Privacy Policy

PaulStays respects your privacy and is committed to protecting the personal information you place in our hands. When you plan a journey with us, you share your travel plans, your contact details, your identity documents and your payment information. This Privacy Policy explains — in plain language — what we collect, why we collect it, how we use it, when we share it, how long we keep it, how we protect it, and what rights you have over it.

PaulStays is a stay discovery and booking platform created for travellers who want to Stay Beyond the Ordinary across North East India, Bhutan and other selected destinations. Through PaulStays, travellers can discover and book verified homestays, boutique villas, mountain retreats, heritage homes, forest cottages, riverside cottages, community stays and local guesthouses.

PaulStays is a brand of BREAKBAG HOLIDAYS PRIVATE LIMITED (CIN: U63090WB2015PTC208218; GSTIN: 19AAGCB4757N1Z1), a company incorporated in 2015 under the Companies Act, 2013 and headquartered at Kolkata, West Bengal, India (the “Company”, and together with the PaulStays brand, “PaulStays”, “we”, “us” or “our”).

This Privacy Policy applies to every User of the Platform, including Guests, Hosts, property owners, property managers, accommodation providers, vendors, service partners, visitors, enquirers and registered account holders, wherever located.

By accessing, browsing, registering, listing a property, making an enquiry, confirming a booking, making a payment, contacting our support team, communicating through PaulStays, or otherwise using the Platform, you confirm that you have read and understood this Privacy Policy, and — where consent is the applicable lawful basis — you consent to the processing of your personal data as described here. If you do not agree with this Privacy Policy, please do not use the Platform.

2.1 This Privacy Policy forms part of the PaulStays User Agreement and must be read together with:

• the PaulStays Terms and Conditions;
• the PaulStays Cancellation and Refund Policy;
• the PaulStays Guest Terms;
• the PaulStays Host Agreement;
• the booking confirmation, voucher, invoice or itinerary issued for a specific Stay;
• any property-specific house rules or policies; and
• any other policy, notice or instruction published or communicated by PaulStays.

2.2 Order of precedence. Where there is any conflict between this Privacy Policy and the Terms and Conditions on a matter concerning privacy, personal data or data protection, this Privacy Policy shall prevail. On all other matters — including booking, cancellation, refund, Host obligations, Guest obligations, payment and liability — the Terms and Conditions and the relevant specific policy shall prevail.

2.3 Words defined in the Terms and Conditions — including Guest, Host, User, Listing, Booking, Stay, Add-On Services, Service Fee and Applicable Law — carry the same meaning in this Privacy Policy, unless a different meaning is given in Section 3 below.

For the purposes of this Privacy Policy:

“Company” means BREAKBAG HOLIDAYS PRIVATE LIMITED, CIN U63090WB2015PTC208218.

“Data Fiduciary” means the person who alone or in conjunction with others determines the purpose and means of processing personal data, as defined under the DPDP Act. In relation to the data described in this Privacy Policy, the Company is the Data Fiduciary.

“Data Principal” means the individual to whom the personal data relates, as defined under the DPDP Act. If you are a User, you are a Data Principal.

“DPDP Act” means the Digital Personal Data Protection Act, 2023, together with the rules, regulations and notifications made under it, as amended from time to time.

“PaulStays” and the expressions “Paul Stays”, “we”, “us” and “our” mean PaulStays, a brand of BREAKBAG HOLIDAYS PRIVATE LIMITED.

“Personal Information” or “Personal Data” means any information relating to an individual who is identifiable, directly or indirectly, by or in relation to such information — including name, mobile number, email address, postal address, identity document, location, payment reference, booking details, travel details, property details, communication records and any other identifiable information.

“Platform” means the PaulStays website at www.paulstays.com, the PaulStays mobile application, web pages, booking system, listing dashboard, host dashboard, support channels, WhatsApp and email communication, payment links, and any other digital or offline interface operated by or on behalf of PaulStays.

“Processing” means any operation performed on personal data, whether wholly or partly automated, including collecting, recording, organising, structuring, storing, adapting, retrieving, using, aligning, sharing, disclosing, restricting, erasing or destroying it.

“Sensitive Information” means personal data warranting a higher standard of care, including government-issued identity documents, passport and visa details, financial and payment account details, and any health, dietary, accessibility or mobility information you voluntarily share with us for the purpose of a Stay.

4.1 As explained in our Terms and Conditions, PaulStays operates as an intermediary and facilitator connecting Guests with independent Hosts. We do not own, operate or manage the properties listed on the Platform.

