Notice under the Digital Personal Data Protection Act, 2023
Last updated: 8 October 2026
Saffron Studios Private Limited (CIN U74120MH2015PTC264101), trading as SaffronStays, B19, Shriram Industrial Estate, Wadala West, Mumbai 400031, Maharashtra, India, is the Data Fiduciary for www.saffronstays.com and the SaffronStays mobile app. You are the Data Principal. This notice is available in English and, on request to our Grievance Officer, in any language listed in the Eighth Schedule to the Constitution of India.
What we collect and why
- Account data — name, email, phone, password, date of birth. To create and secure your account and to verify you are 18 or older.
- Service messages — your mobile number, email and the content of the message. When you sign in, book or enquire, we send you the messages the service needs — one-time passwords, booking confirmations and changes, payment links and payment reminders, check-in details, cancellation and refund updates, support replies, and follow-ups on an enquiry you made about a stay (for example, whether you still want the home you asked about, or need help completing the booking) — on WhatsApp as well as by SMS, email and push notification. WhatsApp is part of how we provide the service, not a marketing channel you have signed up to: these messages carry no promotions. Some replies and enquiry follow-ups are drafted with the help of an AI model (OpenAI), which receives the conversation to do so.
- Booking data— dates, guest names and ages, meal and accessibility preferences, special requests. To confirm and deliver your stay, which means sharing the necessary parts with the home's owner or caretaker.
- Payment data— amount, payment status, gateway reference. Card, UPI and netbanking credentials are entered on the payment gateway's own surface and never reach us.
- Check-in data — guest identity details where state hospitality law requires them, guest count and arrival details. To meet our statutory obligations as an accommodation provider.
- Support data — messages, tickets, call-back requests, reviews. To answer you and to improve our service.
- Device and usage data — IP address, device and browser characteristics, pages viewed. Strictly necessary parts for security and fraud prevention; everything beyond that only with your consent.
On what basis
We process personal data on your consent, and on the "certain legitimate uses" section 7 allows — chiefly data you voluntarily give us for a purpose you have not objected to, compliance with Indian law, and responding to a medical emergency or threat to safety. Analytics, advertising and non-essential communication run on consent alone, and you may withdraw that consent at any time without affecting your booking. Service messages, including those on WhatsApp, are sent because you used the service for that purpose (section 7(a)); they do not depend on marketing consent and continue after you withdraw it. If you object to receiving them on WhatsApp, write to us and we will use SMS and email instead. Withdrawal stops the marketing itself, not only the tracking scripts: the email, SMS, WhatsApp and push marketing opt-ins on your account are switched off with it. A withdrawal made while signed out is held briefly and applied to your account if you sign in on the same browser soon after; it is not held longer, so that one person's decision is never applied to another person's account. Write to us and we will apply it directly instead. Consenting again in the cookie panel restores advertising cookies in that browser; it does not resume marketing messages, which stay off until you ask us to lift the opt-out.
Who else receives it
Property owners and caretakers, our processors, and public authorities where the law requires. The full itemised list, including what each recipient gets and where it is processed, is on the third-party disclosure page. Cookies and trackers are described in the Cookie Policy and controlled from your .
How long we keep it
Account data for as long as your account is open, and for one year after you close it. Booking, invoice and tax records for eight years, as Indian tax law requires. Support conversations for three years. Consent-based marketing data until you withdraw consent. When a retention period ends, we erase the data or irreversibly anonymise it.
Your rights
- Access a summary of my data — A summary of the personal data we process about you, what we do with it, and the other fiduciaries and processors it has been shared with.
- Correct or complete my data — Fix inaccurate details or fill in incomplete ones — name, phone, email, address, booking details.
- Erase my data — Delete your personal data, except what we must keep to meet a legal obligation such as tax, GST and hospitality records.
- Withdraw my consent — Stop processing that relies on your consent, including marketing messages and analytics.
- Nominate someone — Name a person who may exercise these rights on your behalf if you die or become incapacitated (s.14).
- Raise a grievance — Complain about how we have handled your personal data or an earlier request.
Exercise any of them through the data request form, or read the detail on the Your Data Rights page.
