Privacy Policy — KedarnathStays

• Account: your mobile number (your login identity) and name. Email is optional for guests — added only if you choose, used for voucher copies and formal notices. Property owners provide an email at listing (required, for booking records and settlement summaries).
• Booking details: guest names, ages, gender, and government-ID type for each guest (required for the property's guest register and yatra checkpoints), dates, units, meals, and amounts.
• Payment records: payment references (gateway payment IDs or UPI transaction references/UTR) and amounts. We never receive or store card numbers, bank credentials, or UPI PINs — online payments are processed by Razorpay under their own privacy policy.
• Technical: login sessions (device/browser description and times — visible to you under Logged-in Devices), and minimal cookies needed for sign-in and language preference. No advertising cookies, no trackers.
• Owner KYC documents (ID, PAN, tourism registration certificate) — used only to verify listings and enable settlements.

Government ID numbers of guests (type only). Card or bank details. Location tracking. Date of birth, marital status, or other profile data unrelated to a stay. We do not buy data about you and we do not sell or rent your data to anyone.

To create and manage bookings and vouchers; to send booking communications on WhatsApp and SMS (and email if you've added one); to let the property host you (they receive the guest names/ages and booking details for your stay); to process payments and refunds through Razorpay; to meet legal and tax record requirements; and to prevent fraud (e.g., duplicate payment references).

The property you book (your booking and guest details), Razorpay (payment processing), our messaging providers (WhatsApp/SMS/email delivery), and our infrastructure providers (hosting, database, file storage) — each only what their function needs. Government or judicial authorities where the law requires. No one else.

Booking, payment, and refund records are retained as business and tax records. You may delete your account from your profile: your account is anonymized — phone, email, and name are removed from the account and sessions are revoked — while the booking ledger is retained in anonymized form as required for accounts and tax. Active bookings must be completed or cancelled first.

See and edit your details in your account; log out any session under Logged-in Devices; choose your language (Hindi/English) for the site and messages; add or remove your email at any time; request a copy or correction of your data, or raise any privacy concern, at [email] / WhatsApp [number]. We respond within 30 days.

OTP-only sign-in (no password database to breach), hashed session tokens, encrypted transport (HTTPS), access limited to the operators of the Platform. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the authorities as required by law.

Accounts are for adults (18+). Children stay as guests under a booking made by an adult; we hold only the name/age given for the stay and use it for nothing else.

Updates to this policy change the "Last updated" date; material changes will be notified on the site and by message. Questions: [email] · [address], Rudraprayag, Uttarakhand.