4.2 For the purposes of the DPDP Act, the Company — acting through the PaulStays brand — is the Data Fiduciary in respect of the personal data it collects and uses for its own platform operations, including account creation, enquiry handling, booking coordination, payment processing, Host onboarding, verification, customer support, safety, fraud prevention, legal compliance and service improvement.

4.3 Where we share personal data with Hosts, vendors, payment gateways, technology providers or other third parties in order to deliver a service, those parties may act either as independent Data Fiduciaries in their own right, or as processors acting on our instructions, depending on their role.

4.4 Hosts as independent Data Fiduciaries. Once a Booking is confirmed and we share your details with a Host, that Host becomes independently responsible for handling your information lawfully — for the purposes of check-in, stay management, guest registers, foreign-guest reporting, safety and service delivery. We require every Host, under the Host Agreement and the Terms and Conditions, to handle that information lawfully, confidentially and only for the purposes of your Stay. However, we are not responsible for a Host’s independent acts or omissions in relation to your data. If you believe a Host has misused your information, tell us at grievance@paulstays.com and we will investigate.

5.1 We process personal data in accordance with the Digital Personal Data Protection Act, 2023; the Information Technology Act, 2000, together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; the Consumer Protection Act, 2019 and the e-commerce rules made under it; and any other Applicable Law, including data protection and tourism laws applicable in Bhutan or in any other destination where a Stay is located.

5.2 Where the law of another jurisdiction grants you rights that are broader than those set out here, or imposes stricter obligations on us, we will comply with those requirements to the extent they apply.

5.3 This Privacy Policy does not govern the independent privacy practices of Hosts, of local vendors, guides or drivers providing Add-On Services, or of any third-party website or application you may reach through a link on the Platform. Those parties operate under their own privacy policies, which we encourage you to review.

6.1 What we collect depends on how you use the Platform. We collect only what is reasonably necessary for the purposes described in Section 8, and we do not ask you for more than that.

6.2 Information we collect from Guests

• Identity and contact data — full name; mobile number; email address; residential city, state or country; and, where you choose to provide it, postal address, profile photograph, date of birth or preferred language.
• Booking data — travel dates; destination preference; the Listing selected; guest count and the names of accompanying guests; age group, child or infant details where needed for the booking; room or unit configuration; selected Add-On Services; special requests; and your booking history.
• Identity documents — government-issued photo identity (such as Aadhaar, PAN, voter ID, driving licence or passport) where required for check-in, for a permit, or for compliance with Applicable Law.
• Permit and travel-compliance data — passport, visa and permit-related information required for Bhutan, restricted or protected areas, including data needed for an Inner Line Permit, Protected Area Permit, Restricted Area Permit, Bhutan entry permit, Sustainable Development Fee payment or Form C reporting.
• Payment data — payment status; transaction ID; payment method type; bank or payment gateway reference; refund reference; partial or balance payment information; invoice and GST billing details where requested.
• Stay preferences and voluntary information — food or dietary preferences, and any accessibility, mobility, medical or health information you voluntarily share with us so that we can assess whether a Stay is suitable for you.
• Reviews and feedback — reviews, ratings, photographs, complaints, feedback and support requests you submit.
• Communication records — your enquiries, messages, emails, WhatsApp exchanges, chat transcripts, support tickets and call notes. Support calls may be recorded for quality and training purposes, and you will be informed where this occurs.

6.3 Information we collect from Hosts

• Identity and contact data — the full name of the owner, operator or authorised representative; mobile number; email address; and address.
• Property data — property name and address; map coordinates; photographs, videos and descriptions; room or unit details; amenities; house rules; pricing; availability calendar; and cancellation terms.
• Ownership and authorisation data — documents evidencing ownership, lease, management authority or written authorisation to list the property.
• Licensing and compliance data — tourism or homestay registration, municipal permissions, fire-safety clearance, trade licence, and any other permit or approval required to operate the property lawfully.
• Identity and tax data — government-issued photo identity, PAN, GSTIN and other tax details, collected for verification, payout and statutory purposes.
• Payout data — bank account name, account number and IFSC, or UPI identifier, collected solely to remit amounts due to you.
• Operational and performance data — guest-handling policies, check-in rules, booking acceptance and cancellation history, response times, guest ratings, complaint records, payout history, commission records and service history.
• Communication records — your communications with PaulStays and with Guests through the Platform.

