Privacy Policy

Summary

This summary is here to help you find your way. It does not replace the full policy below, and only the full policy is binding.

• Who we are. Stayantra is run by two companies: [Pending: UK company legal name] in the United Kingdom and [Pending: Nepal Stayantra company legal name] in Nepal. For the marketplace, the Stayantra Go app, Stayantra Rewards, reviews, our websites and our marketing, they are joint controllers of your data. You can exercise your rights against either of them.
• Hotels control their own records. When a hotel uses the Stayantra hotel system to run its business (check-in, ID scans, guest chat, staff records), that hotel is the controller. We process that data for the hotel, on its instructions, as its processor.
• AI is involved, and we tell you where. Our AI assistant, Exubee, sends text (and, for document scanning, images) through OpenRouter to companies that run AI models. We allow only companies that keep no copy of the request and do not train on it, and never companies based in China. We explain what is sent, why, and your right to a human.
• We do not sell your data. We do not sell or share personal data for cross-context behavioural advertising. We use no advertising cookies and no advertising IDs.
• Your rights apply wherever you live. Everyone can ask to see, correct, export or delete their data, object to processing, and withdraw consent. You can delete your account in the app or at https://stayantra.com/delete-account.
• Some records must be kept. Tax, invoice and guest-register records are kept for at least 7 years because the law requires it, even after you delete your account.
• We verify every hotel. Before a hotel goes live we check its business documents and its owner's identity (KYC). We keep them for 5 years after the hotel leaves Stayantra (section 4.4).
• Contact. Email info@stayantra.com with any privacy question or request.

1. Who we are and how to contact us

1.1 The Stayantra companies

In this policy, "Stayantra", "we", "us" and "our" mean the two companies that operate the Stayantra service:

Together we call them "the Stayantra companies".

Joint controllers. For platform data (marketplace and Stayantra Go accounts, Stayantra Rewards, referrals, publication of reviews, our websites, our marketing and our security records), the two Stayantra companies decide together why and how your data is used. They are joint controllers under Article 26 of the GDPR and UK GDPR. They have agreed between themselves who handles which duty: the company that serves you (see the table above) answers your requests and notices first, but you may contact either company and exercise any of your rights against either of them. Data moves between the two companies under an intra-group data sharing agreement that uses the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

Our developer. The Stayantra service, including Exubee, was developed by Nexalaris Tech Pvt. Ltd., a company in Nepal. Nexalaris Tech Pvt. Ltd. is not a controller of your data and is not a party to your contract with us. Nexalaris Tech Pvt. Ltd. provides development, AI operations and support for Exubee and the platform. Where its engineers need access to personal data for that work, Nexalaris Tech Pvt. Ltd. acts as our service provider (processor) under a written agreement, is bound by confidentiality, and may use the data only on our instructions. It is listed on our sub-processor list.

1.2 How to reach us

• Privacy questions and requests: email info@stayantra.com
• General enquiries: email info@stayantra.com or phone [Pending: Customer phone number]
• Security reports: email info@stayantra.com
• Grievance officer (Nepal and India): [Pending: Grievance officer name], email info@stayantra.com, postal address [Pending: Grievance officer postal address]
• Post: to either registered office shown above

EU representative. Because the Stayantra companies are not established in the European Union, we have appointed a representative under Article 27 of the GDPR: [Pending: EU representative (GDPR Art. 27 / DSA Art. 13)]. You and EU supervisory authorities can contact the representative about any matter concerning our processing of personal data.

UK regulator. [Pending: UK company legal name] is registered with the UK Information Commissioner's Office under registration number [Pending: UK ICO data protection registration number].

We have not appointed a data protection officer because we are not required to. Our privacy team at info@stayantra.com handles all data protection matters.

2. What this policy covers

This policy covers every Stayantra product and every person whose data we handle:

• the Stayantra marketplace at marketplace.stayantra.com and the guest app Stayantra Go for iOS and Android;
• our website stayantra.com, our documentation site docs.stayantra.com, and hotel websites built on Stayantra;
• the Stayantra hotel system: the web dashboard at app.stayantra.com and the staff app Stayantra Connect;
• our AI assistant Exubee, in every place it appears;
• our public AI and agent interfaces (MCP, A2A and UCP endpoints) that let outside AI assistants search and book on a guest's behalf, or let hotel staff connect their own assistant;
• Stayantra Rewards, our points programme, and our referral programmes;
• our emails, WhatsApp and push notifications, and our social media pages.

It covers guests and marketplace and Stayantra Go users; hotel owners, managers and staff; business customers such as companies, travel agents and suppliers whose contacts appear in the hotel system; website visitors; and people who contact us about jobs, investment or our waitlist.

