Privacy Policy

We are committed to protecting your privacy and handling your personal data in a transparent and lawful manner. By creating an account, making a booking, ordering in-stay services, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy.

If you do not agree with this policy, please do not use our services. Where required by law, we will obtain your consent before collecting or processing certain categories of personal information.

This policy applies to personal information processed in connection with:

• The Picasa mobile application for iOS and Android
• Our website, booking flows, and guest account features
• In-stay services such as food ordering and guest support
• Communications with us, including email, SMS, push notifications, and WhatsApp
• Our internal property management tools used to operate bookings on your behalf

This policy does not cover third-party websites, online travel agencies (OTAs), or payment providers that may link to or integrate with our services. Those services are governed by their own privacy policies.

Depending on how you use Picasa, we may collect the following categories of information:

Account and profile information

• Full name
• Mobile phone number
• Email address
• Account credentials (stored in hashed form)
• Communication preferences and notification settings

Booking and stay information

• Reservation details (property, check-in/check-out dates, number of guests)
• Guest names and contact details associated with a booking
• Special requests, notes, and stay-related communications
• Booking source (for example: mobile app, WhatsApp, phone, or OTA import)

Identity verification

Where required for check-in or compliance, we may collect government-issued identification information and document images (such as Aadhaar, passport, driving licence, voter ID, or PAN card) to verify guest identity before or during a stay.

Payment and transaction information

• Payment status, amounts, invoices, refunds, and security deposits
• Limited payment details processed by our payment partners (we do not store full card numbers)

In-stay services

• Food and beverage orders, delivery location within a property, and order notes
• Service requests, maintenance issues, damage claims, and related photos or descriptions

Reviews and feedback

• Ratings, written reviews, and responses related to your stay or our services

Device and technical information

• Device type, operating system, app version, and language settings
• Push notification tokens
• IP address, browser type, and log data related to app and dashboard usage
• Cookies or similar technologies used for authentication and session management on our web properties

Location information

• Property addresses and map coordinates associated with listings
• Approximate or precise device location, where you grant permission in the mobile app (for example, to find nearby properties or navigate to a stay)

Communications

• Messages and support enquiries sent through the app, email, SMS, or WhatsApp
• Call or message metadata where communications are handled through integrated channels

Information from third parties

• Booking details imported from connected OTAs (such as Airbnb, Booking.com, or Goibibo)
• Information from payment processors, identity verification tools, and service providers

We use personal information for the following purposes:

• To create and manage your account
• To process, confirm, modify, and cancel reservations
• To verify guest identity where required for check-in or legal compliance
• To process payments, refunds, deposits, and billing
• To provide in-stay services, including food ordering and guest support
• To send transactional messages (booking confirmations, check-in instructions, payment receipts)
• To send service and promotional notifications where you have opted in (you may opt out of promotional messages at any time through app settings or by contacting us)
• To respond to enquiries, complaints, and support requests
• To manage reviews, loyalty benefits, and guest relationship features
• To detect, prevent, and address fraud, abuse, security incidents, and legal claims
• To sync availability and reservations with connected booking channels
• To improve, maintain, and develop our products and services
• To comply with applicable laws, regulations, and lawful requests

We process personal information based on one or more of the following legal bases, as applicable: your consent, performance of a contract with you, compliance with legal obligations, and our legitimate interests in operating and improving our services.

We may share personal information with:

• Property operators and staff — to fulfil your reservation, provide check-in support, and deliver in-stay services
• Service providers — such as cloud hosting, analytics, customer support tools, payment processors, SMS and push notification providers, and identity verification services, under contractual confidentiality and data protection obligations
• Meta / WhatsApp — when you choose to communicate with us through WhatsApp
• Online travel agencies and channel partners — when you book through or sync calendars with connected platforms
• Professional advisers and authorities — where required by law, court order, or to protect rights, safety, and security
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to appropriate safeguards

We do not sell your personal information.

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, including to provide services, comply with legal and tax obligations, resolve disputes, and enforce our agreements.

Identity documents are retained only for the period required to verify guests and meet applicable legal or operational requirements, after which they are deleted or anonymised unless a longer retention period is required by law.

We implement reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. These measures include access controls, encrypted connections (HTTPS), and restricted access to sensitive data such as identity documents on a need-to-know basis.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

Depending on applicable law (including India's Digital Personal Data Protection Act, 2023), you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal exceptions
• Withdraw consent where processing is based on consent
• Object to or restrict certain processing activities
• Opt out of promotional communications
• Lodge a complaint with a relevant data protection authority

To exercise these rights, contact us at Picasa.theluxestay@gmail.com. We may need to verify your identity before responding to your request.

Mobile app permissions. You can control app permissions (such as notifications, camera, photo library, and location) through your device settings. Some features may not function without the required permissions.

Our services are not directed to children under 18 years of age, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will take steps to delete it.

Picasa is operated from India. Your information may be processed in India and in other countries where our service providers operate. Where personal data is transferred internationally, we take steps to ensure appropriate safeguards are in place as required by applicable law.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and revise the "Last updated" date. We encourage you to review this page periodically. Continued use of our services after changes become effective constitutes acceptance of the updated policy where permitted by law.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out using the contact options below.