Privacy policy

Effective 24 April 2026

This policy explains how Book-A-Bed ("we", "us") collects and uses information when you use our website (bookabed.in), our mobile web app, and our related services (together, the "Platform").

Book-A-Bed is operated by GoPGMS and is a marketplace connecting guests with owners of PGs, hostels, and coliving spaces across India.

1. Information we collect

• Account information — your name, mobile number, email address, and password hash when you sign up.
• Identity + business information (owners only) — name, business details, PAN, GST, Aadhaar data, and uploaded ID documents for KYC.
• Booking information — dates, properties booked, prices paid, communications with owners, and any notes you send.
• Device + usage information — IP address, browser, operating system, pages viewed, and similar analytics data.
• Location — if you grant permission, approximate or precise location to show nearby properties.
• Communications — records of support requests and messages sent through the Platform.

We do not collect special categories of personal data (health, biometric, religious, etc.) unless you voluntarily share them in a message.

2. How we use your information

• To operate the Platform and provide bookings, listings, and communications between guests and owners.
• To verify owner identity (KYC) before publishing listings.
• To send transactional messages — booking confirmations, OTPs, KYC decisions, owner responses.
• To prevent fraud, abuse, and platform misuse.
• To comply with legal obligations and respond to lawful requests.
• To measure usage and improve the Platform.

We do not sell your personal data to third parties. We do not use your data for targeted advertising.

3. Who we share information with

• Property owners receive the booking details + your contact information when you send a booking request. Guests receive the owner's contact details once a booking is confirmed.
• Service providers — cloud hosting (AWS), email delivery (AWS SES), SMS OTP (TrueSMS), identity verification (SurePass), payment processors (CCAvenue, once instant-book is enabled). Each is bound by data-processing terms.
• Law enforcement and courts — when legally required.
• Successor entities — in a merger or acquisition, with notice.

4. Cookies + similar technologies

We use a small number of cookies:

• Essential — session + authentication cookies required to keep you signed in.
• Preferences — remembering your city, dates, and recent searches.

We do not use advertising cookies or sell cookie data.

5. Data retention

• Account data — while your account is active, plus up to one year after deletion for fraud prevention.
• Booking + invoice data — retained for seven years to meet Indian tax and accounting requirements.
• KYC documents — retained for seven years after the last booking as required by applicable regulations.
• Server logs — up to 90 days.
• Deleted data — within 30 days of a verified deletion request, except data we are legally required to retain.

6. Your rights

Under India's Digital Personal Data Protection Act, 2023 you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccuracies.
• Request deletion of data we no longer need to retain.
• Withdraw consent and close your account.
• Nominate someone to act for you in case of incapacity.

To exercise any of these rights, email our Grievance Officer (see section 10). We respond within 30 days.

7. Security

We use industry-standard measures: TLS on all connections, encrypted storage, hashed passwords, least-privilege access controls, audit logs on administrative actions, and private-by-default storage for uploaded documents with short-lived signed URLs.

No system is perfectly secure. If you suspect unauthorized access, email support@bookabed.in immediately.

8. Children

Book-A-Bed is for users aged 18 and above. If you believe a minor has provided personal data, email us and we will delete it.

9. International transfers

Our primary infrastructure is in AWS Mumbai. If we need to transfer data outside India (e.g., for a vendor based elsewhere), we rely on contractual safeguards and applicable legal mechanisms.

10. Grievance Officer

For privacy-related concerns, contact:

• Email: privacy@bookabed.in
• Postal address: to be published on registration

We acknowledge complaints within 48 hours and resolve within 30 days.

11. Changes to this policy

We may update this policy. Material changes will be announced in-app and by email at least 14 days before they take effect.