Privacy Policy

This Privacy Policy explains how Stay Craft India LLP ("StayCraft", "we", "us") handles personal data in connection with the StayCraft platform: the websites, and the tools for bookings, orders and enquiries, that we provide to small businesses ("Businesses"). They are homestays and other places to stay, paying-guest houses, vehicle rentals, taxi services, tour and activity operators, makers of local crafts, newspapers, and cafes and restaurants. The people who use a Business's site are its "customers".

Our role. For a Business's own account and site content, StayCraft acts as the data fiduciary. For the personal data of customers that a Business collects through its StayCraft site (enquiries, bookings, orders, reviews), the Business is the data fiduciary and StayCraft acts as a data processor on the Business's behalf. Customers should also review the individual Business's own privacy notice where one is provided.

1. Personal data we handle

Customer data (collected through a Business's site)

• Name, phone number and email address.
• The dates you ask for and the number of people, where a form asks for them: for a stay, your check-in and check-out dates and the number of guests.
• Any message you send through an enquiry, booking, order or review form.
• What you type to the AI helper in the chat box on a Business's website, where the Business has one, and its answers. Please do not type your name, phone number or other personal details into the chat; use the enquiry form for that. The words you type are sent to our AI provider, Anthropic, to write the answer, together with the Business's own published information. A conversation is deleted after 30 days.
• Payment reference or a payment-confirmation screenshot you upload to confirm a booking or an order, where the Business asks for one.

Business-owner data

• Account details (name, email, login credentials) and the content you publish on your site.
• Subscription and payment records for your StayCraft plan.

Collected automatically

• Basic technical data (IP address, device/browser, pages viewed) and cookies.
• Aggregate analytics where a site has connected Google Analytics.

2. Why we use it

• To deliver bookings, orders and enquiries to the relevant Business and let it respond.
• To operate, secure and improve the platform.
• To process Businesses' subscriptions and keep records required by law (including tax).
• To communicate with you about your enquiry, booking, order or account.

3. Consent and legal basis

Where you submit an enquiry, booking, order or review, you consent to the processing described here. You may withdraw consent at any time (see Your rights), though we may still retain data where the law requires. We process data under the applicable law, including India's Digital Personal Data Protection Act, 2023.

When you tick the box on a booking, enquiry, review or partner-request form, the record of your request notes the date and time and the version of this policy you agreed to (shown at the top of this page), so that you and the business can both see what was agreed.

4. Cookies and analytics

Every site on StayCraft may set one small first-party cookie, sc_ft, for up to 90 days. It remembers how you first found the site (for example a search engine, a social link or a campaign tag on the link) so that the owner can see which source led to an enquiry or a booking. It holds no name or contact detail. On a site where the owner has connected Google Analytics, it is set only after you accept cookies there (see below). Otherwise we set essential cookies only, such as the one that keeps a signed-in owner signed in.

We count page views without cookies, using a one-way code made from your IP address and browser that changes every day and cannot be turned back into either.

Google Analytics (GA4). If a site's owner has connected Google Analytics, that site asks you first. Google Analytics, which sets its own cookies (_ga and similar) and sends information about your visit to Google, is loaded only after you press Accept; if you press Decline it is never loaded. Your choice is remembered in your browser for 12 months, and you can change it at any time from Cookie choices at the foot of the site. A site with no Google Analytics connected shows no cookie question.

On staycraft.co.in itself a cookie notice asks once, and nothing below is set unless you press Accept:

• sc_gft, a first-party cookie on staycraft.co.in only, kept for 30 days. It remembers how you first found staycraft.co.in (the kind of source, such as a search engine, an AI assistant or a campaign tag on the link, the first page you opened and the date) so that, if you sign up within those 30 days, we can see where sign-ups come from. It holds no name, contact detail, IP address or visitor code, is never shared with a business's site, and is not updated after it is set.
• Google Analytics (which sets _ga cookies), when we have it switched on.

Your answer is remembered for 12 months in a small cookie, sc_consent. You can change it at any time from Cookie settings at the foot of any page; declining removes those cookies. If you decline, or never answer, we trace a sign-up only to a visit made the same day, using the cookieless count above.

