Privacy policy

Rukiye Zara is a curated short-stay booking platform operated by Rukiyation Hospitality LLP, registered in India. We operate the Rukiye Zara website, mobile application, and hospitality software (PMS, Booking Engine, Channel Manager, and related tools).

For this Privacy Policy, Rukiyation Hospitality LLP is the data fiduciary responsible for personal data processed through our platform.

This policy applies to everyone who interacts with Rukiye Zara in any of these roles:

• Guests
• Software plan hosts
• RZ listed hosts
• Visitors

Some hosts may be both RZ listed and on a software plan. Where it matters, this policy clarifies what applies to each role.

Guests

• Identity: Name, email, phone number.
• Booking: Dates, property, guest count, payment status, reservation history.
• Payment: Transaction reference and status. Card details are processed by our payment gateway (Cashfree); we do not store full card numbers on our servers.
• Device & usage: IP address, device type, OS, browser, and pages visited on the website.

RZ listed hosts

• Identity & business: Name, business name, email, phone, registered address.
• Property: Descriptions, photos, rooms, amenities, availability, pricing, house rules.
• Financial: Bank details for payouts, PAN, GSTIN where applicable, tax registrations.
• Performance: Reservations, earnings, reviews, cancellations.

Software plan hosts

• Everything listed for RZ listed hosts where relevant.
• Subscription: Plan, billing, invoices.
• Operational: Data entered in PMS, Booking Engine, or Channel Manager (inventory, pricing, reservations, channel mappings).

All users (automatic)

• Website analytics: Pages, session duration, clicks — via Google Analytics and Microsoft Clarity on the website only (not in the mobile app).
• Device: Storage access (hosts uploading listing photos), vibration (notification feedback), OS version.
• Verification: SMS OTP and email codes processed in real time; not retained beyond the verification event.

Core platform

• Bookings, payments, and reservation management.
• Identity verification and fraud prevention.
• Communication between guests and hosts.
• Host payouts and software subscription billing.
• Providing and improving PMS, Booking Engine, and Channel Manager.

Safety & legal

• Compliance with Indian law, tax, KYC, and the Digital Personal Data Protection Act 2023.
• Disputes, chargebacks, and misuse investigations.
• Lawful requests from government or regulators.

Improvement

• Usage analysis, bug fixes, and feature quality.
• Performance and reliability monitoring.
• Internal research and QA.

Communications

• Transactional: confirmations, receipts, support.
• Service: policy updates, account alerts, payout status.
• Where you have not opted out: promotional or informational email or WhatsApp messages.

We do not sell personal data. We share it only as follows:

Between guests and hosts

• After a booking is confirmed, we share the guest's name and contact details with the host.
• Guests see property details, rules, and cancellation terms as part of booking.

Service providers

• Cashfree Payments — payments and host payouts.
• Google Analytics & Tag Manager — website analytics (website only).
• Microsoft Clarity — session behaviour (website only).
• Brevo (Sendinblue) — email delivery.
• AiSensy / WhatsApp Business API — WhatsApp messages.
• SMS gateway — OTP verification.
• Cloud / infrastructure — hosting and operations.

Authorities

• When required by law, court order, or lawful regulatory request.
• When we reasonably believe disclosure protects people, property, or the public.

Each provider has its own privacy policy. We are not responsible for their practices; please read their terms.

The app may request:

We do not require camera, microphone, contacts, location, or call logs. You can revoke permissions in device settings; some features may stop working.

Essential

Session, authentication, and security — required for the site to work.

Analytics

Google Analytics and Microsoft Clarity on the website (not in the app). You can opt out of Google Analytics via Google's opt-out tool.

Marketing

Google Tag Manager and Meta pixel may measure campaigns and set cookies across sessions. This is not linked to your Rukiye Zara account without your consent.

We keep data only as long as needed for the purpose collected or as the law requires.

After retention, data is deleted or anonymised. Where law blocks immediate deletion, we restrict use until deletion is allowed.

