Privacy Policy

1. Introduction

RoomBuddy ("RoomBuddy," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use the RoomBuddy mobile application, website, and related services (collectively, the "Platform").

This Privacy Policy applies to all users of the Platform, including Hosts (who list rooms), Guests (who book rooms), and visitors. By accessing or using the Platform, you consent to the practices described in this Privacy Policy.

We process personal information in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"), as applicable.

2. Who Controls Your Data

RoomBuddy, a company registered in India, is the data fiduciary (controller) responsible for your personal information. This means we determine the purposes and means of processing your personal data collected through the Platform.

For payment-related data, our payment partner Razorpay acts as an independent controller for information processed through their payment infrastructure, subject to their own privacy policy.

3. Information We Collect

3.1 Information You Provide

We collect information you provide directly when using the Platform:

3.2 Information Collected Automatically

When you use the Platform, we automatically collect certain information:

• Device information — device type, operating system, unique device identifiers, app version, and crash reports.
• Usage data — pages viewed, searches performed, listings viewed, booking history, and interaction patterns.
• Location information — approximate location based on your IP address. We do not collect precise GPS location without your explicit consent.
• Log data — IP address, access times, referring URLs, and browser or app type.

3.3 Information from Third Parties

We may receive information from third-party sources, including:

• Payment partner (Razorpay) — transaction confirmation, payment status, and payment method details (we do not receive or store your full card number).
• Identity verification providers — Aadhaar verification status and results from our KYC partner.
• OTP and SMS providers (MSG91) — delivery status of OTPs and transactional messages.

4. How We Use Your Information

4.1 Providing the Platform

We use your information to:

• Create and manage your account.
• Verify your identity through phone OTP, email, and Aadhaar KYC.
• Enable you to create listings, search for rooms, and make bookings.
• Facilitate communication between Hosts and Guests.
• Process payments and payouts through Razorpay.
• Send transactional notifications (booking confirmations, payment receipts, reminders).
• Provide customer support.

4.2 Safety, Security, and Trust

We use your information to:

• Prevent fraud, abuse, and unauthorized access.
• Verify the identity and trustworthiness of Members.
• Enforce our Terms of Service and community policies.
• Investigate and respond to reports of misconduct or safety concerns.
• Maintain the security and integrity of the Platform.

4.3 Improving the Platform

We use your information to analyze usage patterns, conduct R&D, fix bugs, and measure the effectiveness of our services.

4.4 Communications

We use your information to send service-related notices necessary for Platform operation, and promotional communications where you have opted in. You can opt out at any time through notification preferences in the app.

4.5 Legal Obligations

We use your information to comply with applicable laws, regulations, legal processes, or governmental requests, including tax reporting obligations and responses to law enforcement.

5. Who We Share Your Information With

We do not sell your personal information. We share your information only in the following circumstances:

5.1 Between Members

When a booking is confirmed, we share limited information between the Host and Guest:

• Shared with the Host: Guest's first name, profile photo, and booking details.
• Shared with the Guest: Host's first name, profile photo, property address (after booking), and contact information for check-in coordination.

5.2 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Razorpay — payment processing and payout services.
• MSG91 — OTP delivery and transactional SMS.
• Amazon Web Services (AWS) — cloud infrastructure, storage, and hosting.
• Amazon SES — transactional and verification emails.
• Sentry — error tracking and monitoring (anonymized data only).

5.3 Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities (such as a court order, tax authority, or law enforcement).

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change and the choices you may have.

6. Payment Information

All payments are processed by Razorpay. RoomBuddy does not receive or store your full card number, CVV, or other sensitive payment credentials. We receive only transaction confirmation data necessary to maintain booking records. Razorpay is PCI-DSS compliant. Their handling of your data is subject to their own Privacy Policy.

7. Cookies & Tracking

The RoomBuddy mobile app does not use browser cookies. We use encrypted local storage for authentication tokens and user preferences, and may collect anonymous aggregated analytics to improve the Platform. Push notifications are sent with your permission and can be managed in the app settings.

8. Data Retention

• Account data — retained for the lifetime of your account plus 180 days after deletion.
• Booking records — retained for 7 years to comply with Indian tax regulations.
• Payment transaction records — retained for 7 years as required under the Income Tax Act and GST regulations.
• Identity verification data (Aadhaar) — we store only the verification status, not the Aadhaar number itself.
• OTP records — automatically deleted within 24 hours of generation.
• Communication logs — retained for 1 year after the relevant booking is completed.
• Usage and analytics data — retained in anonymized/aggregated form indefinitely.

9. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption in transit — TLS 1.2 or higher (HTTPS) for all data transmission.
• Encryption at rest — AES-256 encryption for sensitive stored data.
• Authentication security — JWT tokens with short-lived access tokens and secure refresh token rotation.
• Infrastructure security — AWS (ap-south-1, Mumbai) with VPC isolation and security groups.
• Access controls — restricted to authorized personnel on a need-to-know basis.

10. Your Rights

Under applicable Indian data protection laws, including the DPDP Act, 2023, you have the following rights:

• Right to access — request a summary of the personal information we hold about you.
• Right to correction — request correction of inaccurate or incomplete information. Most can be updated via Edit Profile in the app.
• Right to erasure — request deletion of your personal information, subject to our legal retention obligations.
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time.
• Right to grievance redressal — raise concerns with our Grievance Officer or file a complaint with the Data Protection Board of India.
• Right to nominate — nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact us at support@roombuddy.co.in. We will respond within 30 days.

11. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe your child has provided information to us, contact support@roombuddy.co.in and we will delete it promptly.

12. International Data Transfers

Your personal information is primarily stored and processed in India on AWS servers in the Mumbai (ap-south-1) region. In limited circumstances, your data may be accessed by service providers outside India, where we ensure comparable data protection standards and use contractual safeguards.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email, in-app notification, or a prominent notice at least 30 days before changes take effect, and update the "Last updated" date above. Your continued use of the Platform after the effective date constitutes acceptance of the revised policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us:

• General inquiries: support@roombuddy.co.in
• Website: roombuddy.co.in