Welcome to MoveTara Stay ("we", "us", "our", or the "Platform"). This Privacy Policy explains how MoveTara, a company headquartered at Hyderabad, Telangana 500019, India, founded by Pradhudas Avanigadda and Parise Lakshmi Venkata Subrahmanyam, collects, uses, stores, and protects your personal information when you use the MoveTara Stay mobile application (the "App"). By downloading, installing, or using the App, you consent to the practices described in this policy.

1. Definitions

• "User" / "You": Any individual who downloads, registers on, or uses the MoveTara Stay App to search for or book accommodation
• "Property Partner": Hostel owners, PG operators, or co-living space providers who list their properties on MoveTara Stay
• "Booking": A confirmed reservation of a bed, room, or accommodation unit made through the App
• "Personal Data": Information that identifies or can be used to identify an individual, as defined under the Digital Personal Data Protection Act, 2023 (DPDPA)
• "Data Fiduciary": MoveTara, as the entity that determines the purpose and means of processing your personal data
• "Payment Partner": Razorpay Software Private Limited, our authorized payment gateway provider

2. Information We Collect

We collect the following categories of personal and non-personal information:

2.1 Information You Provide Directly

Category	Data Points	Purpose
Account & Identity	Mobile phone number, OTP verification	Account creation, authentication
Profile Information	Full name (first name, last name), email address, profile photo (optional)	Personalization, booking confirmation, communication
Booking Details	Check-in/check-out dates, number of guests, room/bed preferences, special requests	Processing reservations
Communication Data	Support messages, feedback, reviews, ratings	Customer service, quality improvement

2.2 Information Collected Automatically

Category	Data Points	Purpose
Device Information	Device model, operating system, app version, unique device identifiers, push notification tokens	App compatibility, notifications, analytics
Location Data	Approximate location (city/area level) when you grant permission; precise GPS coordinates for nearby search	Showing nearby properties, distance calculations
Usage Data	Search queries, properties viewed, filters applied, booking flow interactions, session duration	Improving search results, app experience
Log Data	IP address, access timestamps, error logs, crash reports	Debugging, security monitoring

2.3 Information from Third Parties

Source	Data	Purpose
Property Partners	Property details, pricing, availability, amenities, photos	Displaying accurate listings
Razorpay (Payment Partner)	Transaction status, payment confirmation, refund status	Payment processing, booking confirmation

3. How We Use Your Information

We use your personal data strictly for the following purposes:

• Account Management: Creating, authenticating, and managing your user account via Firebase phone OTP
• Booking Services: Processing reservations, confirming bookings, generating booking receipts, and managing check-in/check-out
• Payment Processing: Initiating and tracking payments through Razorpay, processing refunds, and maintaining transaction records
• Search & Discovery: Displaying relevant hostels and PGs based on your location, search queries, and preferences
• Communication: Sending booking confirmations, payment receipts, check-in reminders, and customer support responses
• Safety & Security: Detecting and preventing fraud, unauthorized access, and abuse of the platform
• Legal Compliance: Meeting obligations under Indian tax laws (GST), consumer protection regulations, and data protection laws
• Analytics & Improvement: Understanding usage patterns in anonymized/aggregated form to improve the App experience

4. Legal Basis for Processing

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000, we process your data on the following legal bases:

Legal Basis	Processing Activity
Consent	Account registration, location access, push notifications, marketing communications (you can withdraw consent at any time)
Contract Performance	Processing bookings, payments, and refunds — necessary to deliver the service you requested
Legitimate Interest	Fraud prevention, security monitoring, service improvement through anonymized analytics
Legal Obligation	Tax compliance (GST records), responding to lawful government requests, Consumer Protection Act compliance

5. Information Sharing & Disclosure

We share your personal data only in the following limited circumstances:

5.1 With Property Partners

When you make a booking, we share your name, phone number, check-in/check-out dates, and booking details with the Property Partner to fulfill your reservation. Property Partners are contractually obligated to use your data solely for the purpose of your stay and must comply with applicable data protection laws.

