Last updated: 24 October 2026
This Privacy Notice explains what personal data Aangan collects, why, how we use it, and the rights you have under the Digital Personal Data Protection Act, 2023 (DPDP Act).
1. Who is the Data Fiduciary?
Meera Stay India Private Limited, CIN U55101HR2026PTC151172, is the Data Fiduciary under the DPDP Act for personal data processed through the Aangan platform. You can reach the person responsible for data protection at dpo@aanganstay.com.
2. What we collect
- You give us: mobile number, name, email, profile photo (optional), payment instrument, preferences (veg/Jain/etc.), messages to hosts.
- We collect when you use Aangan: booking history, listings viewed, device type, IP address, app crash reports.
- Hosts give us: PAN, Aadhaar (last 4 digits only retained), bank account, property address, property photos.
- If you apply for a job: your name, mobile number, email, city, experience, CV (file or link) and anything you write in the application.
- We receive from partners: payment and refund status from Cashfree Payments, verification results from Cashfree Secure ID, and your name and email from Google if you sign in with Google.
3. Why we use it
- To operate the service — search, book, pay, message, refund.
- To verify identity (KYC) where required by law or platform safety.
- To compute and remit GST and TDS to the government.
- To prevent fraud and respond to safety incidents.
- To send transactional messages (booking confirmation, cancellation, refund). These are not marketing.
- Marketing communications are sent only with separate express consent under DPDP and TRAI rules. You can withdraw consent at any time.
4. Lawful basis
We process personal data under (a) consent given at sign-up and at specific feature opt-ins; (b) "legitimate use" for performance of the booking contract (DPDP s.7(a)); and (c) compliance with the IT Act, GST and Income Tax law.
5. Sharing
We share only what is necessary:
- Hosts see your first name, profile photo, dates and guest count, and any message you send them. They see your full contact details only after a confirmed booking.
- Payments (Cashfree Payments) receive the data needed to take payments, issue refunds and send payouts to hosts.
- Identity verification (Cashfree Secure ID) receives the PAN, Aadhaar (via DigiLocker) and bank or UPI details a host submits for verification.
- Email (ZeptoMail by Zoho, with Resend as a backup) receives your email address and the message we send you. When we start sending SMS, our SMS provider (MSG91) will receive your mobile number and the message.
- Hosting and storage (a cloud hosting provider for our servers and database; Amazon Web Services for photos, documents and backups) store the data needed to run the service.
- Error reports (Sentry) receive technical details when something breaks, such as the page and the error. We do not send passwords, payment details or documents.
- App notifications (Apple and Google push services) receive the notification text and a device token.
- Website analytics (Umami) receives anonymous, cookieless page-view and event counts from our website — never your name, contact details or booking IDs.
- Government authorities when compelled by lawful order; we publish an annual transparency note.
6. International transfers
Photos, documents and backups are stored in India (AWS Mumbai, ap-south-1). Our servers and main database run in Singapore, and some of the providers above (for example email backup, error reports and analytics) may process data in other countries. We transfer data abroad only to countries the Government of India has not restricted under the DPDP Act, and only to providers bound to protect it.
7. Retention
- Account and booking data: kept while your account is active and for up to 8 years after the last booking, as required by the Income Tax Act for transactional records.
- Aadhaar full numbers: never stored — only the last 4 digits retained for matching during reverification.
- Card numbers: never stored by Aangan — handled by Cashfree Payments (PCI-DSS).
- OTP codes: stored as a salted hash; deleted after 10 minutes (TTL) or on first use.
- Job applications and CVs: kept while we hire for the role and for up to 12 months after, then deleted. You can ask us to delete yours earlier.
- Marketing preferences: kept until you withdraw consent.
8. Your rights under DPDP
You have the right to:
- Access a copy of your personal data we hold.
- Correct or update inaccurate personal data.
- Erase personal data we no longer need for a lawful purpose. You can delete your account yourself on the website (Account → Delete account) or in the app (Profile → Delete account).
- Nominate another person to exercise these rights in case of incapacity.
- Withdraw consent for any processing relying on consent.
- Raise a grievance about how we handle your data.
To use any of these rights, write to dpo@aanganstay.com from the email on your account (or tell us your registered mobile number). We reply within 1–2 working days and act on the request within 30 days. If you are not satisfied, you can approach our Grievance Officer or the Data Protection Board of India.
9. Children
Aangan is not for users under 18. We do not knowingly collect data from children. Under DPDP s.9 any processing of a child's data requires verifiable parental consent — if you believe we hold such data inadvertently please write to us and we will delete it.
10. Security
We use TLS 1.2+ in transit and encrypted storage at rest. Admin access is limited to named staff, each with only the sections they need, and every admin action is recorded in an audit log. Keys and passwords for our systems are kept in our hosting provider's encrypted settings, never in our code. The database is backed up every night to encrypted, versioned storage in India. We will notify you and the Data Protection Board within 72 hours of any personal-data breach affecting you.
11. Cookies
See our Cookies notice for the small set of cookies we use and how to opt out.