Children
A child is anyone under 18. We do not knowingly let a child hold an account, we process a child's data only on the consent of a parent or lawful guardian, and we never track, profile or advertise to a child. See the Child Safety Policy.
Security and breaches
We apply reasonable security safeguards — encryption in transit, access control, logging and vendor due diligence — to prevent a personal data breach. If one occurs, we will notify the Data Protection Board of India and every affected Data Principal, as section 8(6) requires.
Grievance redressal
Sarang Purundare, Chief Technology Officer, is our Grievance Officer & Data Protection Contact. Saffron Studios Private Limited, B19, Shriram Industrial Estate, Wadala West, Mumbai 400031, Maharashtra, India. sarang@saffronstays.com (or privacy@saffronstays.com). We acknowledge within 72 hours and respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Detailed privacy practices
As a SaffronStays user, you’ll be giving sensitive information like your phone details, address, bank account numbers and more. SaffronStays takes privacy very seriously and implements strong controls to protect your personal information. The Privacy Policy document states SaffronStays’ policies and procedures on gathering and using your personal information. Read further on how SaffronStays is keeping your personal information safe.
Saffron Studios Private Limited ("SaffronStays", "we" or "us") provides this Privacy Policy to inform you of our policies and procedures regarding the collection, use and disclosure of personal information we receive from users of www.SaffronStays.com (collectively, the "Site") and our application for mobile devices (the "Application"). This Privacy Policy applies only to information that you provide to us through the Site and Application. This Privacy Policy may be updated from time to time to reflect changes to our information practices. If we make any material changes we will notify you by means of a notice on the Site and Application prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices. Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meanings as in our Terms of Service.
As used in this policy, the terms "using" and "processing" information include using cookies on a computer, subjecting the information to statistical or other analysis and using or handling information in any way, including, but not limited to collecting, storing, evaluating, modifying, deleting, using, combining, disclosing and transferring information within our organization or among our affiliates/ service providers within India or internationally.
International Transfer
Your information may be transferred to - and maintained on - computers located outside of your state, province, country or other governmental jurisdiction where the privacy laws May not be as protective as those in your jurisdiction. If you are located outside India and choose to provide information to us, SaffronStays transfers personal information to India and processes it there. Such information is also transferred and processed outside India. Your consent to this privacy policy followed by your submission of such information represents your agreement to that transfer.
Information Collection and Use
Our primary goals in collecting information are to provide and improve our Site, Application, services, features and content, to administer your use of the Site and Application (together, the "Service") and to enable users to enjoy and easily navigate the Site and Application
The collection of this information is necessary to provide certain functionalities within our mobile apps and to enhance the user experience. By voluntarily providing this information, users consent to its collection and use as described in this privacy policy.
We handle all collected information in accordance with applicable privacy laws and regulations. We do not collect any sensitive personal information without explicit user consent.
Data retention
We retain the personal information you provide through the app for as long as necessary to fulfill the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by law.
The criteria used to determine the retention period of your personal information include the following:
Legal Obligations: We may retain certain information for a longer period if required to do so by applicable laws, regulations, or legal processes. This may include data necessary to comply with tax, accounting, or other legal requirements.
Security and Fraud Prevention: We may retain certain information to maintain the security of our app, protect against fraud or misuse, and enforce our terms of service.
Our users can anytime choose to change or delete certain personal information from controls on the site and app.
Security Measures
We take the security of user information seriously and have implemented various measures to safeguard it.
Access Controls: We have implemented strict access controls to ensure that only authorized personnel can access user data.
Data Minimization: We only collect and retain the minimum amount of data necessary to provide the website & app's services.
Encryption: Sensitive data is encrypted during transmission and while at rest to prevent unauthorized access.