5. Sharing

We share customer data with the Business you are enquiring of, booking with or ordering from. We use trusted service providers (for hosting, email and analytics) who process data only on our instructions. We do not sell personal data. We may disclose data where required by law.

6. Payments

StayCraft does not operate a payment gateway for customers' bookings or orders; customers pay the Business directly (for example by UPI) and, where the Business asks for it, may upload a payment screenshot to confirm. We do not collect card or bank-account numbers from customers.

6A. The StayCraft owner app and notifications

[FOR THE LAWYER] Added for Google Play's Data safety form. Each statement below was checked against the code that stores devices, sends notifications and removes them, and against the Android app's permissions and libraries (it uses Firebase Cloud Messaging and no advertising or analytics library). The wording is for the lawyer to settle, with the Play form.

This applies to site owners and their staff who use the StayCraft Owner app (Android), or who allow notifications from their site's admin in a browser (including on an iPhone).

• The app opens your StayCraft admin on your phone and remembers on the phone which site you chose. What you enter or upload in it is handled as this policy describes for owner and guest data.
• If you allow notifications, your phone or browser gives your site an identifier for that install: on Android, a Firebase Cloud Messaging registration token (a random code for that app install); in a browser, a Web Push address and two keys. Your site keeps it with your login, the address of the site it registered from, the name your app or browser gives itself, the time it was last seen and whether the last alerts reached it. It is used only to send you alerts.
• Alerts travel through Google's Firebase Cloud Messaging service (Android) or your browser maker's push service, which handle the identifier on our instructions.
• An alert may name a guest. It never shows a phone number, an email, an address or an amount. On Android, alert text is hidden on a locked screen.
• The identifier is removed when you sign out on that device or switch sites, when the push service says it no longer works, when every alert to it has failed for 30 days, and when it has not been used for 180 days. You can also see and remove your devices yourself on the Notifications page of your admin.
• The app does not use your location or contacts, does not read your advertising ID, and contains no advertising or analytics.

You can ask for access, correction or erasure of this data as described in section 8.

6B. People we send a quote to

[FOR THE LAWYER] Added for the Quotes feature (Operator, Billing, Quotes). Each statement was checked against the code (App\Services\Quotes, QuoteController and the quote page). Retention: Arun set twelve months without activity on 3 Oct 2026 (a daily job, Quotes::idle()); an accepted quote is kept until an operator deletes it. The lawyer settles the period and the wording.

This applies to a person a StayCraft operator has made a quote for, and who has opened it. If we send you a quote for a StayCraft plan, we keep:

• your name, your business's name, your email address and your phone number, as we were given them;
• the quote itself: the plan, the price, what it says and its dates;
• when you opened it and how many times. Only a count and the first and last time are kept, not your address or your device;
• if you press Accept: the name and email you type, the time, your IP address and browser type, and the versions of this policy and of the Owner Agreement you ticked.

We use these details to prepare your site, to contact you about the quote and to keep a record of what was offered and what you accepted. Accepting a quote does not create a site and does not charge you anything. We do not sell these details. We share them only with the service providers that host our systems and send our email. The quote page sets no analytics or advertising cookie and loads no third-party script; the form uses the ordinary session cookie that protects it.

If you do not accept the quote, we delete these details by themselves once nothing has happened to it for 12 months: counted from the latest of when it was made, sent, opened or changed, and the end of its last valid day. If you accept it, we keep them as the record of what you agreed until a StayCraft operator deletes them. An operator can delete them sooner; deleting blanks the name, business, email, phone, notes, and the IP address and browser type of an acceptance, and keeps the quote's number, plan, price and dates. To ask for yours to be deleted, write to privacy@staycraft.co.in.

6C. People who write to us from our contact page

[FOR THE LAWYER] Added for the contact form (staycraft.co.in/contact, Operator, Sites, Enquiries). Each statement was checked against the code (ContactController, FormGuard, ContactEnquiry). Retention: Arun set twelve months without activity on 17 Oct 2026, as for quotes (a daily job, ContactEnquiry::idle()). The lawyer settles the period and the wording.