Under the DPDP Act 2023 and other applicable Indian law, you may have rights including:

• Access — copy of your personal data.
• Correction — fix inaccurate or incomplete data.
• Erasure — request deletion, subject to legal and operational limits (see section 11).
• Withdraw consent — where processing is consent-based; past processing is unaffected.
• Grievance — contact support if you believe data was mishandled.
• Nomination — you may nominate someone to exercise your rights on death or incapacity, as the Act allows.

Email support@rukiyezara.com with your account details and request. We respond within reasonable timeframes and any statutory deadline.

Request deletion via rukiyezara.com/delete-account or email support@rukiyezara.com with subject Account Deletion Request and your registered email or phone.

When we accept a request, we will:

• Acknowledge within 7 working days.
• Deactivate the account from active use promptly.
• Delete or anonymise data that is no longer required.
• Retain what the law requires, then delete after that period.
• Tell you if anything cannot be deleted yet and why.

If you have active trips, bookings, or payouts, we may ask you to resolve those first.

We do not knowingly collect data from people under 18. The platform is for adults.

Guests under 18 must stay with a legal guardian, who is responsible for the stay and for any data submitted about the minor.

If we learn we collected a child's data without proper guardian consent, we delete it. Report concerns to support@rukiyezara.com.

Transactional

We send essential messages (confirmations, receipts, payouts, OTPs, security alerts) regardless of marketing preferences.

Email marketing

We may send offers or updates. Unsubscribe from any marketing email or contact support to opt out.

SMS

SMS is for OTP verification only — not marketing.

We follow strict data-protection guidelines, including GDPR-aligned practices where applicable, alongside Indian law including the DPDP Act 2023. Our goal is fair platform usage: we do not misuse your data or market on it unless specified in our agreement with you, and we never charge you without authorization for the relevant order or plan.

We use technical and organisational measures appropriate to the risk, including:

• HTTPS/TLS in transit.
• Role-based access for staff.
• Token-based app authentication.
• PCI-DSS compliant payment processors.
• Monitoring and security reviews.

No system is perfectly secure. If a breach likely affects you, we notify as required by law.

We may update this policy and related terms for practices, technology, law, or operations. For material changes we will:

• Update the "Last updated" date on this page.
• Notify registered users by email or in-app notice when handling of their data changes materially.

Continued use after an update means you accept the revised policy. If you disagree with a material change, you may request account deletion (section 11). If you are unsure which policies apply to you, email support@rukiyezara.com — we will respond promptly.

This section applies if you join the Rukiye Zara Agent Program at rukiyezara.com/agent.

Data we collect from agents

• Identity & contact: Full name and mobile number (verified via OTP; your mobile number also serves as your agent referral code).
• Payout: UPI ID and city.
• Tax: PAN, where annual payouts approach statutory thresholds.
• Optional: Profile photo, if you request an Agent ID card.

Why we collect it

We use agent data to:

• Operate the referral program — attributing referrals and calculating commissions.
• Pay commissions to your UPI account.
• Send program notifications on WhatsApp and SMS (for example payout updates and milestone alerts).
• Comply with tax law, including TDS deduction and reporting.
• Prevent fraud and misuse of the program.

Referral attribution

When someone opens an agent's referral link, we store the referring agent's code in a cookie or local storage on that device for up to 30 days to attribute a subsequent host signup. Hosts may also enter an agent's code manually at signup.

What hosts should know

If you signed up through an agent's referral, that agent can see your property's name and high-level progress status (for example listing live, milestone reached) in their dashboard. Agents cannot see your guest data, booking details, revenue figures, or contact information.

Sharing

Agent data is not sold. It is shared only with payment processing (UPI transfer), tax authorities as legally required (TDS filings, Form 16A issuance), and our service providers for notifications.

Retention

Agent and payout records are retained as required for tax and accounting law (minimum 8 years from the relevant financial year), after which they are deleted or anonymised. Agents may request account closure at any time; earned-but-unpaid commissions are settled before closure.

For privacy questions, data requests, or grievances, contact Rukiye Zara Support. We aim to acknowledge requests within 7 working days.

If you are not satisfied with our response, you may later approach the Data Protection Board of India once constituted under the DPDP Act 2023, or another competent authority under applicable law.