This policy does not cover the privacy practices of hotels themselves, outside AI assistants you choose to connect, online travel agencies, or payment providers. They have their own policies.

3. When we are the controller and when the hotel is

This is the most important distinction in this policy, because it tells you who to ask when you want to exercise your rights.

3.1 Where the hotel is the controller and we are its processor

A hotel that uses the Stayantra hotel system decides why and how it uses the data it keeps about its guests and staff. For that data, the hotel is the controller and Stayantra is its processor. We process it only on the hotel's documented instructions, under our Data Processing Addendum. This includes:

• reservations, stays, folios and invoices the hotel manages in its system (including bookings that came from the marketplace, once the hotel holds them);
• check-in records, the guest register, and ID document scans and the details read from them (this does not include a guest's own saved ID document on their Stayantra profile, section 3.2, unless and until the guest shares it with the hotel at check-in);
• the guest's profile at that hotel, including preferences, and AI web profiling the hotel's staff trigger (see section 7.4);
• in-stay chat between a guest and the hotel, WhatsApp messages sent through the hotel's own WhatsApp Business account, and complaints raised with the hotel;
• the hotel's staff records: names, contacts, roles, shifts, tasks, task photos, payroll records and performance ratings;
• the hotel's business contacts, such as corporate accounts, travel agents and suppliers.

If you are a guest or a hotel employee and want to access, correct or delete this kind of data, please contact the hotel first. If you contact us, we will pass your request to the hotel without delay and help the hotel answer it. We will not decide on it ourselves unless the law requires us to.

3.2 Where we are the controller

The Stayantra companies are the controllers, jointly as described in section 1.1, for:

• your marketplace and Stayantra Go account, and the searches, bookings and payments you make through them;
• the ID document you choose to save to your own Stayantra profile for faster check-in (the ID vault, section 4.1) — while it sits on your profile, we are its controller, not a hotel's processor;
• Stayantra Rewards points and our referral programmes;
• publishing reviews on the marketplace;
• conversations with Exubee on the marketplace and in Stayantra Go;
• our websites, cookies and analytics;
• our own marketing, newsletters and social media;
• the accounts of hotel owners and staff who sign in to Stayantra, to the extent we need them to provide, secure and bill the service;
• billing hotels for their subscriptions, and our business relationship with them;
• verifying hotels before they go live (business verification, "KYC", section 4.4);
• security, fraud prevention, abuse handling and our legal records;
• job applications, investor enquiries and waitlist sign-ups.

When you book a hotel through the marketplace, both the hotel and we receive your booking. We are the controller of our copy, which we use to run the marketplace. The hotel is the controller of its copy, which it uses to provide your stay.

4. The data we collect

4.1 Data you give us

• Account data: your name, email address, phone number, password (we store only a secure hash of it, never the password itself), date of birth if you choose to give it, preferred language, and the identifiers Google or Apple give us if you sign in with them.
• Booking and payment data: dates, rooms, guest numbers, amounts, special requests, and the payment route you choose. If you ask for a tax invoice, the buyer name, PAN and address. If you ask for a refund to a wallet or bank, the eSewa, Khalti or Fonepay ID or bank account details you give us.
• Check-in and ID data: the details on your ID document and an image of it, when a hotel asks you to provide them. Separately, you can choose to save an ID document to your own profile in the Go app or on the marketplace ("Save to my profile for faster check-in") — this is off by default and only happens when you upload it yourself; a document a hotel scans at the desk is never saved to your profile this way. Only you can see your saved ID document. A hotel receives a copy of it only when you choose "Use my saved ID" at check-in, and that copy then becomes the hotel's own record (section 3.1).
• Messages: what you write in chat with a hotel or with Exubee, emails you send us, and what you tell us in a complaint.
• Voice: if you speak to Exubee, your voice recording is sent to be transcribed into text. We keep the text and do not store the audio.
• Photos: a profile photo, photos you attach to a complaint as evidence, and (for hotel staff) photos taken as evidence that a task is done.
• Reviews and ratings you write after a stay.
• Preferences: things you tell us or Exubee, such as dietary needs, allergies, accessibility needs, or room preferences. Some of these can reveal health information or, for example through dietary choices, your religious beliefs. We treat them as sensitive (see section 5.2).
• Marketing choices: whether you have agreed to receive emails, WhatsApp messages from a hotel, or push notifications.
• Business and staff data: for hotel users, your role, shifts, tasks and work contact details; for business customers, company names, contact people, PAN and billing details.
• Enquiries: what you send us when you apply for a job, contact us as an investor, or join a waitlist.