5.2 With Service Providers

We engage trusted third-party service providers who process data on our behalf under strict contractual obligations:

• Razorpay — payment processing (PCI-DSS Level 1 compliant)
• Firebase (Google) — phone authentication and push notifications
• Supabase — database hosting and backend infrastructure

5.3 For Legal Reasons

We may disclose your data if required by law, court order, or government authority, or to protect the rights, property, or safety of MoveTara, our users, or the public.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. You will be notified via email and/or in-app notice before your data is transferred and becomes subject to a different privacy policy.

6. Third-Party Service Providers

Service Provider	Purpose	Data Processed	Privacy Policy
Razorpay Software Pvt. Ltd.	Payment gateway & processing	Transaction amount, payment method, status	razorpay.com/privacy
Firebase (Google LLC)	Phone authentication (OTP), push notifications	Phone number, device token, auth events	firebase.google.com/support/privacy
Supabase Inc.	Database, backend infrastructure	All app data (encrypted at rest)	supabase.com/privacy
Expo (820 Industries Inc.)	App build & update infrastructure	Device metadata, crash reports	expo.dev/privacy

7. Payment Data & Razorpay

MoveTara Stay uses Razorpay Software Private Limited as its exclusive payment gateway for all in-app transactions.

• All payment card data (card number, CVV, expiry) is collected and processed exclusively by Razorpay in their PCI-DSS Level 1 compliant environment
• MoveTara never receives, stores, or has access to your full card number or bank credentials
• We receive only: transaction ID, payment status (success/failed/pending), amount, and timestamp from Razorpay
• Razorpay may store your card details for faster future payments if you opt in via their tokenization system (as per RBI guidelines on card-on-file tokenization)
• UPI payments are processed through Razorpay's UPI infrastructure — we do not access your UPI PIN or linked bank account details

8. Location Data

MoveTara Stay requests access to your device location to provide location-based hostel search.

• When accessed: Only when you actively use the search/explore feature and have granted location permission
• Type of data: GPS coordinates (latitude, longitude) for precise nearby search; approximate city/area for general browsing
• Storage: Your precise location is not stored on our servers. It is used in real-time to calculate distances and is discarded after the search session
• Background access: We do not access your location in the background. Location is requested only when the App is in the foreground
• Opt-out: You can deny or revoke location permission at any time from your device Settings. The App will continue to work — you can manually enter your city or area to search

9. Cookies & Tracking Technologies

The MoveTara Stay mobile app does not use browser cookies. However, we may use the following technologies:

• Firebase Analytics events: Anonymous usage events (screen views, button taps) for understanding app usage patterns
• Crash reporting: Automatic error and crash reports to improve app stability
• Local storage: Authentication tokens stored securely in the app sandbox (AsyncStorage) on your device

We do not use any cross-app tracking identifiers, advertising IDs, or fingerprinting techniques.

10. Data Storage, Security & Encryption

We implement industry-standard security measures to protect your personal data:

• Encryption in transit: All data transmitted between the App and our servers is encrypted using TLS 1.2 or higher
• Encryption at rest: All database records are stored on Supabase infrastructure with AES-256 encryption at rest
• Access control: Production database access is restricted to authorized MoveTara engineering personnel only, with role-based access control (RBAC)
• Authentication security: Phone OTP is managed by Firebase Authentication with automatic rate limiting and abuse detection
• Payment security: All payment data is handled by Razorpay's PCI-DSS Level 1 certified infrastructure — card data never reaches our servers
• Server security: Our backend infrastructure is protected by rate limiting (60 req/s reads, 20 req/s writes), input validation, and RBAC on every API endpoint
• Regular audits: We conduct periodic security reviews of our infrastructure and application code

11. Data Retention

Data Category	Retention Period	Reason
Account data (profile, phone)	Duration of active account	Service delivery
Booking records	3 years after checkout	Legal compliance (Consumer Protection Act), dispute resolution
Payment transaction records	7 years after transaction	Tax compliance (GST Act, Income Tax Act), audit requirements
Support/communication data	2 years after last interaction	Service quality, dispute resolution
Deleted account data	Permanently deleted within 30 days of request	DPDPA 2023 compliance
Anonymized analytics	Indefinite	Non-identifiable, used for trend analysis

