Privacy Policy

Data Fiduciary (Controller): VacationBNA Pvt. Ltd, William industry estate office No. 19. 2nd floor SG Barve Marg, Above Sheetal Mithaiwala Kurla West, Mumbai, Maharashtra 400007, India.

Contact (privacy): vacationbna5@gmail.com | Phone: [8976203444]

Grievance Officer (India): [adnan], [8976203444], [

William industry estate office No. 19. 2nd floor SG Barve Marg, Above Sheetal Mithaiwala Kurla West, Mumbai, Maharashtra 400007].

This Policy covers personal data we process through our apps, website, APIs, and communications (email/SMS/phone/push). It does not cover third-party websites or services that are not controlled by us.

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act):

• Data Principal = you, the individual to whom personal data relates.
• Data Fiduciary = us, the entity that decides the purposes and means of processing.
• Personal data = any data about an identifiable individual.

We also continue to follow applicable provisions under the IT Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), as updated or replaced.

We do not sell personal data. We share data only as necessary:

• Between booking participants: after a booking is confirmed, we share the traveller's contact number with the Host to coordinate the stay. We do not provide an in-app calling feature; calls occur directly via your own phone service.
• Service providers (processors): hosting/cloud infrastructure (Vercel, Hostinger), SMS/OTP, analytics/UX (Google Analytics 4, Hotjar), tag management (Google Tag Manager), search console (Google), Google Maps Platform, image storage/CDN, KYC/identity verification, support ticketing/call recording (for customer support only), push notifications (OneSignal), and advertising/attribution (Meta, LinkedIn, Google Ads, Quora). If enabled in future, a WhatsApp Business messaging provider will process your phone number and message metadata to deliver WhatsApp messages you opted into. We contractually require appropriate confidentiality, security, and data protection.
• Legal & compliance: to courts, law enforcement, regulators, or advisors when required by law or to protect our rights, users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

Our primary operations are in India. However, some service providers (e.g., analytics or cloud hosting) may process data in other countries. Transfers will occur only in accordance with applicable Indian law (including any government-notified restrictions under the DPDP Act). We implement contractual and technical safeguards with providers handling personal data outside India.

We keep personal data only for as long as needed for the purposes described or as required by law, after which we securely delete or anonymise it. You can temporarily deactivate your account (profile becomes inactive but data is retained), or permanently delete your account (we delete your personal data, subject to legal retention requirements). See Annex A for indicative retention periods.

For permanent deletion requests, we aim to complete deletion within 30 days from verification of your request, except where we must retain limited data for legal, tax, fraud-prevention, or dispute purposes.

We apply reasonable and appropriate technical and organisational measures, including: Encryption in transit (TLS) and at rest for sensitive data; Role-based access controls with least-privilege principles; Audit logs and periodic reviews of access to KYC data; Network and application security controls; secure software development practices; Vendor due diligence and contractual security obligations; Incident response playbooks and breach notification processes as required by law.

No system is 100% secure; if we detect or are notified of a breach affecting your data, we will act promptly and notify you and/or authorities as required.

We collect Aadhaar and PAN details from Hosts solely to verify identity and reduce fraud. We may collect and store numbers and images (e.g., photos/scans) as provided by you. We do not mask these values in storage. KYC data is encrypted and access-controlled, used only by authorised personnel or verification vendors. We do not use KYC data for marketing.

Retention: We retain KYC data until you permanently delete your account. If you temporarily deactivate your account, we continue to retain KYC data. Upon permanent deletion, we delete KYC data as part of account deletion (see Retention and Annex A), subject to any legal obligations to retain limited records.

Subject to law, you may:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Deactivate your account (temporary; data retained);
• Permanently delete your account (we delete your personal data, including KYC, subject to legal retention needs);
• Withdraw consent for optional processing (e.g., analytics, marketing, location);
• Portability (export basic account/booking data), where feasible;
• Grievance redressal via the Grievance Officer below.

How to submit a request: Use the in-app settings or contact vacationbna5@gmail.com with your registered email/phone. We may request additional information to verify your identity. We typically acknowledge within 48 hours and resolve within 30 days (or as required by law) with your registered email/phone. We may request additional information to verify your identity. We typically acknowledge within 48 hours and resolve within 30 days (or as required by law).

Withdrawing consent or requesting deletion may affect your ability to use some features or complete existing bookings. We may keep limited records to comply with law, enforce our agreements, or defend legal claims.

Our Services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us so we can delete it and take appropriate steps.

We may update this Policy from time to time. If we make material changes, we will notify you (e.g., in-app notice, email) and update the Effective Date above. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

We aim to acknowledge complaints within 48 hours and resolve them within 30 days, unless a different period is prescribed by law.

We currently focus on operations in India and do not offer services targeted to other countries. If we introduce Host memberships or cross-border services in the future, we will update this Policy and provide clear notice before launch, including any new data types (e.g., billing) and purposes.

Final periods may vary based on legal, tax, or dispute requirements.

We will update this Annex if our vendor categories change. Specific provider names may be disclosed upon request or where legally required.

• Cloud hosting & CDN: Vercel, Hostinger (regions may include India and other countries).
• Analytics & user experience: Google Analytics 4, Hotjar, Google Search Console (site performance insights).
• Tag management: Google Tag Manager.
• Advertising & attribution: Meta Pixel, LinkedIn Insight Tag, Google Ads, Quora Pixel.
• Push notifications: OneSignal.
• Maps & geocoding: Google Maps Platform.
• Messaging (future): WhatsApp Business messaging provider - only if you opt in.
• SMS/OTP & email delivery: GupShup.
• Crash reporting & performance: Firebase.
• KYC/identity verification: [Internal process / Vendor if engaged later].
• Customer support & call recording: MyOperator for customer support calls only.
• Security & fraud prevention: Services used to detect abuse and secure accounts.

Our mobile applications may request the following permissions, which you can grant or deny through your device settings: