Privacy Policy
Last updated: 13 November 2026
This policy explains what personal data Avenaa Hospitality Management Private Limited ("Avenaa", "we", "us") collects through avenaa.co.in and the Avenaa mobile apps, why we collect it, who we share it with and the choices you have. It applies to guests, property owners (patrons), job applicants and anyone who contacts us.
1. Who is responsible for your data
Avenaa Hospitality Management Private Limited is the data fiduciary for the personal data described here, under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and its rules.
2. What we collect
| Who | Data |
|---|---|
| Everyone who signs in | Name, mobile number, email address (optional), sign-in records (date, time, IP address and device/browser type). |
| Guests | Booking details (home, dates, number of guests, amounts, GST number if you add one); identity verification for each adult guest at online check-in: Aadhaar (verified with an OTP through UIDAI via our licensed KYC provider), driving licence or passport; for foreign nationals, passport and visa details needed for Form C; the address on your ID; your signature on the house rules; reviews, photos or videos you choose to send us for rewards. |
| Property owners | Property details, address, map location, photos and amenities; property documents (for example a utility bill or ownership document); Aadhaar e-KYC (name, photo, date of birth, gender and address returned by UIDAI with your consent), PAN, bank account details and IFSC for payouts; the agreements you sign with Aadhaar eSign; payout and tax (TDS) records. |
| Job applicants | Name, phone, city, experience and anything you include in your application. |
| Payments | Payment status, amount and reference. Card, UPI and bank details are entered on Razorpay's secure page and are not stored by Avenaa. |
| Support | Messages, call notes and tickets when you contact us by phone, WhatsApp, chat or email. |
| Device and usage | Pages viewed, approximate location if you allow it (to show nearby homes or directions), and technical logs used to keep the service secure. The apps can use your camera and photos only when you choose to upload an ID or property photo. |
3. Why we use it (purposes and legal basis)
- To provide bookings and stays: confirming bookings, taking payment, sharing arrival details with the caretaker, issuing GST invoices and handling cancellations and refunds (performance of a contract and your consent).
- Guest registration required by law: verifying the identity of every adult guest and submitting Form C for foreign nationals to the immigration authority within 24 hours of arrival (legal obligation).
- To manage owners' homes: onboarding and verifying properties, signing agreements, listing homes on our website and on platforms such as Airbnb and Booking.com, paying monthly rent or revenue share, and deducting and reporting TDS (contract and legal obligation).
- Safety and security: preventing fraud, protecting homes, guests, staff and neighbours, and handling incidents, damage and disputes (legitimate uses permitted by the DPDP Act).
- Service messages: sign-in codes, booking confirmations, check-in links, payout statements and support replies by SMS, WhatsApp or email.
- Marketing: offers and updates, only where you have agreed. You can opt out at any time by replying STOP on WhatsApp, using the unsubscribe link in an email, or contacting us.
4. Who we share it with
We do not sell your personal data. We share it only as needed for the purposes above:
- Service providers that process data on our behalf under contract: Supabase (database and file storage, India region), Vercel (website hosting), Razorpay (payments), Cashfree (identity verification and Aadhaar eSign), MSG91 (SMS and WhatsApp messages), Resend (email), Google Maps (maps and directions) and our property management and channel distribution provider.
- Booking platforms such as Airbnb, Booking.com, MakeMyTrip and Google, when a home is listed or booked through them.
- Owners and caretakers: owners see booking details, guest names and masked ID numbers for their own home; the caretaker sees what is needed to check you in.
- Authorities: the immigration authority (Form C), police or courts when required by law, or to report a crime, serious damage or a safety incident.
- Professional advisers and successors: our auditors, lawyers and, if Avenaa is merged or acquired, the new owner, under the same protections.
5. How long we keep it
- Booking, invoice, payout and tax records: 8 years, as required by Indian tax and accounting law.
- Guest ID verification and check-in records: for the period required by guest-registration rules and to deal with any claims, and no longer than 3 years after check-out unless a legal matter is open.
- Owner KYC and agreements: for the term of the agreement plus 8 years.
- Sign-in codes expire after 10 minutes; security logs are kept for up to 1 year.
- Marketing preferences: until you opt out or delete your account.
6. How we protect it
Data is encrypted in transit (HTTPS). ID addresses and sensitive KYC fields are encrypted at rest; ID numbers are stored masked. Access is limited to staff who need it for their role, and every admin action is logged. Sign-in uses one-time codes; Avenaa team members use separate password sign-in. No system is completely secure, but we will notify you and the Data Protection Board of India of a personal data breach as the DPDP Act requires.
7. Your rights
You can ask us to: access a summary of your personal data and how it is used; correct or update it; erase it (see Delete your account); withdraw a consent you gave; and nominate another person to exercise your rights if you die or become incapacitated. You can also raise a grievance with us. We reply within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.
Some data cannot be erased straight away when the law requires us to keep it (for example tax records or Form C) or while a booking, payout or dispute is open.
8. Children
Avenaa accounts are for adults (18+). We do not knowingly create accounts for children. Children may stay at a home only as part of a booking made by an adult, who is responsible for them.
9. Cookies
We use essential cookies to keep you signed in and to secure the site. We do not use advertising cookies or sell browsing data.
10. Changes
We will post any change to this policy on this page with a new date, and tell you by email or in the app if the change is significant.
11. Grievance Officer
Hrithik Agarwal, Executive Director
Avenaa Hospitality Management Private Limited, 402, 11th Floor, Platina Tower, Plot C-59, G Block, Bandra Kurla Complex, Bandra East, Mumbai 400098, Maharashtra, India
Email: hrithik.agarwal@avenaa.co.in · Phone: +91 92409 54742
We acknowledge grievances within 48 hours and resolve them within 30 days.
Contact us
Avenaa Hospitality Management Private Limited
402, 11th Floor, Platina Tower, Plot C-59, G Block, Bandra Kurla Complex, Bandra East, Mumbai 400098, Maharashtra, India
Phone and WhatsApp (24/7): +91 92409 54742
Email: hrithik.agarwal@avenaa.co.in