6.4 Information we collect from visitors and browsers

• IP address; device type and identifiers; browser type and version; operating system; app version; time zone.
• Approximate location derived from your device or IP address, and precise location only where you expressly enable it.
• Pages and Listings visited; search queries; filters applied; time spent on pages; click and interaction behaviour; referral source; session duration.
• Cookie identifiers and similar technical identifiers.
• Enquiry-form data you submit, and crash or diagnostic logs.

6.5 Information we receive from third parties

• From payment gateways, banks, card networks and payment aggregators — transaction status, settlement confirmation, refund status and chargeback notices.
• From Hosts — where a Host reports an incident, damage claim, no-show or rule violation involving you.
• From Guests, group leaders, travel agents or organisations booking on your behalf — in which case the person making the booking confirms to us that they are authorised to share your details.
• From authentication and login providers, where you choose to sign in using a third-party account, in which case we receive the verified name and email address that provider shares with us.
• From mapping, location, analytics, security and anti-fraud service providers — in the form of aggregated, pseudonymised or technical signals.
• From communication providers (WhatsApp, SMS and email) — delivery and engagement status.
• From travel partners, local vendors and experience providers, in connection with an Add-On Service you have requested.
• From government authorities, where required by law, and from publicly available sources such as websites, public map listings and business registries, where we verify a licence, registration or permit.

7.1 Directly from you

We collect data when you create an account; submit an enquiry; make a booking; make a payment; list a property; upload documents, photographs or property details; respond to a verification request; communicate with us or with a Host by phone, WhatsApp, email, website chat, app notification or support channel; submit a review, complaint or feedback; or take part in an offer, campaign or survey.

7.2 Automatically, as you use the Platform

We and our service providers collect technical and usage data automatically through cookies, software development kits, pixels, tags, scripts and log files. This tells us, for example, which Listings are viewed, where a booking journey is abandoned, whether a page is loading slowly, and whether an account shows signs of unauthorised access. Section 17 explains cookies and your choices.

7.3 From third parties

We receive data from the sources described in Clause 6.5. Where a third party shares your personal data with us, we rely on that party’s confirmation that it is authorised to do so, and we process the data in accordance with this Privacy Policy.

7.4 Offline and in person

Where you interact with our team by telephone, at a travel event or exhibition, or through a partner, we may record the details you provide so that we can respond to your enquiry.

8.1 The table below sets out each purpose for which we process personal data, and the lawful basis on which we do so. Under the DPDP Act, we process personal data either with your consent, or for a “legitimate use” permitted by that Act — including where you have voluntarily provided data for a specified purpose and have not objected to its use, or where processing is required to comply with a legal obligation, a court order or a lawful request from an authority.

8.2 We will not use your personal data for any purpose materially different from those described above unless we first inform you and, where required, obtain your consent.

9.1 Where we rely on your consent, we seek it through a clear, specific and unambiguous affirmative action — for example, ticking a box, tapping a consent button, or opting in to marketing. We will always tell you what we are asking consent for, and you are free to decline.

9.2 You may withdraw your consent at any time, with the same ease with which you gave it — by using the unsubscribe link in any marketing message, by adjusting your account or cookie preferences, or by writing to support@paulstays.com.

9.3 Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal. Nor does it affect processing we are required to carry out under Applicable Law, or that is necessary to complete a Booking you have already made, to settle a payment, or to establish or defend a legal claim.

9.4 Consequence of withdrawal. Withdrawing consent may affect your ability to use parts of the Platform. For example, if you withdraw consent to identity verification, payment processing, Host communication or booking-related communication, we may be unable to confirm, modify, support or complete your Booking. We will tell you where this is the case.

9.5 Where you provide us with the personal data of another person — a co-traveller, a family member, a child, or a colleague — you confirm that you are authorised to share their data with us and that you have informed them of this Privacy Policy.

9.6 In accordance with the DPDP Act, you may give, manage, review or withdraw your consent through a Consent Manager registered with the Data Protection Board of India, once such a facility is available to you.

10.1 We do not sell your personal data. We do not rent it, trade it, or make it available to data brokers or advertisers for their own purposes. We share it only where reasonably necessary — to deliver a service, fulfil a Booking, comply with the law, protect safety, or improve the Platform — and only to the extent necessary.

10.2 With the Host of your Stay

When a Booking is confirmed, we share with the Host the information reasonably needed to receive you — typically the lead guest’s name and contact number, the number of guests, arrival and departure dates, the selected Add-On Services, and any special requirement you have told us about. Where local law requires guest registration or Form C reporting for a foreign national, the Host may also require identity or passport details.

Each Host is required, under the Host Agreement and the Terms and Conditions, to use this information solely for the purposes of your Stay and for compliance with Applicable Law; to keep it secure and confidential; not to retain it for longer than the law permits; and never to sell it, market from it, publish it or otherwise misuse it.

