Privacy Policy

This Privacy Policy explains how [COMPANY LEGAL NAME] ("StayCraft", "we", "us") handles personal data in connection with the StayCraft platform: the websites, and the tools for bookings, orders and enquiries, that we provide to small businesses ("Businesses"). They are homestays and other places to stay, paying-guest houses, vehicle rentals, taxi services, tour and activity operators, makers of local crafts, and newspapers. The people who use a Business's site are its "customers".

Our role. For a Business's own account and site content, StayCraft acts as the data fiduciary. For the personal data of customers that a Business collects through its StayCraft site (enquiries, bookings, orders, reviews), the Business is the data fiduciary and StayCraft acts as a data processor on the Business's behalf. Customers should also review the individual Business's own privacy notice where one is provided.

1. Personal data we handle

Customer data (collected through a Business's site)

• Name, phone number and email address.
• The dates you ask for and the number of people, where a form asks for them: for a stay, your check-in and check-out dates and the number of guests.
• Any message you send through an enquiry, booking, order or review form.
• Payment reference or a payment-confirmation screenshot you upload to confirm a booking or an order, where the Business asks for one.

Business-owner data

• Account details (name, email, login credentials) and the content you publish on your site.
• Subscription and payment records for your StayCraft plan.

Collected automatically

• Basic technical data (IP address, device/browser, pages viewed) and cookies.
• Aggregate analytics where a site has connected Google Analytics.

2. Why we use it

• To deliver bookings, orders and enquiries to the relevant Business and let it respond.
• To operate, secure and improve the platform.
• To process Businesses' subscriptions and keep records required by law (including tax).
• To communicate with you about your enquiry, booking, order or account.

3. Consent and legal basis

Where you submit an enquiry, booking, order or review, you consent to the processing described here. You may withdraw consent at any time (see Your rights), though we may still retain data where the law requires. We process data under the applicable law, including India's Digital Personal Data Protection Act, 2023.

When you tick the box on a booking, enquiry, review or partner-request form, the record of your request notes the date and time and the version of this policy you agreed to (shown at the top of this page), so that you and the business can both see what was agreed.

4. Cookies and analytics

Every site on StayCraft may set one small first-party cookie, sc_ft, for up to 90 days. It remembers how you first found the site (for example a search engine, a social link or a campaign tag on the link) so that the owner can see which source led to an enquiry or a booking. It holds no name or contact detail. On a site where the owner has connected Google Analytics, it is set only after you accept cookies there (see below). Otherwise we set essential cookies only, such as the one that keeps a signed-in owner signed in.

We count page views without cookies, using a one-way code made from your IP address and browser that changes every day and cannot be turned back into either.

Google Analytics (GA4). If a site's owner has connected Google Analytics, that site asks you first. Google Analytics, which sets its own cookies (_ga and similar) and sends information about your visit to Google, is loaded only after you press Accept; if you press Decline it is never loaded. Your choice is remembered in your browser for 12 months, and you can change it at any time from Cookie choices at the foot of the site. A site with no Google Analytics connected shows no cookie question.

On staycraft.co.in itself we load Google Analytics (which sets _ga cookies) only after you press Accept on the cookie notice. You can change your choice at any time from Cookie settings at the foot of any page; declining removes those cookies.

5. Sharing

We share customer data with the Business you are enquiring of, booking with or ordering from. We use trusted service providers (for hosting, email and analytics) who process data only on our instructions. We do not sell personal data. We may disclose data where required by law.

6. Payments

StayCraft does not operate a payment gateway for customers' bookings or orders; customers pay the Business directly (for example by UPI) and, where the Business asks for it, may upload a payment screenshot to confirm. We do not collect card or bank-account numbers from customers.

6A. The StayCraft owner app and notifications

[FOR THE LAWYER] Added for Google Play's Data safety form. Each statement below was checked against the code that stores devices, sends notifications and removes them, and against the Android app's permissions and libraries (it uses Firebase Cloud Messaging and no advertising or analytics library). The wording is for the lawyer to settle, with the Play form.

This applies to site owners and their staff who use the StayCraft Owner app (Android), or who allow notifications from their site's admin in a browser (including on an iPhone).

• The app opens your StayCraft admin on your phone and remembers on the phone which site you chose. What you enter or upload in it is handled as this policy describes for owner and guest data.
• If you allow notifications, your phone or browser gives your site an identifier for that install: on Android, a Firebase Cloud Messaging registration token (a random code for that app install); in a browser, a Web Push address and two keys. Your site keeps it with your login, the address of the site it registered from, the name your app or browser gives itself, the time it was last seen and whether the last alerts reached it. It is used only to send you alerts.
• Alerts travel through Google's Firebase Cloud Messaging service (Android) or your browser maker's push service, which handle the identifier on our instructions.
• An alert may name a guest. It never shows a phone number, an email, an address or an amount. On Android, alert text is hidden on a locked screen.
• The identifier is removed when you sign out on that device or switch sites, when the push service says it no longer works, when every alert to it has failed for 30 days, and when it has not been used for 180 days. You can also see and remove your devices yourself on the Notifications page of your admin.
• The app does not use your location or contacts, does not read your advertising ID, and contains no advertising or analytics.

You can ask for access, correction or erasure of this data as described in section 8.

7. How long data is kept

The business you dealt with (the business whose site you used) keeps your enquiry, booking, order, reservation or review for as long as its StayCraft account is active, and until it removes your details. Each business can remove a person's name, phone, email and address from its records with a Remove details button; it does this when you ask, and it can do so once nothing of yours is still open. Bills, invoices and a property's guest register are kept for the period the law requires and are not changed by a request to remove details. We hold that data for the business for as long as the business uses StayCraft, and we keep our own records of an owner's account and subscription as the law requires.

Some data is cleared automatically:

• website orders and table requests that were declined or that nobody answered: 90 days after they were made;
• our log of outgoing email: 30 days;
• page-view counts: 400 days (about 13 months).

Customer records that are not in the list above are not yet cleared automatically. We plan to build automatic limits for them before the duties of India's Digital Personal Data Protection Act, 2023 begin on 13 May 2027.

8. Your rights

Subject to applicable law, you may request access to, correction of, or erasure of your personal data, and may withdraw consent. To have your name, phone, email and address removed from a business's records, ask that business (its contact details are on its site and in your booking email); it can remove them from its records. You can also write to us at privacy@staycraft.co.in and we will pass your request on.

9. Grievance officer

For complaints about how your data is handled, contact our Grievance Officer: [GRIEVANCE OFFICER NAME], [GRIEVANCE OFFICER EMAIL]. We acknowledge a complaint within 24 hours and aim to resolve it within 15 days.

10. Children

The platform is not directed at children, and we do not knowingly collect their data without the consent required by law.

11. Changes

We may update this policy; the version number and the "last updated" date above show the current text.

12. Contact

[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email: privacy@staycraft.co.in. Governed by the laws of India.