1. Introduction & Scope
Pravaasa Stays ("Pravaasa", "we", "us") runs an online travel marketplace in India for verified homestays, villas, resorts, treks and events. We take your privacy seriously. This Privacy Policy describes how we handle personal data when you use our website, applications and related services (the "Platform"), whether you are a traveller, a host, an event organiser or just a visitor.
In the language of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), you are the "Data Principal" and, for the personal data we decide how and why to process, Pravaasa is the "Data Fiduciary". Hosts who receive your details to host you also handle that data for their own purposes of providing your stay, and are responsible for treating it lawfully.
This Policy applies together with our Terms & Conditions and Cookie Policy. We handle personal data in line with applicable Indian law, including the DPDP Act and the Information Technology Act, 2000, as they apply to us. If the law changes, we will update this Policy.
2. Information We Collect
2.1 Information you give us
Account and sign-in details: your name (given name, family name or a single name), mobile number, email address, preferred language and, if you use Google sign-in, the identifier and basic profile details Google shares with us. We do not need a password from travellers; sign-in uses one-time passwords (OTP) or email links.
Booking details: stay dates, number of guests, the property and rate plan you chose, special requests, and the messages you exchange with hosts.
Trip briefs and InstantMatch requests: your destination, dates, group size, budget, stay type, food preferences, and optional details such as travelling with pets, vehicle, accessibility needs, trip purpose, mood or occasion. We use these to find matching stays and to show hosts what you are looking for.
Host and property details: property name, address and map location, photos, descriptions, amenities, rates, calendar availability, and identity and verification information that hosts submit to be verified (for example PAN, bank proof, or GSTIN where applicable). Hosts also give bank or UPI details so we can pay them.
Support and dispute records: your messages to the support team, case details, photos or documents you attach as evidence, and your communications in a dispute.
Reviews, community posts and travel stories you write, and any questions you ask or answers you give in community features.
2.2 Information collected automatically
Device and connection information: IP address, browser type, device type, operating system and basic technical logs that help us keep the Platform secure and working.
Usage information: the pages and features you use, searches and filters, and the stays you save or add to your compare list. Some of this is stored only in your own browser (see our Cookie Policy).
Location: an approximate location from your IP address, and a precise location only if you choose to share it, for example to find stays near you. You can decline or withdraw location permission in your browser or device settings.
Security and audit records: sign-in events, device sessions, consent records and a record of important account and booking actions, which we keep to protect accounts and investigate misuse.
2.3 Information from other sources
Payment partners tell us whether a payment succeeded, failed or was refunded and give us a payment reference. They do not give us your full card number, CVV or UPI PIN.
Hosts may add private notes about a guest to their own records after a stay, and hosts may leave feedback about guests. Public reviews and ratings that you receive become visible as described in our Review & Rating Policy.
Google Maps and place data providers, and event or trek organisers, supply public information about places, treks and events that we show on the Platform.
2.4 What we do not collect
We do not store your full card number, CVV, UPI PIN or net-banking credentials on our servers. These are entered into the payment partner's secure checkout.
We do not intentionally collect sensitive information such as health, religion or political views. Please do not put such details in free-text fields unless you must (for example, accessibility needs you want a host to know).
3. Why We Use Your Information, and Our Basis for Doing So
Under the DPDP Act we process personal data either with your consent or for "certain legitimate uses" that the Act recognises, such as performing something you have asked for, complying with the law, or protecting against fraud. In practice this looks like the following.
3.1 To provide the service you asked for
Creating and securing your account, and verifying you by OTP, email link or Google sign-in.
Showing availability and prices, creating quotes, taking payment, confirming bookings, issuing invoices and sending confirmation messages.
Matching your trip brief with suitable hosts through InstantMatch, and letting you and your host communicate before and during a stay.
Handling cancellations, refunds, disputes and support requests.
3.2 To keep the Platform safe and trustworthy
Verifying hosts and listings, detecting fraud, scams, fake listings and fake reviews, and enforcing our Terms.
Securing accounts, rate-limiting suspicious sign-in attempts and keeping audit records of sensitive actions.
Meeting legal obligations such as tax, invoicing, accounting and responding to lawful orders from courts or authorities.
3.3 To improve and personalise the Platform
Understanding which features are used so we can fix errors and improve speed and usability.
Remembering preferences such as language, theme or compare list, and generating personalised suggestions based on what you tell us and what you do on the Platform. You can correct or exclude traits from your travel profile where the feature is offered.
Where we use AI-assisted tools (for example to help draft listings, read property information or assist with trip planning), we send only the information needed for that task, and a person remains responsible for decisions that materially affect you.
3.4 To communicate with you
Transactional messages such as OTPs, booking confirmations, cancellation and refund notices, payout notices to hosts and security alerts, which we send by email, SMS, WhatsApp or in-app notification depending on what is available and what you have chosen.
Marketing and promotional messages only where you have opted in. Marketing preference is off by default, and you can change your notification preferences from your account page at any time. Security and booking messages that you need to use the service may continue even if you opt out of marketing.
4. Consent and How to Withdraw It
Where we rely on your consent, for example for optional location access, marketing messages or certain notifications, we ask for it clearly and separately, and we keep a record of it. You do not have to agree, and you can say no to optional uses without losing access to the core booking service.
You can withdraw consent at any time. For notification and marketing choices, use the notification preferences on your account page. For browser permissions such as location, use your browser or device settings. For anything else, write to support@pravaasastays.com. Withdrawing consent does not affect processing that has already happened, and we may still need to keep data to meet legal duties or to complete an existing booking.
If we ever contact you through WhatsApp or SMS for marketing, we do so only after you have opted in and we keep a record of that choice.
7. How Long We Keep Your Information
We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires. When it is no longer needed, we delete it or make it anonymous.
Account and profile data: while your account is open, and for a short period after closure while we complete any pending bookings, refunds or disputes.
Booking, payment and invoice records: for the period required by Indian tax, accounting and company laws. This can be several years, as these records support invoices, audits and refunds.
Identity documents submitted for verification or check-in: for a limited period, which we aim to keep to about one year unless the law or a dispute requires longer.
Sign-in codes: one-time passwords and email link tokens are stored only as one-way hashes and expire in minutes.
Support, dispute and safety records: for as long as the case remains open and for a reasonable period afterwards, or longer if needed to defend legal claims or prevent repeat abuse.
Messages and reviews: reviews you publish stay on the property's page until removed under our policies. Messages between guests and hosts are retained for as long as needed for the booking, safety and disputes.
Backups may retain data for a short additional time before being overwritten.
8. How We Protect Your Information
We use reasonable technical and organisational safeguards to protect personal data. Examples of what we do include:
Strong sign-in controls: OTPs and email tokens are stored as hashes, expire quickly, allow a limited number of attempts, and are rate-limited. Optional two-factor authentication with an authenticator app is available, authenticator secrets are stored encrypted, and you can sign out of all sessions from your account page.
Payment safety: card and UPI details are entered in the payment partner's checkout, and the amount charged is calculated on our servers from the stored quote rather than accepted from your browser. Payment notifications from the provider are verified before we act on them.
Access controls: access to host and booking data is limited by organisation and role, sensitive administrative actions are recorded in an audit log, and uploaded images are checked before they are accepted.
No system is completely secure, and we cannot guarantee absolute security. Please keep your own device and sign-in methods safe and never share OTPs. If we become aware of a personal data breach that affects you, we will notify you and the relevant authority as the law requires.
9. Where Your Data Is Processed (Cross-Border Transfers)
Pravaasa is India-first and aims to keep personal data in India wherever practical. However, some of our service providers, such as sign-in, email, AI, messaging and cloud infrastructure providers, may process data on servers outside India.
The DPDP Act permits transfers of personal data outside India except to countries the Government of India restricts by notification. Where we transfer data abroad, we do so only to service providers who need it to provide the service, and we require them to protect it. If you have questions about a particular transfer, write to us at support@pravaasastays.com.
10. Children
The Platform is for adults. You must be at least 18 years old to create an account or make a booking. We do not knowingly collect personal data from anyone under 18 for their own account, and under the DPDP Act we would need verifiable parental or guardian consent to do so.
A parent or guardian may include children in a booking and may need to give their names, ages or identity details to the host for check-in. We use that information only to complete the stay, and we do not track or profile children or send them targeted advertising.
If you believe a child has created an account or given us personal data without proper consent, please contact us and we will delete it.
11. Your Rights
Under the DPDP Act, and as a matter of how we run the Platform, you have the following rights over your personal data.
11.1 What you can ask us to do
Access: ask for a summary of the personal data we process about you and the identities of the parties we have shared it with.
Correction and completion: ask us to correct inaccurate or incomplete data. You can edit your name, language and many profile details directly on your account page.
Erasure: ask us to delete your personal data when it is no longer needed for the purpose it was collected for, or when you withdraw consent, unless we must keep it by law, for an open booking or dispute, or to prevent fraud.
Withdraw consent: stop optional processing, for example marketing messages, as described in Section 4.
Grievance redressal: complain to us about how we handle your data and expect a response.
Nominate someone: nominate another person to exercise these rights on your behalf if you die or become unable to do so, as the DPDP Act allows.
11.2 How to make a request
Email support@pravaasastays.com from the email address or phone number linked to your account, or use the support page at /support, and tell us what you would like us to do. Writing with the subject "Privacy request" helps us route it quickly.
We will confirm your identity before acting, so that your data is not given to someone else. We aim to respond within 30 days. If we cannot do what you ask, for example because the law requires us to keep a record, we will explain why.
We do not charge a fee for reasonable requests. If a request is clearly repetitive or abusive, we may decline it and tell you why.
11.3 What deletion means in practice
If you ask us to delete your account, we will delete or anonymise your personal data unless we need to keep some of it. For example, we must keep booking and invoice records for tax and audit purposes, and a host may keep a copy of the booking details they received for their own legal obligations.
Reviews you have written may be kept in an anonymised form so that a property's reputation is not distorted. Content that is already with a host or a payment provider is held by them under their own policies.
12. Information About Other People
If you give us someone else's personal data, for example the names of people in your travelling group or a guest's details as a host, you confirm that you have the right to do so and that they know their details are shared with the host and with Pravaasa for the purposes described here.
Hosts must use guest information only to provide and manage the stay, comply with law, and handle disputes. Hosts must not use guest details for unrelated marketing without the guest's consent, share them with others, or use them to pressure or harass a guest. We may suspend hosts who misuse guest data.
13. Grievance Redressal and Contact
If you have a concern about how your personal data is handled, please write to our Grievance Officer through support@pravaasastays.com with the subject "Grievance", or contact us from the support page at /support. Please include your name, the contact details linked to your account and a clear description of your concern.
We will acknowledge your complaint and aim to resolve it within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is operational, or any other authority that has jurisdiction under Indian law.
14. Changes to This Policy
We may update this Privacy Policy as our services, providers or the law change. The "last updated" date and version history show what changed. If a change significantly affects how we use your personal data, we will tell you through the Platform or by email before it takes effect, and where the law requires it we will ask for your consent again.
Questions About This Policy?
Our customer support and legal compliance team is available to assist you.