Privacy Policy

Eden's Home collects only the personal data needed to run your booking, nothing more. This policy explains what we collect, why, who we share it with, and your rights over your data.

It follows India's Digital Personal Data Protection (DPDP) Act, 2023. Eden's Home is operated by Aviral Sharma (New Delhi, India), acting as the Data Fiduciary for data collected here. Using the platform means you accept these practices.

We collect personal data only to the extent necessary to operate the platform and provide our services. This includes:

• Full name, used for booking confirmation and communication
• Email address, used for account creation, booking notifications, and support
• Phone number, used for booking coordination, WhatsApp-based chat, and OTP verification
• Booking details, check-in and check-out dates, number of guests, property selected
• Payment-related information, processed through Razorpay; we do not store card numbers or full banking credentials
• Billing address, collected when you request an invoice or GST receipt
• Identity verification documents, a government-issued photo ID shown at check-in, and copies requested only in specific situations such as dispute resolution or where the law requires it
• Chat and inquiry content, messages sent through our website chat (Aven) and WhatsApp assistant
• Device and session data, IP address, browser type, pages visited, and session identifiers

We collect and use personal data for the following purposes, each of which corresponds to a legitimate basis under the DPDP Act:

• Processing and confirming bookings, necessary to perform the booking contract
• Verifying guest identity at check-in and meeting legal record-keeping duties (including foreign-national reporting), legal obligation and contract performance
• Communicating check-in instructions, property details, and booking updates, necessary to perform the contract
• Providing customer support and resolving disputes, legitimate interest and legal obligation
• Coordinating with property owners and caretakers on your behalf, necessary to provide the service; only the details needed for your stay are shared
• Fraud prevention and platform security, legitimate interest
• Platform analytics to improve performance, legitimate interest, using aggregated data where possible
• Sending service-related notifications, necessary to perform the contract

We do not use your personal data for unsolicited marketing without your explicit consent.

We share only what's needed with the services that run the platform. We never sell your data:

• Razorpay, processes payments (name, email, phone, amount). PCI-DSS compliant.
• AI chat providers (OpenRouter, Groq), process your Aven chat messages to generate replies.
• Meta WhatsApp Business API, routes messages you send to our WhatsApp assistant.
• Property owners and caretakers, receive your name, contact, dates, and guest count to prepare for your stay only.
• Supabase (database) and Vercel (hosting), store and serve platform data from the United States (see below).

Our database and hosting run in the United States, so your data may be processed outside India by providers operating under their own data-protection frameworks.

By using the platform and accepting this policy, you consent to this transfer.

Some properties may have security cameras in shared or outdoor areas such as entrances, driveways, or common lounges. Where cameras exist, the property owner must disclose them in the listing.

Cameras are never permitted in bedrooms, bathrooms, or other private guest spaces. If you discover an undisclosed camera in a private space, please leave the area and contact our Customer Support team immediately.

We use cookies and similar technologies to operate the platform. Cookies are small files stored in your browser. We use them to:

• Maintain your login session so you remain signed in
• Remember your preferences and booking state during checkout
• Enable secure payment processing (Razorpay sets its own session cookies)
• Measure platform usage patterns to improve performance

You can disable cookies through your browser settings. Doing so will prevent login and checkout from working correctly. For full details, please see our Cookie Policy.

We retain personal data only as long as necessary for the purposes it was collected:

• Booking records, retained for 5 years from the date of the stay, in line with standard accounting and dispute resolution requirements
• Identity document copies (where collected for disputes or legal compliance), retained only as long as the matter requires, then deleted
• Account data, retained for as long as your account is active. Deleted accounts are purged after 90 days.
• Chat and support conversations, retained for 12 months from the date of the conversation
• Payment records, retained as required by Razorpay and applicable Indian financial record-keeping requirements

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access, you can request a summary of what personal data we hold about you
• Right to correction, you can ask us to correct inaccurate or incomplete data
• Right to erasure, you can request deletion of your data, subject to any legal obligations we have to retain it
• Right to nominate, you can nominate another person to exercise your rights on your behalf in the event of your incapacity or death
• Right to withdraw consent, where we rely on consent as the basis for processing, you can withdraw it at any time. Withdrawal does not affect processing already done.
• Right to seek redressal, if you believe we have violated your data rights, you can contact our Customer Support team below, and you retain the right to approach the Data Protection Board of India once operational

To exercise any of these rights, contact us at avirals@edenshome.in. We ordinarily acknowledge requests within 2 business days and aim to resolve them within 30 days.

Our platform is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If you become aware that a child has provided us personal data without parental consent, please contact us and we will delete it promptly.

We implement technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include encrypted data storage (Supabase), HTTPS on all web traffic, HMAC-signed API communication between platform components, and row-level security policies on all database tables.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining appropriate safeguards.

For any privacy request or complaint, access, correction, deletion, consent withdrawal, contact Customer Support below. For timelines, see the rights section above.

You also retain the right to approach the Data Protection Board of India (once operational) or the appropriate Consumer Commission under the Consumer Protection Act, 2019.

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. For material changes, we will notify registered users by email.

Continued use of the platform following any update constitutes acceptance of the revised policy.