Privacy Policy

Who we are

StayRated is a service operated by [LEGAL NAME - TO FILL] ([BUSINESS TYPE - TO FILL]), with its registered address at [FULL REGISTERED ADDRESS - TO FILL]. In this policy, "StayRated", "we", "us" and "our" mean [LEGAL NAME - TO FILL].

StayRated helps homestays, guesthouses and other small properties in India ("owners") send WhatsApp messages to their guests asking about their stay, share a Google review link, and alert the owner to low ratings.

Questions about this policy: email privacy@stayrated.co or write to us at the address above.

Our role: processor for guest data, fiduciary for owner data

Data protection law gives different responsibilities to whoever decides why and how data is used and to whoever handles it on their behalf. India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") calls these a Data Fiduciary (often called a "controller") and a Data Processor.

• Guest data: the owner is the Data Fiduciary, and we are their Data Processor. Each homestay decides to message its own guests about their stay. We send those messages and store the replies on the owner's behalf, following their instructions and our agreement with them. We do not use guest data for our own purposes, such as marketing.
• Owner account data: we are the Data Fiduciary. When an owner signs up, we decide how their account details are used to provide and run the service.
• Visitors to this website: this site does not collect personal data unless you choose to contact us. If you email or message us, we are the Data Fiduciary for that correspondence.

If you are a guest and have a question about how a homestay uses your data, you can contact the homestay directly or contact us. We will help, and pass your request to the owner where needed.

Data we collect

From homestay owners

• Name, email address and phone number (including WhatsApp number).
• Property details: property name, address or location, number of rooms, and checkout times.
• The link to your Google Business Profile review page.
• Account and billing records, and messages you send us.

From guests (on behalf of the owner)

• Name and WhatsApp number, entered by the guest on the consent page or provided by the owner.
• Stay dates and the property and room the guest stayed in.
• A consent record: the date and time the guest agreed, the exact wording and version of the consent text they saw, and the property it relates to.
• Ratings the guest gives, and any feedback text they choose to send.
• Message delivery status from WhatsApp (sent, delivered, read or failed) and opt-out requests (such as a STOP reply).

From website visitors

None, unless you contact us. This website sets no cookies and uses no analytics or tracking tools. Our hosting provider keeps standard server logs (such as IP address, browser type and the page requested) for a short time for security and to keep the site running.

How we use data

• Sending WhatsApp messages about the guest's stay and feedback: an optional welcome message, one rating request after checkout, one thank-you with the Google review link, and at most one reminder. See the full list of messages.
• Notifying the owner: passing on guest replies, sending low-rating alerts and weekly summaries to the owner who registered the property.
• Running the service: setting up accounts, showing owners their ratings and feedback, customer support, billing and keeping records required by law.
• Security and abuse prevention: detecting misuse, keeping the service reliable, and honouring opt-outs.

We do not send guests promotions or marketing offers, we do not use guest data to market our own services, and we do not sell personal data to anyone.

Legal basis and consent

Under the DPDP Act, we process guest data on the basis of the guest's consent. A guest gives consent by ticking a checkbox, which is not ticked by default, on the page they reach by scanning the QR card in their room. The wording is: "I agree to receive WhatsApp messages from [Property name] about my stay and feedback." We save the date, time and version of that wording.

We process owner account data to perform our agreement with the owner, with their consent, and to meet legal obligations (for example, tax and accounting records).

Withdrawing consent

Guests can withdraw consent at any time by replying STOP to any message. It takes effect immediately and no further messages are sent, apart from one confirmation. You can also email privacy@stayrated.co with the phone number you used. Withdrawing consent does not affect messages already sent.

WhatsApp and Meta Platforms

We send and receive messages through the WhatsApp Business Platform, provided by Meta Platforms, Inc. and its affiliates ("Meta"). Meta acts as a service provider to us for message delivery. Messages you send and receive on WhatsApp are also subject to WhatsApp's own Terms of Service and Privacy Policy, which you accepted when you started using WhatsApp.

