Privacy Policy

Guestly ("we", "us"), operated by Guestly Hospitality PVT LTD. runs the guestly.in website and the Guestly apps for Android and iOS — a marketplace where guests book stays and hosts list properties in India. This policy explains what personal data we handle, why, and the rights you have over it. It is written to match what our systems actually do.

What we collect

• Account & profile: name, username, email, phone number, date of birth, profile photo, address details you add, language and timezone.
• Identity verification (KYC): government identity information and documents you submit (Aadhaar-based verification via our verification partner, or document upload), including a selfie where the flow requires one. Documents are encrypted at rest and access is restricted.
• Bookings & stays: dates, guest counts, traveller details you enter (including saved co-travellers), the optional emergency contact, amounts, taxes and invoices.
• Payments: transaction identifiers, amounts and payment status from our payment provider. We never receive or store your card or UPI details — you enter them on the payment provider's own secure surface.
• Communications: messages you exchange with hosts or guests on Guestly, support tickets, and help cases including any attachments.
• Device & security: IP address, device/browser information, login history, push notification tokens, and one-time-password delivery records.
• Usage: in-product events such as campaign interactions, wishlist activity and notification delivery. Our mobile apps contain no third-party analytics or advertising trackers. Our website uses Google Analytics only after you accept analytics cookies.

Why we process it

• To create and secure your account (including OTP login and optional sign-in with Google, Apple or Truecaller).
• To perform the booking contract: reservations, payments, invoices (GST tax invoices are legally required records), host payouts, and revealing your stay's exact address and host contact in the 24 hours before check-in once you are verified.
• To verify identity and prevent fraud — hosts hand keys to verified guests.
• To operate messaging and support, including automated screening of chat for attempts to move payment off-platform (see the Chat & Communication Policy).
• To send transactional messages (booking confirmations, OTPs, stay updates) by SMS, WhatsApp, email and push; and, separately and only with your consent settings, promotional messages.

Who we share it with

Only service providers needed to run Guestly: our payment provider (Razorpay), SMS provider (MSG91), WhatsApp messaging provider (AiSensy), identity-verification provider (Surepass), realtime messaging transport (Pusher), push notifications and Android crash reporting (Google Firebase), maps and sign-in (Google; Apple sign-in on iOS; Truecaller verification on Android), our email provider, and Google Analytics on the website with your cookie consent. Hosts see the booking details they need (your name, party size, dates); they never see your emergency contact or payment identifiers. We do not sell personal data. We disclose data to authorities only where the law requires it. LEGAL REVIEW REQUIRED: processor contract/DPA status is being confirmed for each provider.

Where it lives, and for how long

Data is stored on Guestly's own servers. Automated retention runs daily: OTP records are deleted after 30 days; login history is anonymised after 180 days and deleted after 365; abandoned verification sessions are deleted after 30 days. Booking and tax records are kept for the statutory period (LEGAL REVIEW REQUIRED: exact period per GST law). See the Data Retention & Deletion Policy for the full schedule.

Your rights

From the app or website you can: access and download the personal data we hold about you; correct your profile; manage each consent (marketing email, SMS, WhatsApp, push, and more) individually; withdraw consent; and delete your account. Deletion anonymises your identity in place, purges your KYC documents, verification sessions, saved co-travellers and bank details, and signs you out everywhere; financial records required by law are retained without your identity attached to a usable login. See "Your Data Rights" for the full procedure and timelines.

Children

Guestly accounts are for adults (18+). Children appear only as accompanying guests in a booking made by an adult. See the Children's Privacy Policy.

Grievances

Suhas Parasa, CFO and suhasparasa@guestly.in We acknowledge complaints and resolve them within the timelines required by applicable law (see the Grievance Redressal Policy).

Changes

Every version of this policy is numbered and dated. Material changes are announced in the product, and where the law requires it we will ask for your consent again.