Privacy policy

Draft — to be reviewed by a lawyer. Written for our pilot in line with India’s Digital Personal Data Protection Act, 2023.

Last updated: 11 October 2026

1. Who is responsible

Praniv Enspan Pvt Ltd operates Apnaa Deraa and is the data fiduciary for your personal data. Contact us about anything in this policy at info@pranivenspan.com.

2. What we collect

• Account: name, phone number and/or email (from phone OTP or Google sign-in), preferred language.
• Bookings: dates, number of guests, amounts, booking status, and payment reference IDs from the payment company. We never see or store your card, UPI PIN or bank login.
• Hosts: display name, listing details, photos, location of the property, UPI ID for receiving the balance, homestay registration number (optional), payout status and the last 4 digits of the bank account.
• Agents: photos, voice notes and GPS location recorded while setting up a listing.
• Search and usage: what you search for (to show results and to limit AI use), app crash reports, and a device token for notifications.

3. PAN and bank details

When a host sets up payouts, their PAN, legal name and bank account/IFSC are sent directly to our payment company (currently Razorpay) to create a payout account. We do not store PAN or the full bank account number — only the verification status and the last 4 digits.

4. Why we use it

• To run your account, show listings and process bookings, payments, refunds and payouts.
• To share what is needed for a stay: after a booking is confirmed, the guest sees the exact address and the host’s phone/UPI ID, and the host sees the guest’s name and phone.
• To send booking messages (app notifications, email, WhatsApp to hosts).
• To keep the platform safe — reviewing listings and photos, preventing fraud and resolving disputes.
• To meet legal, tax and accounting requirements.

We do not sell your personal data and we do not use it for third-party advertising.

5. Who we share it with

• The other party to your booking (as described above).
• Our payment company, for payments, refunds and host payouts.
• Service providers who process data for us: database and file hosting (Supabase), AI processing of listing photos, voice notes and searches (Google Gemini), messaging (SMS/WhatsApp providers) and crash reporting.
• Authorities, when the law requires it.

6. Where it is stored and for how long

Our database and files are stored in India (Mumbai region). Some service providers (for example AI processing) may process data briefly outside India. We keep booking and payment records as long as tax and accounting law requires (usually 8 years); other data is deleted when you delete your account.

7. Your rights

• Access and correct your data — most of it is editable in the app’s Profile screen.
• Delete your account — from the app, or by emailing info@pranivenspan.com from the email or phone number on your account. We will confirm within 30 days. Records we must keep by law are retained only for that purpose.
• Withdraw consent for optional uses at any time.
• Raise a grievance with us at info@pranivenspan.com. If you are not satisfied, you may approach the Data Protection Board of India.

8. Security

Data is encrypted in transit, access is limited by role (guests, hosts, agents and admins see only what they need), and secret keys are never placed in the app or website.

9. Children

Apnaa Deraa is meant for adults. Bookings must be made by someone 18 or older.

10. Changes

We will show important changes to this policy in the app before they take effect.