4.2 Data we collect automatically

• Device and technical data: IP address, browser and device type, operating system, app version, language settings, pages and screens viewed, and error reports. Error reports are scrubbed of personal data before they leave our systems wherever we can do so.
• Approximate location: the country and city we work out from your IP address. We use it to show prices in a sensible currency and to choose which city's featured hotels to show you.
• Precise location: only when you tap "near me" or allow location access in Stayantra Go. We round the coordinates and send them to our servers to find nearby hotels. We do not store them in your profile.
• Push notification tokens for your device, if you allow notifications.
• Cookies and similar technologies: see our Cookie Policy.
• Security and rate-limit logs: records of requests, used to stop abuse. Rate-limit records last about 20 minutes.

4.3 Data we receive from others (Article 14 GDPR)

Some data comes to us from someone other than you. The sources are:

4.4 Business verification of hotels (KYC)

Before a hotel can go live on Stayantra (be listed, take online bookings, connect to online travel agencies, take online payments or receive payouts), we check that it is a real, lawful business. This is often called "know your customer", or KYC. The Stayantra company that serves the hotel (section 1.1) is the controller of this data.

• What we collect: the hotel's legal and trading names, registration number, PAN or VAT number, registered address, operating licence number and its expiry date; the name and role of the owner or authorised signatory; and copies of the business registration, the tax registration, the operating licence, the signatory's identity document (citizenship certificate, passport or national ID), an authorisation letter when the signatory is not the registered owner, and a photo of the premises. When our installation team captures the documents at the hotel, we also record when and roughly where the capture was made. Photos uploaded from a phone have their location and camera details removed.
• Why: to stop fake or fraudulent hotels reaching guests, to meet our legal obligations for the payments and payouts we handle for hotels, and to keep a record that each hotel was checked. Our legal bases are legal obligation (6(1)(c)) and our legitimate interests (6(1)(f)) in a marketplace guests and hotels can trust.
• Who sees it: the hotel's owner and co-owners, and the Stayantra staff who review it. The hotel's managers and other staff cannot see it. The documents are stored privately and opened only through links that expire after a few minutes; each time a Stayantra reviewer opens one, we record who and when. A capture made by our installation team is always checked by a different Stayantra person.
• How long: while the hotel uses Stayantra and for 5 years after it leaves, then deleted.
• Erasure: we must be able to show that a hotel was verified, so we keep these records for that period even if the owner or signatory asks us to erase their personal data. We will tell you when this exception applies, and we delete the records as soon as the period ends.

5. Why we use your data and our legal basis

5.1 Purposes, legal bases and retention

The GDPR and UK GDPR require us to have a legal basis for each purpose. The table below applies where the Stayantra companies are the controller. Where the hotel is the controller (section 3.1), the hotel chooses the legal basis, and our Data Processing Addendum governs our processing.

Where we rely on legitimate interests, we have weighed our interests against your rights and concluded that the processing is fair. You can ask us for that balancing test, and you can object at any time (section 13).

Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawing consent does not affect processing that already happened.

5.2 Sensitive data

Some information you share can be special category data under Article 9 of the GDPR and UK GDPR, or sensitive information under Nepal's Individual Privacy Act 2075 (2018): for example allergies and other health needs, accessibility needs such as using a wheelchair, and dietary preferences that can indicate your religion.

We process this kind of data only with your explicit consent. We ask for it when you add such details to your profile, or when Exubee offers to remember something sensitive you said. You can see these details in your profile, ask Exubee what it remembers, and delete them or withdraw your consent at any time. If you withdraw consent, we stop using the data and delete it, and you can still use Stayantra; the hotel simply will not know your preference in advance.

When a hotel records this kind of data in its own system, for example because you told reception about an allergy, the hotel is the controller and is responsible for having a lawful basis.

We do not ask for, and ask you not to share, data about your political views, sexual life or orientation, genetic or biometric data. Stayantra Go can use your phone's Face ID or fingerprint unlock to open the app; this check happens entirely on your device and we never receive your biometric data.

5.3 Nepal: consent under the Individual Privacy Act

Nepal's Individual Privacy Act 2075 (2018) requires consent before personal data is collected, and use only for the purpose for which it was collected (section 12), and forbids giving personal data to others without consent except in the cases the law allows (section 26). By reading this policy and creating an account or making a booking, you give your consent to our collecting and using your data for the purposes set out in section 5.1, and to our sharing it with the recipients listed in section 9, for those purposes only. Where this policy asks for separate or explicit consent (for sensitive data, marketing and precise location), we ask for it separately and you are free to say no. We disclose data to authorities without your consent only where Nepal law permits it, such as a written demand from an authorised official in a criminal investigation or a court order.