StayRated is not affiliated with or endorsed by Meta or WhatsApp.

Other service providers

We use a small number of trusted providers to run the service. They may only use data to provide their service to us, under contracts that require them to protect it.

• Messaging: the WhatsApp Business Platform (Meta Platforms, Inc.).
• Website and application hosting: cloud hosting providers that serve this site and our application.
• Database and file storage: managed cloud database providers that store account, property and guest records.
• Authentication: a provider that handles owner sign-in securely.
• Email: a provider that sends account and service emails to owners.

We may also share data where required by law, for example in response to a valid order from a court or government authority, or to protect the rights and safety of our users or others.

Where data is stored

Some of our providers store or process data on servers outside India. When this happens, we choose providers with strong security practices and contracts that protect the data. We do not transfer personal data to any country the Government of India restricts under section 16 of the DPDP Act.

How long we keep data

• Guest data (name, number, stay dates, ratings, feedback and delivery status) is kept for [RETENTION PERIOD, e.g. 12 months - TO FILL] after the stay, so owners can see their feedback history. After that it is deleted or anonymised.
• Consent and opt-out records are kept for the same period, or longer if we need them to show that a guest agreed or opted out. We keep a minimal record of numbers that replied STOP so we never message them again.
• Owner account data is kept while the account is active and deleted after the account is closed, except where the law requires us to keep it (for example, invoices and tax records).
• Correspondence with us is kept for as long as needed to deal with your request.

You can ask us to delete data sooner. See how to request deletion. We complete deletion requests within [NUMBER OF DAYS, e.g. 30 - TO FILL] days.

How we protect data

• All data is encrypted in transit (HTTPS / TLS).
• Data is stored with providers that encrypt it at rest.
• Access to personal data is limited to people who need it to run the service, using individual accounts.
• Owners can only see data about guests of their own property.
• We collect only the data needed to send the messages and show owners their feedback.

No system is completely secure. If a personal data breach happens, we will inform affected owners, the Data Protection Board of India and, where required, affected individuals, as the DPDP Act requires.

Your rights

Under the DPDP Act, you have the right to:

• Access: get a summary of the personal data we process about you and how we use it.
• Correction: ask us to correct, complete or update inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed or you withdraw consent.
• Withdraw consent: at any time, by replying STOP or emailing us.
• Grievance redressal: raise a complaint with our grievance officer, and if unresolved, with the Data Protection Board of India.
• Nominate: name another person to exercise your rights if you die or become unable to do so.

To use any of these rights, email privacy@stayrated.co from the email address or with the phone number linked to your data. We may ask you to confirm your identity. For guest data, we will act on the owner's behalf and let the owner know.

Grievance officer

If you have a concern about how your personal data is handled, contact our grievance officer:

• Name: [GRIEVANCE OFFICER NAME - TO FILL]
• Email: [GRIEVANCE OFFICER EMAIL - TO FILL]
• Address: [FULL REGISTERED ADDRESS - TO FILL]

We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days.

Children

StayRated is not directed at anyone under 18. Owners must be 18 or older. The guest consent page is meant for adult guests. If we learn that we hold a child's data without verifiable consent from a parent or guardian, we will delete it.

Cookies

This website (https://stayrated.co) does not use cookies, analytics, advertising pixels or any other tracking. That is why you do not see a cookie banner. If you sign in to the owner dashboard at https://app.stayrated.co, it may use strictly necessary storage to keep you signed in. It does not use advertising or analytics cookies.

Changes to this policy

We may update this policy as the service changes or the law changes. We will update the "Last updated" date at the top. If a change materially affects how we use your data, we will tell owners by email before it takes effect, and ask for fresh consent where the law requires it.

Contact us

• Privacy questions and requests: privacy@stayrated.co
• General enquiries: hello@stayrated.co
• Post: [LEGAL NAME - TO FILL], [FULL REGISTERED ADDRESS - TO FILL]

Related: Terms of Service · WhatsApp messaging and consent policy · Data deletion instructions