This applies to a person who sends a message from the contact page of staycraft.co.in. Here StayCraft decides what is kept, not a Business. We keep:

• your name, your email address, your phone number and the kind of business, if you gave them, and your message;
• the page you wrote from, when it is one of ours, and the time you agreed to this policy and its version;
• a one-way code made from your network address, used only to count how many messages one network sends in an hour. Your address itself is not kept.

We use these details to answer you, by email or on WhatsApp if you left a number. We do not sell them. We share them only with the service providers that host our systems and send our email.

We delete your message and these details by themselves once nothing has happened to it for 12 months: counted from when you sent it or when we last marked it. A StayCraft operator can delete it sooner. To ask for yours to be deleted, write to privacy@staycraft.co.in.

6D. Offers and updates from a business you stayed with

[FOR THE LAWYER] Added for Offers to past guests (Marketing menu of a business on Growth and above). Each statement was checked against the code (MarketingConsents, the booking, enquiry and desk forms, OfferCampaigns, OfferMail, OfferUnsubscribeController, DetailRemovals and RetainGuestRecords). Retention follows section 7 (twelve months). The lawyer settles the wording and whether the policy's version should move.

This applies to a person who ticks "Send me offers and updates from [the business]" on a business's booking form or enquiry form, or who is asked in person at its front desk and says yes. The box is separate from agreeing to this policy and is empty until you tick it. If you do not tick it, the business does not send you offers or updates.

• For the business, we keep your name, email address, phone number and state if you gave them, the time you agreed and the exact words you saw beside the box.
• The business writes to you by email, sent from StayCraft's address with the business's name and its own address for your reply, or by a WhatsApp message the business itself sends from its own phone. StayCraft does not send WhatsApp messages.
• Every email has an unsubscribe link that works without signing in. After you use it, or if the business stops it for you, no more offers are sent unless you tick the box again.
• A guest is sent at most one offer in 30 days. For each offer we keep a line of the business's log: when it was sent to you, how (email or WhatsApp), whether you unsubscribed from it, and whether a booking of yours used its coupon code.
• We do not sell these details. We share them only with the service providers that host our systems and send our email.

These details, and the log of offers sent to you, are removed by themselves once you have not filled in a form on the business's site for 12 months, and when the business removes your details at your request (section 7). Your agreement goes with them: the business asks again at your next stay.

6E. Gifts to an organisation

[FOR THE LAWYER] Added for donations to NGOs and community organisations (Giving, the donations lane, 28 Oct 2026). Checked against the code (DonationController, Donations, DonationReceipts, Form10bd, DetailRemovals and RetainGuestRecords). The lawyer settles the wording, the period the tax law requires these records to be kept (said here as "as long as the tax law requires"), and whether asking citizenship is worded rightly for FCRA. A CA checks the receipt wording separately (D6).

This applies to a person who gives to an NGO, trust or other organisation through its StayCraft website, or whose gift the organisation records.

• For the organisation, we keep your name, email address, phone number and address, what you gave, when and how, what it was for, the receipt issued to you, and that you said you are an Indian citizen. If you ask for an 80G receipt we also keep your PAN, which is printed on the receipt and on the yearly statement of donations (Form 10BD) the organisation files with the Income Tax Department. Your PAN is asked only then, shown masked on the organisation's screens, and never put in a web address.
• An online gift is paid to the organisation's own Razorpay account: Razorpay handles your card or UPI details, not StayCraft. A UPI screenshot you upload is seen by the organisation only.
• Your receipt can be checked by anyone who has its code, on a page that shows the receipt number, the organisation, the amount, the date and your first name and initial; never your PAN, address, email or phone.
• Gifts, receipts and the name, address and PAN on them are tax records: they are kept as long as the tax law requires and are not cleared automatically. If you ask the organisation to remove your details, it removes your phone number and email address; the tax records stay.
• We do not sell these details. We share them only with the service providers that host our systems and send our email, and the organisation shares them with the Income Tax Department as the law requires.

6F. Members of a club, an association or an organisation

[FOR THE LAWYER] Added for members and their fees (NGOs & communities, stage 2, lane L1, 30 Oct 2026). Checked against the code (MemberController, MemberDues, CommunityMembers, DetailRemovals and RetainGuestRecords). The lawyer settles the wording, how long a register of members must be kept, and whether a parent or guardian's tick and name are verifiable consent for a child under the DPDP Act (section 9). A CA checks the receipt and tax invoice wording separately.