12. Your Rights Under DPDPA 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023 (DPDPA), you have the following rights:

• Right to Access: Request a summary of all personal data we hold about you and the processing activities performed on it
• Right to Correction: Request correction or completion of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Grievance Redressal: File a complaint with our Grievance Officer or escalate to the Data Protection Board of India
• Right to Nominate: Nominate another individual to exercise your rights in case of death or incapacity
• Right to Withdraw Consent: Withdraw previously given consent at any time; withdrawal does not affect the lawfulness of processing performed before withdrawal

To exercise any of these rights, contact our Grievance Officer at privacy@movetara.com. We will acknowledge your request within 48 hours and respond within 30 days.

13. Account Deletion

You may delete your MoveTara Stay account at any time:

• In-App: Go to Profile → Settings → Delete Account
• Via Email: Send a request to privacy@movetara.com from your registered phone number's associated email

Upon account deletion:

• Your profile, authentication credentials, and preferences are deleted immediately
• Active bookings (if any) will be cancelled and refund eligibility assessed per our Refund Policy
• Historical booking and payment records are retained for the minimum period required by law (see Section 11)
• You will receive a confirmation when deletion is complete

14. Children's Privacy

MoveTara Stay is a consumer accommodation booking platform intended for users aged 18 years and above. We do not knowingly collect, process, or store personal data from children under 18 years of age. If you are a parent or guardian and believe your child has provided personal data through the App, please contact us immediately at privacy@movetara.com and we will delete such data within 72 hours.

15. International Data Transfers

Your data is primarily stored and processed in India. However, some of our third-party service providers (Firebase/Google, Expo) may process data in other jurisdictions. In such cases:

• We ensure that appropriate safeguards are in place as required by DPDPA 2023
• Data is only transferred to jurisdictions that the Central Government has approved or to entities with adequate security measures
• Contractual obligations require all service providers to maintain equivalent data protection standards

16. Push Notifications

MoveTara Stay may send push notifications for:

• Booking confirmations and status updates
• Check-in reminders and check-out notifications
• Payment receipts and refund status updates
• Promotional offers and new property alerts (with your consent)

You can enable or disable notifications at any time from your device Settings or within the App under Profile → Notification Preferences. Disabling notifications does not affect your ability to use the App or manage bookings.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will notify you via push notification and/or an in-app banner at least 14 days before the changes take effect
• The updated policy will be posted at this URL with a revised "Last Updated" date and incremented version number
• For significant changes, we may require you to re-acknowledge the updated policy before continuing to use the App
• Continued use of the App after the effective date constitutes your acceptance of the updated policy

18. Grievance Officer

In compliance with the Information Technology Act, 2000 (Section 5C of the IT Intermediary Guidelines, 2021) and the Digital Personal Data Protection Act, 2023, we have appointed the following Grievance Officer:

Name	Pradhudas Avanigadda
Designation	Founder & Grievance Officer
Email	privacy@movetara.com
Address	MoveTara, Hyderabad, Telangana 500019, India
Acknowledgment	Within 48 hours of receipt
Resolution Time	Within 30 days of receipt of complaint

If you are not satisfied with the resolution provided by the Grievance Officer, you may file a complaint with the Data Protection Board of India as established under the Digital Personal Data Protection Act, 2023, or approach the appropriate consumer forum under the Consumer Protection Act, 2019.

19. Governing Law

This Privacy Policy is governed by the laws of the Republic of India, including but not limited to:

• Digital Personal Data Protection Act, 2023 (DPDPA) — primary data protection legislation
• Information Technology Act, 2000 and IT (Reasonable Security Practices) Rules, 2011
• Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020
• Payment and Settlement Systems Act, 2007 — governing payment processing via Razorpay

Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the competent courts in Hyderabad, Telangana, India.

20. Contact Us