10.3 With Guests, if you are a Host

We display your Listing, the property name, your first name or trading name, the general location and — once a Booking is confirmed — the precise address, your photographs, your check-in instructions, your house rules, your property policies, your contact details, and your ratings and reviews.

10.4 With payment partners

We share the information necessary for payment collection, payout, refund, chargeback handling, reconciliation and fraud prevention with payment gateways, banks, UPI systems, card networks, payment aggregators and refund processors.

10.5 With service providers who help us run the Platform

We engage carefully selected providers to perform functions on our behalf. Each is bound by contract to process your data only on our instructions, to keep it confidential, to apply appropriate security safeguards, and to delete or return it when their engagement ends. These categories are:

10.6 With local vendors and experience providers

Where you book or request an Add-On Service, we share the details necessary to arrange it with the relevant local vendor, guide, driver, experience provider, community partner or supplier — typically your name, contact number, the date and time, and any specific requirement you have told us about.

10.7 With authorities and in legal proceedings

We may disclose personal data where required by Applicable Law, or in response to a valid and lawful request from a court, police, tax authority, tourism department, immigration authority, regulator, the Data Protection Board of India, or another competent body — including for guest registration, foreigner reporting, permit verification or tax compliance. We may also disclose data where necessary to establish, exercise or defend a legal claim, to enforce our Terms and Conditions, or to protect the rights, property, life or safety of any person.

10.8 In a corporate transaction

If PaulStays or BREAKBAG HOLIDAYS PRIVATE LIMITED undergoes a merger, acquisition, restructuring, investment, asset sale, business transfer or change of control, personal data may be transferred to the counterparty or successor as part of that transaction. Any such recipient will remain bound by commitments no less protective than those in this Privacy Policy, and we will notify you where the law requires it.

10.9 With your direction

We will share your data with any other party where you specifically ask or authorise us to do so.

11.1 Hosts and Guests receive each other’s personal information through the Platform for the limited purpose of managing a Booking or a Stay. This is a serious responsibility, and it is not a licence to use that information for anything else.

11.2 Both Hosts and Guests agree that they will:

• use the information only for the relevant Booking or Stay, and for compliance with Applicable Law;
• not disclose the information to any unauthorised person;
• not publish phone numbers, identity documents, addresses, photographs or private messages without consent;
• not use the information for spam, harassment, unsolicited marketing, or any communication unrelated to the Stay;
• not attempt to contact the other party for the purpose of transacting outside the Platform;
• keep the information reasonably secure; and
• delete or stop using the information once it is no longer required, unless retention is required by law.

11.3 Any misuse of personal information obtained through the Platform may result in suspension of the account, cancellation of Bookings, a hold on payouts, delisting, legal action, and reporting to the appropriate authorities.

12.1 PaulStays operates primarily from India. However, some of our cloud, communication, analytics, payment and support providers may process or store information outside India. Your personal data may therefore be transferred to, stored in, or accessed from a country other than the one in which you are located.

12.2 We carry out such transfers in accordance with the DPDP Act, and we do not transfer personal data to any country or territory that the Central Government has restricted for this purpose. Where we transfer data outside India, we put in place appropriate contractual, technical and organisational safeguards requiring the recipient to protect it to a standard consistent with this Privacy Policy and with Applicable Law.

12.3 Where a Stay is located in Bhutan or another international destination, the information necessary to receive you will be shared with the Host, and where required with vendors, permit coordinators, local partners, immigration or tourism authorities, or government agencies in that destination — for booking, check-in, entry, permits, legal compliance and safety. Those parties will handle it in accordance with the law of that country.

13.1 We keep personal data only for as long as we need it for the purpose for which it was collected, or for as long as Applicable Law requires us to keep it — whichever is longer. When neither applies, we delete it or irreversibly anonymise it.

13.2 The following retention periods generally apply. They are indicative, and a longer period may apply where a dispute, investigation, audit, claim, chargeback, police matter, tax matter or legal proceeding is ongoing or reasonably anticipated, or where a specific law requires it.

13.3 Retention after a dispute, fraud or legal claim. Where a Booking, Host account, Guest account, payment, refund, complaint, chargeback, police matter, legal notice, tax matter or dispute is involved, we may retain all relevant information until the matter is finally resolved and for any additional period required under Applicable Law. This may include communications, documents, payment records, Host and Guest details, complaint records, identity verification records, invoices, refund logs and internal notes.