This applies to a person who asks to join a club, residents' welfare association, NGO or other organisation through its StayCraft website, or whom the organisation adds to its register of members.

• For the organisation, we keep your name, phone number, email address, the membership you chose, your member number, when you joined and until when you are paid up, and, for a residents' welfare association, your flat and whether you own or rent it. The organisation may add your photo for your member card, with your agreement. If you give your date of birth, we keep it.
• A person under 18 joins with a parent or guardian, whose name we keep with the time they agreed.
• We keep the fees raised for you, how and when you paid them, any UPI screenshot you upload (seen by the organisation only), and the receipt or tax invoice issued to you. An online payment is made to the organisation's own Razorpay account: Razorpay handles your card or UPI details, not StayCraft.
• You receive the committee's notices only if you ticked the box asking for them.
• Your member card has a code. Anyone with the code can see whether your membership is valid, with your first name, member number, type of membership and the date it is valid until; never your surname, phone, email, address, flat, photo or date of birth.
• The register of members and the fees paid are records the organisation keeps: they are not cleared automatically. If you ask the organisation to remove your details, it removes your phone number, email address, photo and date of birth; your name and number on the register, and your receipts, stay.
• We do not sell these details. We share them only with the service providers that host our systems and send our email.

6G. Monthly gifts and volunteers of an organisation

[FOR THE LAWYER] Added for campaigns, monthly giving and volunteers (NGOs & communities, stage 2, lane L2, 30 Oct 2026). Checked against the code (DonationController, GivingPledges, PledgeController, VolunteerController, Volunteers, DetailRemovals and RetainGuestRecords). The lawyer settles the wording and whether a parent or guardian's tick and name are verifiable consent for a volunteer under 18 under the DPDP Act (section 9).

This applies to a person who chooses to give to an organisation every month, or who signs up to volunteer, through its StayCraft website.

• A monthly gift is a promise, not a debit: nothing is taken from your account by itself. We keep the amount, the day of the month, the campaign it is for (if any), when you agreed, and when we last reminded you. Once a month we email you a link to give; each gift is handled as section 6E describes. You can pause or stop the reminders at any time from the link in every email, without signing in.
• Your monthly promise and the gifts given against it are kept with the organisation's other gift records (section 6E) and are not cleared automatically.
• If you sign up to volunteer, we keep for the organisation your name, phone number, email address, the skills and times you gave, any note, the hours you are recorded as giving, and when you agreed. A person under 18 signs up with a parent or guardian, whose name we keep with the time they agreed; if you give your date of birth, we keep it.
• A certificate of your hours has a code. Anyone with the code can see that it is genuine, with the organisation, your first name and initial, the hours, the period and who signed it; never your phone, email or date of birth.
• A volunteer's details are removed by themselves once the organisation has not marked them active or touched them for 12 months, and when the organisation removes them at your request. The hours stay without your details, and a certificate already issued keeps what it printed.
• We do not sell these details. We share them only with the service providers that host our systems and send our email.

6H. Notices, appeals and complaints to an organisation

[FOR THE LAWYER] Added for NGOs and community organisations, stage 2, lane L3 (30 Oct 2026). Checked against the code (CommunityNotices, FestivalAnnouncements, Complaints, ComplaintController, DetailRemovals and RetainGuestRecords). The lawyer settles the wording; sections 6F and 6G (members, campaigns and volunteers) come from the other lanes and sit before this one.

• An organisation writes its notices and appeals by email only to its members who asked for them when they joined, and to donors who ticked "Send me your updates and appeals" when they gave. That box is off until you tick it. Every email has a link to stop them; once you use it you are not written to again, and we keep only a one-way code of your email address so that it stays that way.
• For each notice we keep a log of who it went to (name, email or phone, when). It is cleared with your other details.
• If you raise a complaint or a request on an organisation's site, we keep, for the organisation, your name, your flat or member number if you give it, your phone number or email, what you wrote, a photo if you add one, its status and when it changed. A photo has its location and camera details removed when it is uploaded and is seen by the organisation only. The organisation emails you when its status changes. Its committee may keep a note on it, which is not shown to you.
• A complaint or request that is done is cleared by itself once nobody has touched it for 12 months, with its photo, and when the organisation removes your details at your request (section 7).
• We do not sell these details. We share them only with the service providers that host our systems and send our email.