6. Payments

Card payments are entered on Stripe's own secure pages. Wallet payments happen on eSewa, Khalti or Fonepay. We never see or store your full card number. We receive only what we need to confirm and reconcile the payment: the amount, status, a transaction reference, the last digits of a card where the provider shares them, and the payer's name where the provider shares it.

If you choose Pay with Stayantra, we collect the money as the hotel's limited payment-collection agent and remit it to the hotel. If you choose Pay the hotel directly, you pay the hotel's own account and we never hold your money; the hotel tells the system when it has received the payment. If you choose Pay at the hotel, you pay on arrival. See our Payments, Cancellations and Refunds policy.

Refunds are always decided and sent by a person at the hotel, or, if the hotel fails to refund a Pay with Stayantra booking on time while we still hold the money, by a person at Stayantra. If you give us wallet or bank details for a refund, we use them only for that refund. When you ask us to erase your data, we mask those details.

7. Artificial intelligence and Exubee

Exubee is the AI assistant built into Stayantra. It answers guests on the marketplace, in Stayantra Go and in hotel chat, and helps hotel staff run the hotel. When you talk to Exubee, we tell you that replies are generated by AI. You can always ask for a person: on a hotel's chat, a member of hotel staff takes over; on the marketplace, you can contact our support at info@stayantra.com.

Read more on our AI Transparency page.

7.1 Which AI providers we use and what they receive

We use paid API access to AI models. All model calls go through OpenRouter (United States). OpenRouter sends each request to a hosting provider: a company that runs the model on its own servers. The company that developed a model and the company that runs it are often different. With every request, we instruct OpenRouter to:

• use only hosting providers that OpenRouter lists as zero data retention, meaning they do not store the request or the answer and do not use them to train models;
• skip any hosting provider that may collect or store data;
• never use a hosting provider based in China. This includes the developers' own services from DeepSeek, Moonshot AI and Alibaba.

If no hosting provider that meets these rules is available for a model, the request moves to our next model or fails. It is never sent to a hosting provider that does not meet them.

DeepSeek and Kimi are open-weight models: their developers publish them so that other companies can run them. We use them only as run by hosting providers outside China, so your data is not sent to DeepSeek, Moonshot AI or Alibaba.

OpenRouter's speech-to-text service does not accept these instructions. For voice, we therefore use a model whose only hosting providers, DeepInfra and Groq, are both on OpenRouter's zero data retention list.

What we send depends on the task:

• Chat: the message you wrote, the conversation so far, and the context Exubee needs to answer, such as your booking details, the hotel's information and preferences you asked Exubee to remember.
• Voice: your recorded speech, to be transcribed into text.
• ID and receipt reading: the image of the document, so that its fields can be read automatically.
• Hotel staff tasks: the business data needed for the task, which can include guest names and booking details.

The hosting providers process the data only to give us the answer. Under zero data retention they do not store it and do not train on it. OpenRouter treats short-lived caching in a server's memory as not storing. OpenRouter keeps records of each request, such as the time, the model and the cost, and its policy is not to keep the content of requests unless a customer turns on prompt logging. The public web search used for guest web profiling (section 7.4) is run by a search provider through OpenRouter, and zero data retention does not cover that search. We do not use your personal data to train AI models that are sold or offered to anyone outside Stayantra.

Most of these providers are in the United States. A US company is covered by the UK and EU adequacy findings only if it is certified under the Data Privacy Framework. Section 10 explains how we protect these transfers.

7.2 ID document reading

Hotels may ask to see your ID at check-in. In Nepal, hotels must keep a guest register for the police, and must record foreign guests' details in the government's immigration system. When hotel staff scan your ID in Stayantra, the image is stored securely and sent to Google's Gemini model, run by Google Cloud, to read the fields (such as name, document number, nationality and date of birth), so that staff do not have to type them. Staff check the result. Stayantra does not submit your details to the police or to immigration. Hotel staff do that themselves, as the law requires.

The hotel is the controller of check-in records. ID images and the fields read from them are kept for 7 years after the stay and then deleted, or deleted at once if you have your data erased. Identity details in the police guest register are kept for 7 years, even after erasure, and then redacted.

7.3 AI memory

On the marketplace and in Stayantra Go, Exubee can remember preferences you state in conversation, such as "I am allergic to peanuts" or "I use a wheelchair", so that you do not have to repeat them. Sensitive preferences are remembered only with your explicit consent (section 5.2). You can ask Exubee what it remembers, see these details in your profile, and ask for any of them to be deleted.