Personally Identifiable Information
When you register with us through the Site or Application and become a Member and when you choose to post a Listing or book an Accommodation, or when you wish to contact another Member/ User, we will ask you for personally identifiable information ("PII"). This refers to information about you that can be used to contact or identify you. PII includes, but is not limited to, your name, phone number, email address, Aadhaar Number (provided by the UIDAI), Passport number, social security number (SSN), any identity proof and home postal address, but does not include your credit card number or billing information. In order to process some of your transactions through the Site and Application, we may also ask for your credit card number and other billing information ("Billing Information") (PII and Billing Information together, "Personal Information"). If the address of a Listing you post matches that of your credit card billing address, that address would be considered PII. Some Personal Information is required, like your name and email address, and other Personal Information is optional, like your date of birth. We reserve the right to require address confirmation for Listings. If we require such confirmation, we will send a code via postal mail/ sms/ email to the address/ phone number contained in a Listing and ask you to enter the code via the Site, Application and Service in order to confirm the address of the Listing. We will also avail of services provided by professional verification agencies or e-KYC (electronic Know Your Customer) service agencies for the purpose of verification of PII, especially for hosts. We use your Personal Information to provide the Service and administer your inquiries. We collect Personal Information in connection with your registration to join the Service. You can register to join via the Site or Application by completing the required forms.
You can also register to join by logging into online accounts you may have with third party service providers ("SNS")(e.g. Facebook, LinkedIn, Google+, etc); each such account, a "Third Party Account", via our Site or Application as described below. As part of the functionality of the Site, Service and Application, you may link your SaffronStays Account with Third Party Accounts, by either: (i) providing your Third Party Account login information to SaffronStays through the Site, Service or Application; or (ii) allowing SaffronStays to access your Third Party Account, as is permitted under the applicable terms and conditions that govern your use of each Third Party Account. You represent that you are entitled to disclose your Third Party Account login information to SaffronStays and/or grant SaffronStays access to your Third Party Account (including, but not limited to, for use for the purposes described herein), without breach by you of any of the terms and conditions that govern your use of the applicable Third Party Account and without obligating SaffronStays to pay any fees or making SaffronStays subject to any usage limitations imposed by the applicable SNS. If you decide to register by logging into a Third Party Account via our Site or Application, we will obtain the Personal Information you have provided to the applicable SNS (such as your "real" name, email address, profile picture, names of SNS friends, names of SNS groups to which you belong, other information you make publicly available via the applicable SNS and/or other information you authorize SaffronStays to access by authorizing the SNS to provide such information) from your Third Party Accounts and use that information to create your SaffronStays Account and SaffronStays Account profile page and you will become a Member. Depending on the Third Party Accounts you choose and subject to the privacy settings that you have set in such Third Party Accounts, you understand that by granting us access to the Third Party Accounts, we will access, make available and store (if applicable and as permitted by the SNS and authorized by you) the information in your Third Party Accounts so that it is available on and through your SaffronStays Account on the Site, Service and Application. If there is information about your "friends" or people with whom you are associated in your Third Party Account, the information we obtain about those "friends" or people with whom you are associated, may also depend on the privacy settings such people have with the applicable SNS.
We also collect the other information that you provide as part of registration and the administration and personalization of your SaffronStays Account profile (e.g., without limitation, PIN code (on its own) and individual preferences, interests or demographic information) ("Non-Identifying Information").
We use your Personal Information (in some cases, in conjunction with your Non-Identifying Information) mainly to provide the Service, complete your transactions, and administer your inquiries.
Certain Non-Identifying Information would be considered a part of your Personal Information if it were combined with other identifiers (for example, combining your zip code with your street address) in a way that enables you to be identified. But the same pieces of information are considered Non-Identifying Information when they are taken alone or combined only with other non-identifying information (for example, your demographic information). We may combine your Personal Information with Non-Identifying Information and aggregate it with information collected from other SaffronStays Users (defined below) to attempt to provide you with a better experience, to improve the quality and value of the Service and to analyze and understand how our Site, Application and Service are used. We may also use the combined information without aggregating it to serve you specifically, for instance to deliver a product to you according to your preferences or interests or restrictions. We also use your Personal Information to contact you with SaffronStays newsletters, marketing or promotional materials and other information that may be of interest to you, but only if you have opted in to receive them. If you decide at any time that you no longer wish to receive such communications from us, please follow the unsubscribe instructions provided in any of the communications or update your "Notifications" information. (See "Changing or Deleting Information," below.) Please note that we also use your name, mobile number and email address to send you service messages related to your use of the Service — one-time passwords (OTPs) and sign-in verification, booking confirmations and changes, payment links, payment reminders and receipts, check-in and stay details, cancellation and refund updates, replies to your support requests, and follow-ups on an enquiry you made about a stay. WhatsApp is one of the channels we use for these, alongside SMS, email, push notification and phone call. WhatsApp messages are sent through the official WhatsApp Business Platform, via our WhatsApp service provider; to deliver them, your mobile number and the message content are processed by that provider and by WhatsApp (Meta Platforms, Inc.). Service messages are not affected when you opt out of marketing. If you would rather not receive them on WhatsApp, write to privacy@saffronstays.com and we will send them by SMS and email instead.
