Privacy policy

Last updated: October 2026

This policy explains what personal data [your business name] ("we", "StayVia") collects when you use this website, why, who sees it, how long we keep it and the rights you have. StayVia is an Indian company and handles your data as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 and its Rules.

What we collect

• Account details: your name and email address, and a password if you choose to set one (stored only as a one-way hash).
• Bookings: the stays you book, dates, guests, prices, payment status and any requests you add.
• Security records: sign-in attempts and account changes, including the IP address they came from, so we can spot and block abuse.
• Business details (optional): if you book for a company and give its GSTIN and legal name, we print them on your receipts and on our tax invoice, and keep them with your account until you remove them or delete the account. Invoices already issued keep them, as tax law requires.
• Your currency choice: if you pick a currency to view prices in, we keep it in your browser, and on your account if you are signed in. You are always charged in Indian rupees; if you have not chosen a currency we show US dollars.
• Messages with a hotel: what you write to the hotel of a stay you booked, and their replies, are kept with the booking so StayVia can help if something goes wrong. We don't share your email address or phone number with the hotel.
• Complaints: your name, email, the booking it is about and what you tell us, so our Grievance Officer can answer.
• If you list a property: your name, email, phone, the property's details and photo links, and the hotel's legal name, GSTIN, PAN and address for tax invoices and statements.
• Emails we send you: sign-in codes, confirmations, reminders, receipts and tax invoices.

We do not run advertising trackers or third-party analytics on this site.

Why we use it

To create and secure your account, take and manage your bookings and payments, pass the hotel what it needs to host you, answer messages and complaints, issue receipts and tax invoices, and meet our legal duties (for example tax records and lawful requests from authorities). When you create an account or book, we ask for your consent to these uses; you can withdraw it at any time by deleting your account, which stops future use but not what we must keep by law.

Visit statistics

To see how the site is used, our own server counts page visits and a few steps of booking: searching, viewing a stay, seeing a price, pressing Reserve and going to payment. Each count records the page or stay, the type of device, the website or campaign link that sent you, and what you searched for. It does not record your IP address, your account, or anything that identifies you, and it uses no cookies.

To count each visitor once a day, the server scrambles your IP address and browser type with a random value that changes every day and is then deleted, so visits can't be traced back to you or linked across days. Individual counts are deleted after 30 days; only daily totals are kept. If your browser sends a Global Privacy Control signal, nothing is counted.

Card payments

Card payments are taken on a payment page run by our payment provider. Your card number never reaches our servers; we keep only the amount, the payment status and the provider's reference for it.

Who we share it with

• The hotel you book: your name, dates, number of guests and any requests, so it can host you.
• Service providers who run parts of the site for us under contract: hosting, email delivery and card payments. Some of them may process data outside India; we only use them as Indian law allows.
• Authorities when the law requires, for example tax authorities.

We do not sell your personal data.

How long we keep it

• Your account while it is open and in use. If you have not signed in, booked or complained for three years, we email you, and erase the account 30 days later unless you sign in. Receipts and tax invoices stay as described below.
• Your agreement: when you create an account we keep the date, which version of the Terms and Privacy policy you agreed to, and that you confirmed you are 18 or over, for as long as the account exists.
• Receipts, tax invoices, credit notes, hotel statements and the booking and payment records behind them: for as long as Indian tax and company law requires (up to eight years). They keep the name and email they were issued to.
• Complaints: three years after they are closed.
• Security records: sign-in and account activity records for at least 180 days. If a security incident ever puts your personal data at risk, we tell you and the Data Protection Board of India, and report it to CERT-In.

Your rights

• See your data: Account → Download my data gives you a copy of what we hold about you and how it is used.
• Correct it: on the Account page, or ask us.
• Erase it: Account → Delete my account. Your personal details are removed; records we must keep by law are kept, anonymised where we can.
• Nominate someone to use these rights for you if you die or cannot: email us with their name and contact details.
• Complain: to our Grievance Officer first (see Complaints); if you are not satisfied with the answer, you may approach the Data Protection Board of India.

If you are in the European Union or the United Kingdom, you also have the rights your local data-protection law gives you; contact us to use them.

Children

You must be 18 or over to create an account or book. We do not knowingly collect data about children.

If something goes wrong

We protect your data with encryption in transit, restricted access and regular encrypted backups. If a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.

Contact

Questions about your data or this policy: our Grievance Officer, whose name and contact details are on the Complaints page, or [your contact email]