6I. The books of a self help group

[FOR THE LAWYER] Added for self help groups' books, NGOs & communities stage 3, lane L1 (30 Oct 2026). Checked against the code (ShgMember, ShgMeetings, ShgSavings, ShgCashBook, ShgBoard, SiteBackup, TenantExport and DetailRemovals). The lawyer settles the wording; section 6J (loans and passbooks) comes from the other lane and follows this one.

• A self help group, or an organisation that keeps the books of self help groups, records on StayCraft each member's name (and in Hindi), her number and role in the group, her nominee and the nominee's relation to her, the day she joined and the day she left, and her phone number only if she gives it.
• For each meeting it records the date, who came, who was away or on leave, what each member saved, the group's cash in hand and in the bank, and the minutes in the group's own words. This is a record of what the group handled at its meetings: no money moves through StayCraft.
• The group's website may show its totals (members, meetings held, savings together), and the group can hide them. It never shows a member's name, phone number or amount.
• These are the group's books: they are not cleared automatically. A request to remove a member's details removes her phone number; her name and her savings stay in the books, as bills do (section 7). They are in the business's own download and in the export of its account.
• We do not sell these records. We share them only with the service providers that host our systems.

6J. Loans and passbooks of a self help group

[FOR THE LAWYER] Added for self help groups' books, NGOs & communities stage 3, lane L2 (30 Oct 2026). Checked against the code (ShgLoans, ShgBankLinkage, ShgPassbook, ShgGrading, ShgBooksController, SiteBackup and DetailRemovals). The lawyer settles the wording; section 6I (the group's members, meetings and savings) comes from the other lane and sits before this one.

• A self help group that keeps its books on StayCraft records, for each loan it gives a member, the amount, the purpose, the interest, the schedule of instalments and every repayment, with the date and the meeting. It also records the group's own loans from its bank and the funds it receives. This is a record of what the group handled at its meetings: no money moves through StayCraft.
• A member's passbook (her savings, loans and repayments) is printed by the group from these records. The group may send her a link to it; the link is private to that passbook, is not listed by search engines, and stops working after 7 days.
• The grading sheet a group takes to its bank shows the group's totals only, never a member's name or amount.
• Loan records are the group's accounts: they are not cleared automatically or by a request to remove details, as bills are not (section 7).
• We do not sell these records. We share them only with the service providers that host our systems.

6K. Sevas and prasad by post at a temple or religious trust

[FOR THE LAWYER] Added for temples and religious trusts, lane L2 (30 Oct 2026). Checked against the code (SevaSlips, SevaReceipts, SevaController, PrasadPost, SiteBackup, TenantExport and DetailRemovals). A seva slip shows a person's faith, gotra and family names, and prasad by post may go to an address abroad. The retention of paid slips and the wording of the faith data are for the lawyer to settle; section 6L (the hundi and annadan) comes from another lane and follows this one.

• When you offer a seva at a temple or religious trust through its website, the temple records your name, your gotra if you give it (it is never required), the names the seva is offered for if you give them, how many people will come, your phone number or email, the day and time, the offering and how you paid. This tells the temple your faith.
• If you ask for prasad by post, the temple also records the name and address it goes to, in any country, the postage, and the tracking number once it is posted, and emails you then.
• You pay the temple directly, through its own payment account or by UPI; StayCraft takes no part in the money. A seva is paid for a ceremony and its receipt is not a donation receipt.
• The temple's pujari sees the day's list (names, gotra and the names it is offered for) and the prasad to post, never amounts or contact details. The website and the receipt's public check never show your gotra or the family names.
• A paid seva is a money record: it is kept as bills are (section 7), and a request to remove your details does not remove it. A seva that was never paid or was cancelled is cleared like an enquiry once it has been untouched for the period in section 7. The address for prasad by post is removed once it has been posted and left untouched for the same period. These records are in the temple's own download and in the export of its account.
• We do not sell these records. We share them only with the service providers that host our systems.

