Privacy Policy
Last updated: 25 September 2026
1. Who we are
StayAtAloha is operated by RAHUL KHANNA HUF (GST 30AAXHR1935E1Z3), 11/203, Charvi Reemz, Anjuna Mapusa Road, opp. Oxford Arcade, Dmello Vaddo, Anjuna, Goa 403509, India. We manage holiday villas and apartments in North Goa. This policy explains what personal data we collect when you use www.stayataloha.com or stay with us, why, and what you can ask us to do with it.
2. What we collect
When you browse the site. Our website does not ask you to create an account or fill in a form. Like most websites, it records technical information automatically: your IP address, browser and device type, the pages you visit and how you arrived. We use Google Analytics to understand this in aggregate (see section 7).
When you enquire. Most enquiries reach us on WhatsApp, by phone or by email. We receive whatever you send: usually your name, phone number, travel dates, number of guests and the property you are interested in. If you tap a WhatsApp button on our site, the dates and property you chose are pre-filled into the message; nothing is sent until you press send.
When you book. To confirm and host your stay we collect the names of guests, contact details and payment confirmations. For every adult guest we collect a copy of a government-issued photo ID, and for foreign nationals a passport and visa, because Indian law requires hosts to register guests with the authorities.
Payments. We accept bank transfer and UPI directly. If you choose to pay by card, you pay on a secure page run by our payment provider, Zoho. We never see or store your full card number.
Availability calendars. Our site shows availability by importing each property’s calendar from Airbnb. These calendars carry booked dates only, not the names or details of other guests.
3. How we use it
- To answer your enquiry and quote for your stay
- To confirm, prepare for and host your booking, and to contact you about it
- To register guests with the authorities and keep tax and GST records, as the law requires
- To take payments and issue refunds
- To keep our properties, guests and neighbours safe, and to prevent fraud
- To understand how visitors use our website so we can improve it
We do not sell your personal data, and we do not send marketing messages unless you have agreed to receive them.
4. Our legal basis
Under India’s Digital Personal Data Protection Act 2023, we process your data with your consent, which you give when you contact us or book, and for the legitimate uses the Act allows, such as meeting legal obligations like guest registration and tax records. You may withdraw consent at any time (section 9); this does not affect data we must keep by law.
5. Who we share it with
- The team at your property, such as the caretaker, so they can welcome and look after you
- Government authorities, when the law requires it, for example guest registration or a lawful request
- Our payment provider, Zoho, if you pay by card
- Service providers who run parts of our website: Hostinger (hosting), Google (analytics), Mapbox (the property maps) and Meta (WhatsApp, when you message us). Each processes data under its own privacy policy.
We share only what each needs to do its job.
6. Bookings made through Airbnb or other platforms
If you book through Airbnb or another platform, that platform collects and handles your data under its own privacy policy. We receive the details it passes to us to host your stay, and we treat them as this policy describes.
7. Cookies and analytics
Our site uses a small number of cookies:
- Essential cookies, which make the site work, for example remembering the filters you chose
- Analytics cookies from Google Analytics, which tell us in aggregate how many people visit, which pages they read and which buttons they use, including taps on our WhatsApp buttons. Google Analytics does not tell us who you are.
We do not currently use advertising cookies. If we start, for example to run adverts on Facebook or Instagram, we will update this policy first and say so here. You can block or delete cookies in your browser settings; the site will still work.
8. How long we keep it
| Data | How long |
|---|---|
| Booking and payment records | As long as tax law requires, currently up to 8 years for GST records |
| Copies of guest ID | Only as long as guest-registration rules require, then deleted |
| Enquiries that did not become a booking | Up to 2 years |
| Website analytics | Up to 14 months, in Google Analytics |
9. Your rights
Under the DPDP Act you may ask us to:
- Tell you what personal data we hold about you and how we use it
- Correct, complete or update it
- Delete it, except where the law requires us to keep it
- Stop using it, by withdrawing your consent
- Deal with a complaint about how we have handled it
- Act for someone else, if you have been nominated to do so
Visitors in the European Union and United Kingdom have similar rights under the GDPR and may also complain to their local data protection authority. To use any of these rights, contact us as in section 13. We may ask you to prove your identity first.
10. Keeping it safe
Our site uses HTTPS encryption. Access to guest records is limited to the people who need it to run your stay. No system is perfectly secure; if a breach affected your data, we would tell you and the authorities as the law requires.
11. Children
We do not knowingly collect data from children except as part of a family booking made by a parent or guardian, such as a child’s name or ID for guest registration.
12. Data stored outside India
Some of our service providers, such as Google, Mapbox and Meta, may process data on servers outside India. We use only established providers that protect data under their own published policies.
13. Changes and contact
We may update this policy; the date at the top shows the latest version.
Grievance Officer: Rahul Khanna, StayAtAloha, 11/203, Charvi Reemz, Anjuna Mapusa Road, opp. Oxford Arcade, Dmello Vaddo, Anjuna, Goa 403509. Email stayataloha.info@gmail.com. Phone +91 84476 11641. We aim to reply within 7 days and to resolve any complaint within 30 days.