7.4 Guest web profiling by hotels

A hotel's staff can ask Exubee to search the public web for information about a guest who is about to arrive, using the guest's name, city, nationality and employer. The aim is to find public professional information, such as a job title or a company, so that the hotel can personalise its welcome. The search runs through OpenAI's GPT-4o mini model, run by Microsoft Azure. The search query itself, which contains the guest's name and the details above, is run by a web search provider through OpenRouter.

• The hotel is the controller of this profiling; Stayantra is its processor.
• The profile is kept for 2 years.
• It never uses sensitive data, and it never decides whether you can book or what you pay.
• You have the right to object. If you object, the hotel must stop and delete the profile. You can object to the hotel directly or by emailing info@stayantra.com, and we will make sure the hotel receives your objection and help it act on it.

7.5 Hotels' use of AI

Hotels can let Exubee propose actions such as price changes, marketing posts and replies. In Co-Pilot mode, a person at the hotel approves each action. In Auto-Pilot mode, which a hotel can switch on for one area at a time only after a track record of approved decisions and an explicit opt-in, Exubee acts within limits we set, and any breach of those limits returns it to Co-Pilot. Every AI action is recorded in an audit log the hotel can see. Exubee never issues refunds and never sends WhatsApp messages.

8. Automated decisions and profiling

Article 22 of the GDPR and UK GDPR gives you the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. None of our automated processing makes such a decision without a person reviewing it. Here is where we use automated scoring or profiling, how it works, and what you can do.

You have the right to ask for a person to review any of these outcomes, to express your point of view, to contest the outcome, and to object to profiling. For outcomes in the hotel system, ask the hotel; we will help. For marketplace outcomes, email info@stayantra.com.

9. Who we share your data with

We share personal data only as described here.

• Hotels. When you book or enquire, the hotel receives your booking and the profile details it needs for your stay: name, contact details, dates, room, special requests, payment status, and preferences you chose to share. The hotel then uses your data as its own controller, under its own privacy notice.
• Service providers (processors and sub-processors). Companies that host our systems, send emails and notifications, run AI models, monitor errors, and similar. They act on our instructions under written contracts. The full list, with locations, is on our sub-processor list.
• Our developer, Nexalaris Tech Pvt. Ltd.. For development, AI operations and support of Exubee and the platform, as our processor, under confidentiality (section 1.1).
• The other Stayantra company, as joint controller (section 1.1).
• Online travel agencies. When a hotel connects its rooms to online travel agencies through our channel manager partner Channex, booking data flows between the hotel's system and those agencies (such as Booking.com, Agoda, Expedia, Airbnb and Trip.com). For a booking you made on one of those sites, that agency is its own controller.
• Payment providers: Stripe, eSewa, Khalti and Fonepay, to take payments and make refunds. They act as independent controllers for their own legal duties, such as anti-money-laundering checks.
• Meta. Only for hotels that connect their Facebook, Instagram or WhatsApp Business accounts: posts the hotel publishes, and WhatsApp messages the hotel sends to guests who opted in, go through Meta's services.
• Co-payers and people you book for. If you split a payment, the other co-payers see the booking and their own share. If someone books for you, they see the booking they made.
• Other travellers, when your review is published. We show your first name and the first letter of your last name, and never your contact details.
• Outside AI assistants you connect. If you ask an outside AI assistant (such as ChatGPT or Claude) to search or book on Stayantra for you, or a hotel connects its own assistant, the data passes to that assistant, which processes it under its own terms and privacy policy. We are not responsible for how that assistant uses it.
• Authorities. Hotels, not Stayantra, report guests to the police and immigration as the law requires. Stayantra discloses data to courts, police, regulators or tax authorities only when the law requires it, under valid legal process, and only what the request lawfully covers. Where we are allowed to, we tell you first. See our Law Enforcement Guidelines.
• Professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality.
• Business transfers. If all or part of a Stayantra company is sold, merged or reorganised, your data may pass to the buyer or successor, who must keep protecting it as this policy describes. We will tell you before your data becomes subject to a different privacy policy.

9.1 We do not sell your data

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We have not done so in the past 12 months. We use no advertising cookies, no Meta Pixel, no Google Analytics, and no advertising IDs in our apps. More at https://marketplace.stayantra.com/do-not-sell.

9.2 California disclosure

In the past 12 months we have collected the following categories of personal information listed in the California Consumer Privacy Act, for the business purposes described in section 5, and disclosed them to the categories of recipients in section 9. We sold or shared none of them.