In certain cases, with your prior permission, we may post on your behalf to your SNS profile page. For example, if, as a host, your listing has received a 5 star rating from your guest, we will post this news on your SNS profile page.
Our users may choose to upload and share photos which are shared on certain pages of the website. We collect and store these photos securely to ensure their availability and display within the app. We do not use or access these photos for any purposes other than providing the intended functionality of the app. We do not claim ownership over your photos, and we do not share them with any third parties.
Sensitive Personal Information (SPI)
Sensitive Personal Information (SPI), as defined by Section 43a of the Indian IT Act 2000, as collected by us shall be protected with reasonable security features, as expected under the IT Act. User passwords are never stored in the clear and are never known to us. Bank account details of the Host are collected with a view to facilitate payments and the same are never shared with any party other than our Bankers for the purpose of funds transfers. Credit Card information is never stored by us and is directly entered by the user in the Payment gateway's payment page presented.
We use Payment Gateway Razorpay which is certified for PCI Compliance. SaffronStays.com does not store any credit card information of its users. No other SPI is collected, stored or processed by us.
Log Data
When you visit the Site and Application, whether as a Member or a non-registered user just browsing (any of these, a "SaffronStays User"), our servers automatically record information that your browser sends whenever you visit a website ("Log Data"). This Log Data may include information such as your computer's Internet Protocol ("IP") address, browser type or the webpage you were visiting before you came to our Site and Application, pages of our Site and Application that you visit, the time spent on those pages, actions performed on those pages, information you search for on our Site and Application, access times and dates, and other statistics. We use this information to monitor and analyze use of the Site, Application and the Service and for the Site and Application's technical administration, to increase our Site and Application's functionality and user-friendliness, and to better tailor our Site and Application to our visitors' needs. We also use this information to verify that visitors to the Site meet the criteria required to process their requests. We do not treat Log Data as Personal Information or use it in association with other Personal Information, though we may aggregate, analyze and evaluate such information for the same purposes as stated above regarding other Non-Identifying Information.
Cookies
Analytics and advertising cookies run only after you consent to them, and you can change or withdraw that consent at any time from your . The Cookie Policy lists every technology by category. The description below covers what those cookies do once enabled.
Like many websites, we use "cookies" to collect information. A cookie is a small data file that we transfer to your computer's hard disk for record-keeping purposes. We use cookies for two purposes. First, we utilize persistent cookies to save your login information for future logins to the Site and Application. Second, we utilize session ID cookies to enable certain features of the Site and Application, to better understand how you interact with the Site and Application and to monitor aggregate usage by SaffronStays Users and web traffic routing on the Site and Application. Unlike persistent cookies, session cookies are deleted from your computer when you log off from the Site, Application and Service and then close your browser. Third party advertisers on the Site and Application may also place or read cookies on your browser. You can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from the websites you visit. If you do not accept cookies, however, you may not be able to use all portions of the Site or Application or all functionality of the Service. We utilize Google Analytics, a web analytics service provided by Google LLC, to collect and analyze app usage data. Google Analytics uses cookies and similar technologies to track and report on app traffic, user interactions, and other analytics. We use Firebase, a mobile development platform provided by Google LLC, to gather data related to app usage and performance. Firebase collects information such as crash reports, user interactions, and device-specific data to help us identify and resolve app issues, enhance performance, and provide a better user experience. Please note that these third-party tracking technologies are subject to their own privacy policies and terms. We encourage you to review their respective privacy policies to understand how they handle your information.
Web Beacons
Our Site and Application may contain electronic images known as Web beacons (sometimes called single-pixel gifs) and are used along with cookies to compile aggregated statistics to analyze how our Site and Application are used and may be used in some of our emails to let us know which emails and links have been opened by recipients. This allows us to gauge the effectiveness of our customer communications and marketing campaigns.
