At VstayInn (operated by Vijnananai Technologies Private Limited), we take your privacy seriously. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our platform, and your rights under the Digital Personal Data Protection Act (DPDP), 2023 and other applicable Indian laws.
Data We Collect
We collect personal data to provide and improve our services. The information we collect depends on how you use our platform:
| Category | Data Collected | Who It Applies To |
|---|---|---|
| Account Data | Name, mobile number, email, password (hashed) | All users |
| Identity / KYC | Aadhaar number, government ID photos, student ID photos, GST registration | Students & Owners |
| Profile Data | College name, year of study, gender preference, profile photo | Students |
| Property Data | Property address, photos, room types, pricing, amenities | Property Owners |
| Transaction Data | Booking details, payment amounts, Razorpay transaction IDs | All users |
| Usage Data | Device type, IP address, browser, pages visited, session duration | All users |
How We Use Your Data
We use personal data strictly for the following purposes:
- Account Management: Creating, maintaining, and securing your account.
- KYC Verification: Verifying identity to maintain platform trust and safety.
- Service Delivery: Facilitating property discovery, booking applications, and payments.
- Communication: Sending booking confirmations, payment reminders, and support responses.
- Platform Improvement: Analyzing usage patterns to enhance features and user experience.
- Legal Compliance: Meeting obligations under Indian law, including tax and regulatory requirements.
- Fraud Prevention: Detecting and preventing fraudulent activity on the platform.
KYC Document Handling
Your KYC documents (Aadhaar, government IDs, property documents) are among the most sensitive data we process. We handle them with the highest level of care:
- Documents are uploaded via encrypted HTTPS connections and stored on AWS S3 with AES-256 server-side encryption.
- Access to KYC documents is restricted to authorized KYC team members only, under strict access controls and audit logging.
- Aadhaar numbers are masked in our databases — only the last 4 digits are stored in plain text.
- KYC documents for rejected applications are deleted from our systems within 90 days of rejection.
- We do not share your KYC data with property owners. Owners only see a verification badge indicating your KYC status.
Data Sharing & Disclosure
We share your data only in the following limited circumstances:
- With Property Owners: Basic profile information (name, contact, KYC status) is shared upon booking confirmation — not before.
- With Payment Processors: Razorpay receives transaction data necessary to process payments. It has its own privacy policy.
- With Service Providers: Supabase (database and document storage) and our SMS/email delivery providers, all under strict data processing agreements.
- For Legal Compliance: When required by Indian law, court order, or government authority request.
- For Business Transfers: In the event of a merger or acquisition, data may be transferred to the successor entity subject to equivalent privacy protections.
Data Retention
We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy, or as required by law:
- Active account data: Retained for the lifetime of your account plus 3 years after account closure.
- Transaction records: Retained for 7 years as required under Indian financial regulations.
- KYC documents (approved): Retained for the duration of account activity plus 3 years.
- KYC documents (rejected): Deleted within 90 days of rejection notice.
- Support correspondence: Retained for 2 years from the date of resolution.
Your Rights Under DPDP Act 2023
Under India's Digital Personal Data Protection Act (DPDP) 2023, you have the following rights regarding your personal data:
- Right to Access: Request a copy of the personal data we hold about you.
- Right to Correction: Request correction of inaccurate or incomplete personal data.
- Right to Erasure: Request deletion of your personal data (subject to legal retention obligations).
- Right to Grievance Redressal: Lodge a grievance with our Data Protection Officer.
- Right to Nominate: Nominate a person to exercise rights on your behalf in the event of death or incapacity.
To exercise any of these rights, contact us at VstayInn@vijnananai.com with the subject line "Privacy Rights Request". We will respond within 30 days.
Cookies & Tracking
VstayInn uses cookies and similar technologies to improve your experience:
- Essential Cookies: Required for platform functionality (login sessions, security tokens). Cannot be disabled.
- Preference Cookies: Remember your settings and preferences (e.g., language, role selection).
We do not use advertising or tracking cookies. You can manage cookie preferences through your browser settings.
Data Security
We implement industry-standard technical and organizational measures to protect your personal data:
- All data transmission is encrypted via TLS 1.3 / HTTPS.
- Passwords are stored using bcrypt hashing with individual salts.
- Database access is restricted by role-based access control (RBAC) with audit logging.
- Regular security audits and vulnerability assessments are conducted.
- Our team undergoes mandatory data privacy training.
In the event of a data breach affecting your rights, we will notify you and the relevant authorities within 72 hours of becoming aware of the breach, as required by applicable law.
Contact & Data Protection Officer
For any privacy-related questions, concerns, or to exercise your data rights, please contact:
- Data Protection Officer (DPO): Privacy Team, Vijnananai Technologies
- Email: VstayInn@vijnananai.com
- Phone: +91 799 333 6749
- Address: Vijnananai Technologies Private Limited, Kakinada, Andhra Pradesh, India — 533001