We use sensitive personal information only for the purposes the CCPA permits without offering a right to limit, such as providing the service you asked for and verifying identity at check-in. You may still ask us to limit its use (section 13.4).

10. International transfers

Stayantra operates across several countries. Your data may be processed in:

• Nepal, where [Pending: Nepal Stayantra company legal name] and our developer Nexalaris Tech Pvt. Ltd. are based;
• the United Kingdom, where [Pending: UK company legal name] is based;
• the European Union, through our representative and some service providers;
• Australia, where our main database is hosted (Sydney);
• Singapore, where some of our servers run;
• the United States, where many of our service providers are based, including OpenRouter, most of the companies that run AI models for us, Google and Nomic;
• other countries outside China where some companies that run AI models for us are based, such as Sweden and Spain.

We are honest that some of these countries do not have an "adequacy" decision from the UK or the EU, meaning those authorities have not found that they protect personal data to an equivalent standard. This includes Nepal. Where UK or EU data goes to a country without adequacy, we use:

• the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, for data from the UK;
• the EU Standard Contractual Clauses, for data from the European Economic Area;
• the UK Extension to the EU-US Data Privacy Framework and the Framework itself, where a US provider is certified under it;
• the provider's own data processing terms, which include these clauses, where the provider offers them;
• supplementary measures such as encryption in transit, sending only the data a task needs, and removing identifiers where the task allows.

In a few cases, a transfer may be necessary to perform your contract, for example sending your booking to a hotel in Nepal you chose (Article 49(1)(b) of the GDPR). You can ask for a copy of the safeguards we use by emailing info@stayantra.com.

11. How we protect your data

We use technical and organisational measures appropriate to the risk, including:

• encryption of data in transit using TLS;
• encryption at rest by our hosting providers;
• additional AES-256-GCM encryption of integration credentials, such as the tokens that connect a hotel's Facebook, Instagram or WhatsApp account;
• passwords hashed with bcrypt, and refresh tokens and API keys stored only as hashes;
• database row-level security that keeps each hotel's data separate from every other hotel's;
• an append-only audit log of AI actions that cannot be edited or deleted;
• two-factor authentication for Stayantra administrators, and staff access on a least-privilege basis;
• scrubbing personal data from error-monitoring reports.

We do not hold ISO 27001, SOC 2 or PCI DSS certification. Card details are handled only by our payment providers, on their own pages.

No system is perfectly secure. If a personal data breach happens that is likely to result in a risk to you, we will notify the relevant regulator within 72 hours of becoming aware of it where the law requires, and tell you without undue delay where the risk to you is high. Where we act for a hotel, we notify the hotel without undue delay and within 48 hours, so that it can meet its own duties. See our Security page. To report a vulnerability, email info@stayantra.com.

12. How long we keep your data

We keep personal data only as long as we need it for the purposes in this policy, or as long as the law requires.

When a retention period ends, we delete or anonymise the data. Anonymised data no longer identifies you and may be kept for statistics.

13. Your rights

13.1 Rights for everyone

We apply the strictest standard everywhere. Wherever you live, you have the right to:

• access your personal data and receive a copy;
• correct data that is wrong or incomplete;
• delete your data ("the right to be forgotten");
• restrict our processing while a question is resolved;
• portability: receive data you gave us in a structured, machine-readable format, or have it sent to another company where that is technically possible;
• object to processing based on legitimate interests, and to direct marketing at any time, without giving a reason;
• withdraw consent at any time, without affecting earlier processing;
• not be subject to solely automated decisions with legal or similarly significant effects, and to ask for human review (section 8);
• complain to a regulator or court (section 13.5).

Nepal's Electronic Commerce Act 2081 (2025) (section 12) requires us to keep your details confidential, and you can view, change or close your details at any time: in your profile, in the app, or by writing to us.

These rights have limits the law sets. For example, we cannot delete records we must keep for tax purposes, and we cannot give you data that would reveal someone else's personal data.

13.2 India

If you are in India, you have the rights given by the Digital Personal Data Protection Act 2023, including access to a summary of your data and who it was shared with, correction, completion, updating and erasure, grievance redress, and nominating another person to exercise your rights if you die or become unable to. Our grievance officer is [Pending: Grievance officer name], email info@stayantra.com. We acknowledge every grievance and give it a reference number within 1 business day (and never later than 48 hours), and send a written, reasoned decision within 15 days, well inside the 90 days the law allows. If you are not satisfied, you may complain to the Data Protection Board of India after using our grievance process.

13.3 Nepal

If you are in Nepal, you can complain to us or to our grievance officer. Under the Electronic Commerce Act 2081 (2025), we register your grievance at once: we acknowledge it and give it a reference number within 1 business day (and never later than 48 hours), and send you a written, reasoned decision within 15 days. Under the Individual Privacy Act 2075 (2018), you may also complain to the District Court about a breach of your privacy, within three months of the act, and claim compensation for harm. See our Complaints and Grievances page.

13.4 California and other US states

If you are a California resident, you have the right to:

• know what personal information we collect, use and disclose, and to receive a copy;
• delete personal information we collected from you;
• correct inaccurate personal information;
• limit the use of sensitive personal information;
• opt out of sale or sharing: we do not sell or share, but you may still tell us, and we honour Global Privacy Control signals as an opt-out;
• non-discrimination: we will not deny you service, charge you a different price or give you a different quality of service because you exercised a right.

You may use an authorised agent to make a request. We will ask the agent for your signed permission, and may ask you to verify your identity directly. Residents of other US states with privacy laws have similar rights, and we honour them in the same way.

13.5 Complaints to regulators

We would like the chance to resolve your concern first, so please contact info@stayantra.com. You also have the right to complain to:

• the UK Information Commissioner's Office (ico.org.uk), if you are in the UK;
• the data protection supervisory authority in the EU country where you live, work or where the issue happened;
• the Data Protection Board of India, after our grievance process, if you are in India;
• the District Court or other competent authority in Nepal, if you are in Nepal;
• the regulator in your own country, anywhere else.

13.6 How to exercise your rights

• In the app or on the website: view and edit your profile, download your data where offered, manage notifications, view or delete your saved ID document (ID vault) at any time, and delete your account.
• Delete your account: in your account settings, or at https://stayantra.com/delete-account.
• By email: write to info@stayantra.com, or to the grievance officer at info@stayantra.com.
• About data a hotel controls: contact the hotel; we will help (section 3.1).

Verifying your identity. To protect you, we check that a request really comes from you, usually by sending a link or code to the email address on your account. We ask only for what we need for the check, and use it only for that purpose.

How quickly we respond. We respond within one month of receiving your request. If a request is complex or you send several, we may extend this by up to two further months; if so, we tell you within the first month and explain why. Requests are free. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse, and we will explain why. Nepal and India grievances follow the shorter or specific time limits in sections 13.2 and 13.3.

14. Deleting your account

14.1 Guests and marketplace users

1. Request deletion in the app, on the website at https://stayantra.com/delete-account, or by email to info@stayantra.com.
2. We send a confirmation link to your email address to verify that the request is yours.
3. A 30-day cancellation window starts. You can cancel the deletion at any time during those 30 days by signing in.
4. After 30 days, your account is erased automatically.

What is erased: your account details and profile, the preferences and AI memory hotels hold about you, ID document images, guest web profiles, device push tokens, Rewards points (which are forfeited, and any vouchers cancelled), and marketing data. Your name and contact details are removed from messages, complaints, bookings and reservations. Your published reviews stay on the marketplace but are no longer linked to your name. Refund account details are masked.

What we must keep: financial records such as invoices and folios, for the periods in section 12, because tax law requires it; personal fields in them are anonymised where the law allows. Guest-register identity records a hotel must keep by law are kept until their 7-year retention period ends, and then the identity details are redacted.

When we cannot delete yet: we cannot erase an account while a stay is upcoming or in progress, or while data is subject to a legal hold, such as an open dispute or an official investigation. We will tell you why, and complete the deletion once the reason ends.

Apart from the items listed above, deleting your Stayantra account does not delete the records each hotel keeps as its own controller. Contact the hotel for those.

14.2 Hotels

A hotel owner can close the hotel's Stayantra account from the dashboard (Settings → Close this hotel), or by emailing info@stayantra.com. Once closed, the hotel is frozen read-only for 90 days: the owner can export everything at any time during that window, and reactivating within it restores the hotel and all its data intact. If it is not reactivated, we delete the hotel's operational data and guest personal data at the end of the 90 days. Financial, tax and payment records, and the guest register's statutory fields, are kept, redacted of personal data, for the period the law requires (currently up to 7 years); staff attendance and leave records are kept for the same period with staff identifiers pseudonymised. The Data Processing Addendum sets out these steps in detail.

Individual staff members who leave a hotel should ask the hotel to remove them. Their personal Stayantra sign-in can be deleted in the same way as a guest account.

14.3 Meta data deletion (Facebook, Instagram and WhatsApp)

If your hotel has connected a Facebook Page, Instagram account or WhatsApp Business account to Stayantra, we store an access token (encrypted) and the data we need to publish posts and send messages on the hotel's behalf. To remove it:

1. Disconnect the account in your Stayantra dashboard under Settings. This deletes the stored token.
2. Remove Stayantra in your Meta settings (for Facebook, Business Integrations in your account settings). Meta then sends us a data deletion request.
3. Ask us to delete any remaining data Meta provided by emailing info@stayantra.com with the subject "Meta data deletion".

When we receive a deletion request from Meta, we delete the data and give you a confirmation code and a status page where you can check progress. Posts already published on Facebook or Instagram stay there until you remove them in Meta's own apps.

14.4 Google user data

Stayantra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Sign-In only to create and sign you in to your account, and Google Maps and Places only to show hotel locations and help with addresses. We do not use Google user data for advertising, do not sell it, do not let people read it except with your consent, for security, to comply with law, or where it is aggregated and anonymised, and do not use it to train general AI models.

15. Location

We use your approximate location, worked out from your IP address, to show prices in a sensible currency and to feature hotels in a city near you. You can change the featured city yourself.

We use your precise location only when you tap "near me" on the marketplace, or allow location access in Stayantra Go. The coordinates are rounded and sent to our servers to search for nearby hotels. We do not store them in your profile or use them to track you. You can turn off location access at any time in your browser or phone settings.

When you view a map on the marketplace, Google Maps loads, and Google receives your IP address. See section 9 and our Cookie Policy.

16. Children

Stayantra is not directed at children. You must be 18 or older to create an account or make a booking. A guest under 18 may stay only on a booking made by an adult, who provides any details the hotel needs about them. We do not knowingly collect personal data from anyone under 18 through our own accounts. If we learn we have done so by mistake, we delete it. If you believe a child has given us personal data, email info@stayantra.com.

17. Marketing and messages

• Email marketing. We send marketing emails only if you agreed, or, in the UK and where the law allows, if you are an existing customer and did not opt out (the "soft opt-in"). Every marketing email has an unsubscribe link. Once you unsubscribe, we add a hashed copy of your email address to a suppression list, kept indefinitely, so that we never send you marketing again. Our emails identify us, include our postal address and are never misleading, as the US CAN-SPAM Act and UK and EU law require.
• Service messages. We always send messages you need for your bookings and account, such as confirmations, receipts, security alerts and legal notices. These are not marketing and you cannot unsubscribe from them while you have an account.
• WhatsApp. Stayantra does not send WhatsApp messages itself. A hotel may send you WhatsApp messages from its own WhatsApp Business account, through Meta's service, only if you opted in. The hotel controls these messages and turns them on; they are off by default. Reply STOP or ask the hotel to stop.
• Push notifications. Stayantra Go and Stayantra Connect send push notifications only if you allow them. Turn them off at any time in your phone's settings or the app's notification settings.
• Social media. We run Stayantra's own LinkedIn company page and other social accounts. If you interact with them, the platform processes your data under its own policy.

18. Cookies, do-not-track and Global Privacy Control

We use cookies and similar technologies as explained in our Cookie Policy. Non-essential cookies and analytics are off until you agree.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a valid opt-out: we switch off analytics and any non-essential processing automatically, without showing you the banner, and we treat it as a request not to sell or share your data.

Do Not Track. There is no common industry standard for how to respond to browser "Do Not Track" signals, so we do not respond to them. We honour Global Privacy Control instead. This disclosure is made under the California Online Privacy Protection Act. We do not allow other companies to collect personal data about your online activities across websites over time through our services.

19. Hotel websites and third-party links

Hotels can publish their own websites on Stayantra. Bookings and enquiries made through a hotel website go to that hotel, which is the controller; Stayantra processes the data for it. Our services link to sites and services we do not control, such as online travel agencies, payment pages and social media. Their own privacy policies apply.

20. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the version in force. We keep a record of earlier versions, and you can ask us for any of them.

If we make a material change, such as using your data for a new purpose or sharing it with a new kind of recipient, we will tell you in advance by email or with a notice in the app or dashboard. Where the law requires your consent to a change, we will ask for it and will not apply the change to you without it. When a change affects cookies, we also reset the choice stored by our cookie banner, so you will be asked again.

21. Contact

For any question about this policy or your data, email info@stayantra.com, or write to [Pending: UK company legal name] at [Pending: UK registered office address], or to [Pending: Nepal Stayantra company legal name] at [Pending: Nepal registered office address].

Grievance officer: [Pending: Grievance officer name], info@stayantra.com, [Pending: Grievance officer postal address].

EU representative: [Pending: EU representative (GDPR Art. 27 / DSA Art. 13)].

Related documents: Cookie Policy, Sub-processors, Data Processing Addendum, AI Transparency, Terms of Service, Complaints.