Privacy Policy

StayPulse is software that hostels, paying-guest accommodations and student residences use to run their business — rooms and beds, rent, food, maintenance and guest records. This policy explains what personal information we handle, why, and what you can ask us to do about it.

Who is responsible for your information

This matters, because two different organisations are involved and they have different responsibilities.

• Your hostel decides what information to collect about its guests and why. For that information, the hostel is responsible, and questions about it — a correction, a copy, or deletion — are best raised with them first.
• StayPulse provides the software and stores that information on the hostel's behalf. We process it on their instructions, and we do not sell it, rent it, or use it to advertise to anyone.

For accounts we create directly — a hostel owner or staff member signing up to StayPulse — we are responsible ourselves.

What we collect

From hostel owners and staff

• Name, email address, phone number, and role.
• The hostel's own business details: name, address, contact numbers, website, and tax registration numbers (GSTIN and PAN) where the hostel enters them.
• A password, stored only as a one-way hash — we cannot read it, and neither can anyone who obtains a copy of our database.

From guests

• Name, phone number, email address, home address, date of birth, and check-in date.
• Room and bed assignment, rent and food charges, payments and receipts.
• Food orders, maintenance requests and feedback.
• Photographs and identity documents where a hostel asks for them at registration.
• Aadhaar details, where a guest provides them — see the section below, which describes exactly how these are handled.

Automatically

• A session cookie once you sign in. It exists to keep you signed in and for nothing else.
• Ordinary server logs — the pages requested, times, and error details — used to keep the service working and to investigate faults.

We use no advertising cookies, no analytics trackers, and no third-party scripts that follow you between sites.

Aadhaar and identity documents

An Aadhaar number is never stored in a form we can casually read. Only the last four digits are kept in the clear, which is all any screen in StayPulse ever displays. The full number, when a guest supplies one, is encrypted with AES-256-GCM before it is written, and can only be decrypted to show the guest their own number back.

Where a hostel verifies identity by scanning the QR code on an Aadhaar card, we check the signature that UIDAI applied to it and store the result — the name, date of birth, gender and address that UIDAI vouched for, plus the last four digits. The scanned code itself is never stored, because it is a portable credential: anyone holding it could re-present it as proof of that person. The photograph inside it is shown to staff at the moment of the check and is not written to disk at all.

Identity document images a guest uploads at registration are stored so the hostel can meet its own record-keeping obligations, and are visible only to that hostel's staff.

Payments

Card numbers, UPI credentials and bank details never reach StayPulse's servers. Online payments are handled by Razorpay, who are certified to handle them; we receive only a payment identifier, the amount, and whether it succeeded.

Records of rent, food bills, advances, refunds and receipts are stored because a hostel needs them to run its business and to meet tax and accounting obligations.

Messages we send

We send transactional messages only — receipts, payment reminders, registration and approval notices, maintenance updates, and one-time codes used to verify a phone number. There is no marketing mail, so there is nothing to unsubscribe from; a guest who does not want these should ask their hostel to remove the contact details from their record.

Email is delivered through Zoho ZeptoMail and WhatsApp messages through Meta's WhatsApp Business Platform. Where an email address permanently rejects our mail, we record that fact and stop sending to it, so that a dead address does not affect delivery for everyone else.

Who else sees your information

We use a small number of service providers, each for one job:

• Amazon Web Services — hosting and storage.
• Razorpay — payment processing.
• Zoho ZeptoMail — sending email.
• Meta Platforms — sending WhatsApp messages.

We do not sell personal information, and we do not share it for anyone else's marketing. We disclose it otherwise only where the law requires it, or to establish or defend a legal claim.

Keeping tenants apart

Each hostel's data is separated at the database level, and every query the application makes is automatically restricted to the hostel it belongs to. One hostel cannot see another hostel's guests, payments or records.

How long we keep it

Guest and financial records are retained while the hostel's account is active, and afterwards for as long as their own tax and record-keeping obligations require — in India, commonly several years for anything supporting a GST return. When a hostel's account is deleted, its data is deleted with it.

Security

• Traffic is encrypted in transit with HTTPS.
• Passwords are stored as one-way hashes, never as text.
• Aadhaar numbers and any stored payment-gateway keys are encrypted at rest.
• Staff access is limited by role, and can be restricted to a single building.

No system is perfectly secure, and we will not claim otherwise. If we become aware of a breach affecting personal information, we will notify the hostels concerned and the relevant authority as the law requires.

Your rights

Under India's Digital Personal Data Protection Act, 2023, you may ask for a copy of the personal information held about you, ask for it to be corrected or completed, ask for it to be erased, and complain about how it has been handled.

If you are a guest, please contact your hostel first: they decide what is held about you, and they can act on most requests immediately. If they cannot help, or your request is about StayPulse itself, contact us using the details below and we will respond.

Children

StayPulse is intended for use by hostels and their adult residents. We do not knowingly collect information directly from children. Where a hostel accommodates a minor, the record is created and managed by that hostel under its own obligations.

Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top. Material changes will be communicated to hostel account holders directly.

Contact

Questions about this policy, or a request about your information, can be sent to:

• Email: hello@staypluse.in