies, a session cookie that keeps you signed in, and a CSRF token cookie that protects forms against cross-site request forgery. The platform cannot function without these.
• Preference cookies, remember choices such as filters you have applied while browsing.
• Payment gateway cookies, set by Razorpay when a payment window is opened, to secure and complete that transaction.

Most browsers let you refuse or delete cookies through their settings. Blocking strictly necessary cookies will prevent you from logging in or submitting forms.

5. Third-party services we share data with

We share personal data only where it is necessary to run the platform, and only with the following categories of recipient:

5.1 Razorpay (payments)

Subscription payments are processed by Razorpay Software Private Limited, a payment aggregator authorised by the Reserve Bank of India. When you pay for a listing plan, your name, email address and mobile number are passed to Razorpay to create the payment order, and you enter your payment credentials directly on Razorpay's interface. Razorpay returns to us only a payment identifier, an order identifier, the amount and the payment status, which we store in our transaction records. Razorpay processes your data as an independent data fiduciary under its own privacy policy, available at razorpay.com/privacy.

5.2 Hosting and infrastructure

The platform and its database are hosted on servers operated by our hosting provider. Data is stored on servers located in India wherever the provider offers that option.

5.3 Email delivery

Transactional emails are sent through an email service provider, which processes the recipient address and message content solely to deliver the message.

5.4 External calendar providers

If you supply an external calendar feed URL, our servers fetch that URL periodically to read availability dates. This is a one-way read: we never write, push or send any data back to that provider.

5.5 Other hosts and guests

Information you choose to publish in a listing (including your nominated contact number, property photographs and the property's neighbourhood) is publicly visible to anyone browsing the platform. Please do not include anything in a listing that you would not want to be public.

5.6 Legal disclosures

We may disclose personal data where required to do so by law, court order or a lawful request from a government or regulatory authority, or where necessary to establish, exercise or defend legal claims.

6. How long we keep your data

• Host account and listing data, for as long as your account is open. If a subscription expires, the listing is hidden from public view but its data is retained so that you can renew and restore it.
• Transaction records, retained for a minimum of eight (8) years, to meet Indian tax and accounting record-keeping requirements.
• Listing engagement records, retained while the listing exists so that historical performance remains visible to the host.
• Server logs, typically retained for a short period for security and diagnostic purposes.

When you ask us to erase your account, we delete or irreversibly anonymise your personal data except where we are required by law to retain it (most commonly, transaction and tax records).

7. Your rights

As a Data Principal under the DPDP Act, 2023, you have the right to:

• Access, obtain a summary of the personal data we hold about you and how it is processed.
• Correction, have inaccurate or incomplete data corrected, completed or updated. Hosts can edit most of their data directly from the host dashboard.
• Erasure, ask us to delete personal data that is no longer needed for the purpose it was collected, subject to our legal retention obligations.
• Withdraw consent, withdraw consent you have given, at any time. Withdrawing consent does not affect processing carried out before the withdrawal, and may mean we can no longer keep your listing live.
• Grievance redressal, raise a complaint with us about how we handle your data (see section 10).
• Nominate, nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email jaipurbnb@jaipurbnb.com from the address registered on your account. We may ask you to verify your identity before acting on a request, and will respond within the timelines prescribed by law.

8. How we protect your data

We apply reasonable security practices and procedures, including:

• encryption of data in transit using HTTPS/TLS across the whole site;
• one-way hashing of account passwords, so that they cannot be read even by us;
• protection of all state-changing forms with CSRF tokens;
• rate limiting on login, registration and password reset endpoints to blunt automated attacks;
• cryptographic signature verification of every payment callback received from the gateway;
• restricting access to production data to the minimum number of authorised personnel.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users in the manner and within the timelines required by the DPDP Act, 2023.

9. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or in applicable law. The revised version will be posted on this page with a new “Last updated” date, and material changes will additionally be notified by email to registered hosts.

10. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made under it, and with the DPDP Act, 2023, complaints about the processing of your personal data may be addressed to: