Privacy Policy

Legal framework

We process digital personal data in India in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), where applicable.

We are also preparing our practices for the Digital Personal Data Protection Act, 2023 ("DPDP Act") and associated rules as they become fully effective. This Policy will be updated as required.

Who we are

KashmirBnB operates the KashmirBnB platform. For privacy-related requests, contact us at hello@kashmirbnb.co or the address listed at the end of this Policy.

Information we collect

We collect information you provide directly and information generated when you use the Service.

• Account and booking details: name, mobile number, email (if provided), trip preferences, selected destinations, package configuration, and messages you send to us or hosts.
• Communications: support chats, WhatsApp or phone correspondence related to bookings, and feedback you submit.
• Technical data: device type, browser, IP address, approximate location derived from IP, pages viewed, and referral source.
• Analytics: aggregated usage events to improve the map, itinerary builder, and destination guides (we use privacy-conscious analytics where possible).
• Cookies and similar technologies: session identifiers and preference storage required for sign-in and core functionality.

Sensitive personal data

Under Indian law, certain categories (such as passwords, financial account details, health information, or biometrics) are treated as sensitive personal data. We do not intentionally collect health records or biometrics through the public website.

If you choose phone-based sign-in, authentication is handled through our secure providers; we do not store your telecom password. Payment details, when collected, are processed through compliant payment partners and not stored on our servers beyond what is required for receipts and reconciliation.

How we use your information

• Provide trip planning, package estimates, destination content, and booking coordination.
• Verify your identity and prevent fraud or abuse of the Service.
• Connect you with homestay, houseboat, and guesthouse hosts when you request a booking.
• Send service messages (itinerary updates, verification, customer support) by SMS, WhatsApp, email, or phone.
• Improve product performance, fix errors, and understand which destinations and features are useful.
• Comply with law, respond to lawful requests, and enforce our terms.

Consent and choices

Where required, we obtain your consent before collecting sensitive personal data or using your information for purposes beyond providing the Service you requested.

You may withdraw consent for optional marketing messages at any time by replying STOP to promotional SMS or emailing us. Service-related messages (booking confirmations, verification) may still be sent while you have an active request with us.

When we share information

We do not sell your personal data. We share information only as described below:

• Hosts and local partners: when you book or request a stay, we share relevant trip and contact details so the host can respond.
• Service providers: cloud hosting, databases, maps (e.g. Mapbox), analytics, SMS/OTP, and customer-support tools that process data on our behalf under contract.
• Legal and safety: regulators, courts, or law enforcement when required by applicable law or to protect rights, safety, and security.
• Business transfers: if we merge or restructure, your data may transfer to the successor entity subject to this Policy.

Data retention

We retain personal data only as long as needed for the purposes above, including legal, tax, and dispute-resolution requirements. Booking records may be kept for several years where required by law or legitimate business needs. Anonymised analytics may be retained longer.

Security practices

We implement reasonable technical and organisational safeguards — including HTTPS encryption in transit, access controls, and vendor due diligence — consistent with the SPDI Rules. No method of transmission over the Internet is 100% secure; please use strong passwords and protect your device.

If we become aware of a data breach likely to harm your rights, we will notify affected users and authorities as required by applicable law.

Your rights

Subject to applicable Indian law, you may request access to, correction of, or deletion of personal data we hold about you. You may also object to certain processing or ask us to restrict use where legally permitted.

To exercise these rights, email hello@kashmirbnb.co with the subject line "Privacy request" and include the phone number or email associated with your account. We may verify your identity before responding.

Children

The Service is not directed at children under 18. We do not knowingly collect personal data from minors without parental consent. If you believe a child has provided us data, contact us and we will delete it promptly.

Cookies and analytics

Essential cookies enable sign-in, security, and session continuity. Analytics cookies help us understand usage patterns in aggregate. You can control non-essential cookies through your browser settings; disabling essential cookies may limit functionality.

Cross-border processing

Our infrastructure and subprocessors may process data in India and other countries with adequate safeguards or contractual protections. By using the Service, you acknowledge such processing where permitted by law.

Third-party links

Destination guides and restaurant pages may link to external websites (maps, menus, social profiles). We are not responsible for their privacy practices. Review their policies before submitting personal data.

Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be posted on this page; continued use after changes constitutes acceptance where permitted by law.