Privacy Policy

1. Data we collect

Account data

• Name, email address, password hash (never the password itself), and optional phone number, city, occupation, bio and avatar.
• Role, verification status, notification and privacy preferences.
• If you use Google sign-in: your Google account identifier, verified email, name and profile photo. We do not receive your Google password.

Listing and usage data

• Listing content, photos, rent, deposit, occupancy, amenities, house rules and approximate coordinates.
• Enquiries, chat messages, visit requests, favourites, reports and moderation history.
• Technical data such as IP address, user agent, timestamps, and audit logs of security-relevant actions.

2. Why we use it

• To create and secure your account, authenticate sessions and prevent fraud and abuse.
• To publish listings, power search and maps, and connect seekers with hosts.
• To deliver chat, enquiries, visit coordination and notifications you request.
• To moderate listings and investigate reports.
• To send transactional email such as verification links, password resets, security alerts and moderation decisions, subject to your preferences.
• To comply with legal obligations and enforce our Terms.

3. Legal bases

Where required, we rely on performance of a contract (providing the service you requested), legitimate interests (safety, fraud prevention, product improvement), consent (optional marketing or non-essential cookies), and legal obligation. You can withdraw consent at any time without affecting prior processing.

4. What is visible to others

• Public listing pages show the property details, locality, approximate map location and the host’s name, avatar and verification badge.
• Public listing pages do not show your email, phone number or exact private address.
• Chat participants can see messages and attachments exchanged in that conversation.
• Administrators can access listing, account and report data to perform moderation and support.

5. Cookies and sessions

We use HttpOnly, Secure, SameSite cookies for authentication and refresh tokens, plus a readable CSRF token for double-submit protection. We do not store long-lived access tokens in browser localStorage. You can clear cookies in your browser, which signs you out.

6. Service providers

We share the minimum data necessary with infrastructure providers that help us run the service. Depending on the environment these may include cloud hosting, MongoDB database hosting, Cloudinary (image storage and delivery), an email delivery provider, Twilio (SMS one-time codes) and Google (OAuth sign-in). Providers process data under their own terms and data-processing agreements. We do not sell personal data.

7. Retention

• Account and listing data is retained while your account is active.
• When you delete your account, personal profile fields are removed or anonymised, active listings are archived and sessions are revoked.
• Audit logs, moderation records and reports may be retained for a limited period to meet legal, safety and dispute-resolution obligations.
• Backups are retained on a rolling schedule and expire automatically.

8. Security

We use password hashing (bcrypt), HttpOnly cookie sessions, CSRF protection, rate limiting, request sanitisation, role-based access control, audit logging and encrypted transport in production. No system is perfectly secure; if you suspect unauthorised access, change your password, sign out of all devices and email privacy@staycircle.in.

9. Your rights

• Access, correct or delete your personal data from Account & security, or by emailing us.
• Object to or restrict certain processing, and withdraw consent where processing is consent-based.
• Export the profile and listing data you provided, on request.
• Lodge a complaint with your local data protection authority.

To exercise these rights, email privacy@staycircle.in. We may need to verify your identity before acting.

10. Children

StayCircle is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will remove it.

11. International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses for those transfers.

12. Changes and contact

We may update this policy and will announce material changes on the platform or by email. Questions: privacy@staycircle.in. See also our Terms of Service.