Privacy Policy

Last updated: 13 August 2026

This Privacy Policy explains how Crafted Travel Plans, operating Unbound Stays ("we", "us", "our", the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 ("DPDP Act")), collects, uses, shares, and protects your personal data when you use https://unboundstays.in (the "Platform"). It is written to align with the notice, consent, and data-principal-rights requirements of the DPDP Act and the DPDP Rules, 2025.

1. What Personal Data We Collect

• Account data: name, email address, WhatsApp/phone number, password (stored as a one-way hash, never in plain text), and account role (guest or host).
• Verification data: if you choose to get verified, a government ID document (for identity verification) and/or property ownership documents (for host property verification).
• Listing & booking data: property details entered by hosts; booking dates, guest count, and any negotiated price, advance amount, or transaction reference entered by a host in connection with a booking.
• Payment data: host subscription payments are processed by our payment gateway partner (Razorpay); we store the payment/subscription status and reference ID, not your card or bank details.
• Communications: messages sent between guests and hosts through the Platform's messaging feature.
• Usage data: pages visited, searches performed, device/browser information, and approximate location inferred from your IP address (used, for example, to suggest your country code on signup).

2. Why We Process Your Data (Purpose)

• To create and secure your account, including WhatsApp OTP verification;
• To publish and display listings, and to connect guests with hosts;
• To process host subscription payments and manage your subscription;
• To review identity/property verification submissions;
• To send booking-related notifications (e.g. a new booking request, confirmation, rejection, or cancellation) via WhatsApp;
• To respond to support requests and grievances;
• To maintain the security, integrity, and legal compliance of the Platform.

We do not use your personal data for any purpose beyond what is described in this notice without seeking your fresh consent.

3. Consent

Where we rely on your consent to process personal data (for example, at signup), that consent is free, specific, informed, and can be withdrawn at any time by contacting us as described below. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal, and may result in us being unable to continue providing certain features of the Platform to you (for example, we cannot publish a listing without a verified WhatsApp number).

4. Who We Share Your Data With

• The other party to a booking: when a guest requests a booking, relevant contact details (such as name and phone number) are shared between the guest and host so they can coordinate the stay directly.
• Payment processor: Razorpay, for processing host subscription payments.
• Messaging/notification providers: our WhatsApp notification workflow (via Pabbly Connect and our WhatsApp API provider), used to deliver OTPs and booking-related alerts.
• Hosting/infrastructure providers: our web hosting provider, to store and run the Platform.
• Legal & regulatory authorities: where required by law, court order, or a lawful request from a government authority, including the Data Protection Board of India.

We do not sell your personal data to third parties.

5. Data Retention

We retain personal data for as long as your account is active, or as needed to provide the Platform's services, comply with our legal obligations, resolve disputes, and enforce our agreements. You may request erasure of your data as described in Section 8 below, subject to any legal requirement to retain certain records.

6. Security Safeguards

We use reasonable technical and organisational safeguards to protect your personal data, including: encrypted transmission (HTTPS), password hashing, restricted access to identity/property verification documents (stored outside the publicly accessible web directory and viewable only by authorised administrators), and access controls on our administrative systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Breach Notification

In the event of a personal data breach that affects you, we will notify the Data Protection Board of India and affected users in the manner and timeframe required under the DPDP Act and Rules.

8. Your Rights as a Data Principal

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it is being processed;
• Correct or update inaccurate or incomplete personal data;
• Erase personal data that is no longer necessary for the purpose it was collected, unless we are required to retain it by law;
• Withdraw consent at any time, as described in Section 3;
• Nominate another individual to exercise your rights in the event of your death or incapacity;
• Grievance redressal — to raise a complaint about how your data is handled, and to escalate to the Data Protection Board of India if unresolved.

To exercise any of these rights, contact us using the details on our Contact Us page. We will respond within a reasonable timeframe as required under applicable law.

9. Children's Data

The Platform is intended for use only by individuals aged 18 and above. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a minor, we will take steps to delete it.

10. Cookies

We use minimal cookies necessary for the Platform to function (such as keeping you logged in). We do not currently use third-party advertising or tracking cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

12. Grievance Officer / Contact

For any privacy-related question, request, or grievance, please contact our Grievance Officer via the details on our Contact Us page.