Emailing Via a SaffronStays Account
As part of the Service, SaffronStays Users may communicate with SaffronStays Members through use of the "Contact Host" feature on the Site and Application. Where SaffronStays Users have selected the option of adding one or more email addresses to an online form, the message they create in the corresponding template will be sent from SaffronStays to those email addresses on their behalf. These email addresses will be used only for the purpose of sending the email communication to the addressee. If you choose to use our referral service to ask a friend for a recommendation, we will ask you for your friend's email address. We will automatically send your friend a one-time email inviting him or her to visit the Site and/ or Application. SaffronStays stores this information for the sole purpose of sending this one-time email.
Your friend may contact us to request that we remove this information from our database. You can import contacts from your email account address book to invite them to send you a recommendation. We collect, but do not store, the username and password for the email account you wish to import your contacts from and will only use it for that purpose only.
Phishing
Identity theft and the practice currently known as "phishing" are of great concern to SaffronStays. Safeguarding information to help protect you from identity theft is a top priority. We do not and will not, at any time, request your credit card information, your SaffronStays Account ID, login password, or national identification numbers in a non-secure or unsolicited e-mail or telephone communication.
Information Sharing and Disclosure
Overview
The Site, Application and Service can be used to facilitate the listing and booking of Accommodations. Listings for such Accommodations are made available via the Site, Application and Service by Hosts. Listings posted by Hosts, ratings and reviews of Hosts and Guests, and the Profile Information (as defined below) of Hosts and Guests, are visible to any SaffronStays User.
SaffronStays Members and Users
When you create a SaffronStays Account, we will set up a SaffronStays Account profile page for you. Your SaffronStays Account profile page will include your first name. You can select the other items of Personal Information that you wish to be included in your SaffronStays Account profile page - including, but not limited to, a profile picture, a list of the SNS groups to which you belong, a list of any of your SNS friends or connections who are also Members of SaffronStays, connections you have established between your Account and any SNSs, and a biography and links to your Listings, if applicable (together, your "Profile Information"). We will display your Profile Information in your SaffronStays Account profile page publicly via the Site and Application, and, with your prior permission, on third party sites. Any information you choose to provide as part of your Profile Information will be publicly visible to all SaffronStays Users and consequently should reflect how much you want other SaffronStays Users to know about you. We recommend that you guard your anonymity and sensitive information and we encourage members to think carefully about what information about themselves they disclose in their profile pages. You can review and revise your Profile Information at any time.
Listings
If you post a Listing, we may publish that Listing publicly via the Site and Application and may enable third parties to publish your Listing on their websites through the use of an HTML "widget". We may also display the geographical location of your Listing in the form of a map so that potential Guests can see the general area and neighborhood of your Listing, but your actual street address will not be disclosed until you enter into a confirmed transaction with another Member. If you request to make a booking via the Site, Application and Service, SaffronStays will share the following information about you with the applicable Host: (i) your first and last name, (ii) a link to your SaffronStays Account profile page, (iii) the names of any members of an SNS with whom you are "friends" or associated on the SNS if such individuals are also "friends" or associated with the Host on such SNS, and (iv) an indication that the name that you provided to SaffronStays when you became a Member matches the name that you provided to the SNSs to which you have linked your SaffronStays Account. All of this information will enable the Host to decide whether to confirm or reject your booking. When a Host confirms a booking we will share pieces of the Host's PII, including, but not limited to, full name, phone number, the Accommodation's address and the Host's email address, with the applicable Guest selected by the Host and we will share pieces of the Guest's PII with the Host, including, but not limited to, full name, phone number and email address, so that the Guest and Host may contact one another directly. In no event is a Guest's Billing Information shared with a Host.
Aggregate Information and Non-Identifying Information
We may share aggregated information that does not include Personal Information and we may otherwise disclose Non-Identifying Information and Log Data with third parties for industry analysis, demographic profiling and other purposes. Any aggregated information shared in these contexts will not contain your Personal Information.
Service Providers
We may employ third party companies and individuals to facilitate our Service, to provide the Service on our behalf, to perform Site and Application-related services (e.g., without limitation, maintenance services, database management, web analytics, fraud detection services relating to the activity of SaffronStays Users and improvement of the Site and Application's features) or to assist us in analyzing how our Site, Application and Service are used. These third parties may have access to your Personal Information; if they do, this access is only so that they may perform these tasks on our behalf and they are obligated not to disclose or use it for any other purpose. We may also provide Personal Information to our business partners or other trusted entities for the purpose of providing you with information on goods or services we believe will be of interest to you. You can, at any time, opt out of receiving such communications. Third party vendors, including Google, use cookies to serve ads based on a SaffronStays User's prior visits to SaffronStays. You can disable these specific cookies that track prior visits for the sake of follow-up advertising by opting out at https://www.google.com/privacy_ads.html .
Compliance with Laws and Law Enforcement; Guarantee Program
SaffronStays cooperates with government and law enforcement officials and private parties to enforce and comply with the law. We will disclose any information about you to government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate to respond to claims and legal process (including but not limited to subpoenas), to protect the property and rights of SaffronStays or a third party, to protect the safety of the public or any person, or to prevent or stop activity we may consider to be, or to pose a risk of being, any illegal, unethical or legally actionable activity.
Business Transfers
SaffronStays may sell, transfer or otherwise share some or all of its assets, including your Personal Information, in connection with a merger, acquisition, reorganization or sale of assets or in the event of bankruptcy.
Changing or Deleting Your Information
All Members may review, update, correct or delete the Personal Information in their registration profile by editing the relevant part of their profile. If you would like us to cancel your SaffronStays Account, please contact us and we will attempt to accommodate your request if we do not have any legal obligation or a legitimate business reason to retain the information contained in your SaffronStays Account. Please note that, if you cancel your SaffronStays Account, any reviews you have posted via the Site and Application will remain publicly viewable via the Site and Application. Please see below for privacy contact information.
Links to Other Websites
Our Site and Application contain links to other websites. If you choose to visit an advertiser by "clicking on" a banner ad or other type of advertisement, or click on another third party link, you will be directed to that third party's website. The fact that we link to a website or present a banner ad or other type of advertisement is not an endorsement, authorization or representation of our affiliation with that third party, nor is it an endorsement of their privacy or information security policies or practices. We do not exercise control over third party websites. These other websites may place their own cookies or other files on your computer, collect data or solicit personal information from you. Other websites follow different rules regarding the use or disclosure of the personal information you submit to them. We encourage you to read the privacy policies or statements of the other websites you visit.
Some portions of the SaffronStays Platform implement Google Maps/Earth mapping services, including Google Maps API(s). Your use of Google Maps/Earth is subject to Google's terms of use, located at, google.com/intl/en_us/help/terms_maps.html, which incorporates Google's Privacy Policy, located at, https://www.google.com/policies/privacy/
Testimonials
With your consent we may post your testimonial on the Site and Application along with your name. If you want your testimonial removed please contact us.
Our Policy Toward Children
Under the Digital Personal Data Protection Act, 2023 a child is anyone under 18. The Site and Application are not directed to children, and an account may only be held by a person aged 18 or above. We process a child's personal data — for example the first name and age of a child travelling with you — only on the consent of the parent or lawful guardian making the booking, and we collect the minimum needed to host that child safely.
We never track a child, monitor a child's behaviour, build a profile of a child or direct advertising at a child, and we do not undertake processing likely to have a detrimental effect on a child's well-being. Where an account's date of birth shows the holder is under 18, analytics and marketing technologies are switched off for that account regardless of any cookie choice made in the browser.
If a parent or guardian becomes aware that a child has given us personal data without their consent, write to privacy@saffronstays.com and we will delete it. See our Child Safety Policy for how we protect children in our homes.
Contacting Us
Privacy questions and rights requests go to privacy@saffronstays.com or the data request form. A formal grievance goes to our Grievance Officer & Data Protection Contact, Sarang Purundare (Chief Technology Officer), at sarang@saffronstays.com or by post to B19, Shriram Industrial Estate, Wadala West, Mumbai 400031, Maharashtra, India. For anything else, use Contact Us.