6L. A temple's hundi counts, gifts in kind and annadan sponsors

[FOR THE LAWYER] Added for temples and religious trusts, lane L3 (30 Oct 2026). Checked against the code (HundiCounts, GiftsInKind, Annadan, AnnadanController, Donations, SiteBackup, TenantExport and DetailRemovals). The lawyer settles the wording; section 6K (sevas and prasad by post) comes from the other lane and sits before this one.

• A temple that counts its hundi on StayCraft records, for each count, the names of the people who counted it, checked it and were present. They are the temple's own committee or staff, named as the witnesses of a money record: their names are kept with the count, as a bill is kept (section 7).
• For a gift in kind (gold, silver, cloth, grain or anything else), the temple may record the name of the person who gave it, or record it as from nobody named. Its acknowledgement prints that name. The temple keeps its list of gifts in kind as a record of what it was given. The giver's name is removed when the temple removes your details at your request (section 7), and by itself once nobody has touched the entry for 12 months .
• If you sponsor an annadan, a bhandara or a langar on a temple's site, it is a gift to the temple: we keep, for the temple, your name, your email or phone number, the date you sponsor, the line you write ("in memory of …"), and, if you ask for an 80G receipt, your address and PAN, as section 6 describes for a gift. You pay the temple directly; no money passes through StayCraft.
• Your name is shown on the temple's website, on the date you sponsored, only if you tick that you agree. Otherwise the date shows as sponsored, with no name.
• We do not sell these records. We share them only with the service providers that host our systems and send our email.

7. How long data is kept

The business you dealt with (the business whose site you used) keeps your enquiry, booking, order, reservation or review for as long as its StayCraft account is active, and until it removes your details. Each business can remove a person's name, phone, email and address from its records with a Remove details button; it does this when you ask, and it can do so once nothing of yours is still open. Bills, invoices and a property's guest register are kept for the period the law requires and are not changed by a request to remove details. We hold that data for the business for as long as the business uses StayCraft, and we keep our own records of an owner's account and subscription as the law requires.

Some data is cleared automatically:

• website orders and table requests that were declined or that nobody answered: 90 days after they were made;
• our log of outgoing email: 30 days;
• conversations with the AI helper on a Business's website: 30 days (an enquiry you choose to send from the chat keeps its own copy of the chat, under the enquiry rule below);
• page-view counts: 400 days (about 13 months).
• an enquiry, request, order or reservation that is finished and that nobody has touched for 12 months: the name, phone, email and address on it are removed, and any payment screenshot is deleted. A person's entry in the business's directory of customers is cleared when they have not been seen for as long and nothing of theirs is still open.

This does not change bills, invoices, gifts and their receipts (section 6E), a register of members (section 6F) or a register the law requires a business to keep, and it never touches a record that is still open (an order not yet delivered, a bill not yet paid, a visit not yet over). The duties of India's Digital Personal Data Protection Act, 2023 begin on 13 May 2027; this limit is how a business's customer records meet them without anyone having to remember.

8. Your rights

Subject to applicable law, you may request access to, correction of, or erasure of your personal data, and may withdraw consent. To have your name, phone, email and address removed from a business's records, ask that business (its contact details are on its site and in your booking email); it can remove them from its records. You can also write to us at privacy@staycraft.co.in and we will pass your request on.

If you own a site on StayCraft, or work at one, Deleting your StayCraft account explains how to have your account and its data deleted, what we keep, and for how long.

9. Grievance officer

For complaints about how your data is handled, contact our Grievance Officer: [GRIEVANCE OFFICER NAME], [GRIEVANCE OFFICER EMAIL]. We acknowledge a complaint within 24 hours and aim to resolve it within 15 days.

10. Children

The platform is not directed at children, and we do not knowingly collect their data without the consent required by law.

11. Changes

We may update this policy; the version number and the "last updated" date above show the current text.

12. Contact

Stay Craft India LLP, [REGISTERED ADDRESS]. Email: privacy@staycraft.co.in. Governed by the laws of India.