Privacy Policy | StayLuxe

StayLuxe Hospitality Pvt. Ltd. ("StayLuxe", "we", "us") operates the StayLuxe website and mobile applications. This Privacy Policy explains what personal data we collect when you search, book or partner with us, how we use it, and the choices you have. By using StayLuxe you agree to the practices described below. This policy should be read together with our Terms of Use.

1. Information We Collect

We collect information in three ways — what you give us, what your device shares, and what our partners provide:

Account & booking data — name, email, phone number, guest names, government ID type shown at check-in (we never store ID numbers), stay preferences and loyalty status.
Payment data — processed by PCI-DSS compliant gateways. We store only the last 4 digits of your card and the payment reference; never your full card number or CVV.
Device & usage data — IP address, browser type, app version, pages viewed, searches made and crash logs.
Location data — only if you enable "hotels near me"; you can revoke this any time in device settings.
Communications — call recordings and chat transcripts with our support team, kept for quality and dispute resolution.

2. How We Use Your Data

We use personal data to deliver and improve the service you expect from a premium booking platform:

Creating and servicing your bookings, refunds and modifications;
Sending transactional messages — vouchers, check-in reminders, refund updates — via email, SMS and WhatsApp;
Personalising search results, deals and recommendations;
Fraud prevention, risk scoring and compliance with Indian law;
Marketing communications, only with your consent, which you may withdraw with one tap on any message.

3. Cookies & Tracking

We use cookies and similar technologies to keep you signed in, remember your currency and theme, measure campaign performance and understand feature usage. Categories include:

Essential cookies — sign-in sessions, cart state, security tokens (cannot be disabled);
Preference cookies — language, currency, dark mode;
Analytics cookies — anonymised usage statistics;
Marketing cookies — set only after you accept them in the cookie banner.

You can manage non-essential cookies via "Cookie Preferences" in the footer or through your browser settings.

4. Sharing & Disclosure

We never sell your personal data. We share it only with:

The hotel you book — guest names, contact number and stay details needed to host you;
Payment gateways and banks — to process payments and refunds;
Service providers — cloud hosting, analytics and communication platforms bound by data-processing agreements;
Authorities — where required by law, court order or to prevent fraud.

5. Data Security

All traffic is encrypted with TLS 1.3, and data at rest is encrypted with AES-256. Access to production data is role-restricted, logged and reviewed quarterly. We run an active bug-bounty programme and independent annual security audits. Despite these measures, no system is 100% secure — please use a strong, unique password and never share OTPs.

6. Data Retention

Booking and invoice records are retained for 8 years to meet tax and accounting obligations. Support recordings are kept for 24 months. Marketing profiles are deleted within 30 days of consent withdrawal. When you delete your account, personal data not subject to statutory retention is erased within 90 days.

7. Your Rights

Subject to Indian data-protection law, you may:

Access a copy of the personal data we hold about you;
Correct inaccurate or incomplete data;
Delete your account and associated data;
Withdraw marketing consent at any time;
Raise a complaint with the Data Protection Board of India if unsatisfied with our response.

Submit requests from Account → Privacy Centre or by email; we respond within 15 days.

8. Contact & Grievance Officer

Grievance Officer: Kavya Deshpande
Email: privacy@stayluxe.com
Address: StayLuxe Hospitality Pvt. Ltd., Sunset Road, Panaji, Goa 403001
We acknowledge privacy grievances within 48 hours and resolve them within 15 days.