13.4 Where we anonymise data so that it can no longer be linked to you, we may retain and use that anonymised data indefinitely — for example, to understand travel trends across a destination.

14.1 Under the DPDP Act and other Applicable Law, you have the following rights in relation to your personal data:

• Right to access — to obtain a summary of the personal data we hold about you, the processing we carry out, and the identities of those with whom we have shared it.
• Right to correction and completion — to have inaccurate or misleading data corrected, and incomplete data completed or updated.
• Right to erasure — to have your personal data deleted, unless we are required to retain it under Applicable Law or for the purposes set out in Section 13.
• Right to withdraw consent — at any time, as described in Section 9.
• Right to opt out of marketing — to unsubscribe from promotional communication at any time, while continuing to receive essential service messages about your Bookings.
• Right to grievance redressal — to raise a complaint with our Grievance Officer, whose details appear in Section 24.
• Right to nominate — to nominate another individual who may exercise your rights on your behalf in the event of your death or incapacity.
• Right to information — to be told, in clear terms, about our data-handling practices and our grievance redressal mechanism.

14.2 To exercise any of these rights, write to support@paulstays.com or grievance@paulstays.com, or call +91-7699002674. We may need to verify your identity before we act, so that we do not disclose your data to the wrong person. We will respond within thirty (30) days, or sooner where the law requires.

14.3 We do not charge a fee to exercise these rights. A request may be refused or limited in part where retention is required for legal compliance, fraud prevention, tax or accounting records, dispute resolution, contractual performance, or a regulatory requirement — and where we refuse, we will tell you why. Where a request is manifestly unfounded, excessive or repetitive, we may decline to act on it.

14.4 Your duties under the DPDP Act. You have a duty to provide information that is authentic and not false or misleading; not to impersonate another person; not to suppress material information where you are legally required to disclose it; and not to file a frivolous or false complaint. Filing a false or frivolous grievance may attract a penalty under that Act.

14.5 If you are not satisfied with how we have handled your request or complaint, you may escalate the matter to the Data Protection Board of India.

15.1 Your responsibility for accuracy

We rely on the information provided by Users, Hosts, Guests, payment partners and vendors. You confirm that everything you submit to us is true, accurate, complete and current, and you agree to update it promptly whenever it changes. Hosts must in particular keep property details, bank and GST details, contact details, house rules, pricing, permits and licence information up to date at all times.

PaulStays shall not be responsible for any failed booking, denied check-in, payment failure, refund delay, incorrect invoice, wrong permit, vendor coordination issue or legal consequence caused by false, outdated, incomplete or misleading information provided by you.

15.2 Correcting your information

You may correct most of your information directly through your account. For anything you cannot change yourself, write to support@paulstays.com and we will correct it after verifying your identity.

15.3 Deleting your account

You may request deletion or closure of your account by writing to support@paulstays.com. On receiving a valid request, we will verify your identity and, after settling any pending Booking, payout, refund, dispute, legal or tax matter, we will delete or deactivate your account and erase your data from our active systems within thirty (30) days.

Some information will continue to be retained after account deletion, where required for: legal compliance; tax and accounting records; fraud prevention; dispute resolution; enforcement of our Terms and Conditions; protection of rights, safety and property; a regulatory or government requirement; or the record of completed Bookings. Section 13 sets out these periods.

16.1 We apply reasonable technical, organisational and administrative safeguards designed to protect personal data against unauthorised access, misuse, loss, alteration, disclosure or destruction. These include:

• encryption of data in transit using TLS, and encryption of sensitive data at rest;
• role-based access controls, so that our people can access only the data they need for their work;
• password and OTP-based verification, and multi-factor authentication for administrative access;
• restricted access to identity documents, payout details and other sensitive information;
• use of secure, certified payment gateways rather than storing payment credentials ourselves;
• data minimisation — collecting only what we need, and deleting it when we no longer need it;
• confidentiality obligations binding our employees, contractors and service providers;
• due diligence on vendors before we engage them;
• secure hosting, regular backups, logging and monitoring for suspicious activity; and
• periodic review of our data-handling processes and security posture.

16.2 No website, application, electronic communication, storage system, payment gateway or internet transmission can be guaranteed to be completely secure. While we work hard to protect your data, we cannot warrant absolute security.

16.3 You share responsibility for your own security. Keep your password confidential, never share your OTP with anyone — including anyone claiming to be from PaulStays — avoid insecure public networks, keep your device secure, and be alert to phishing. PaulStays shall not be responsible for unauthorised access resulting from your own negligence, from your sharing of an OTP or password, from the use of a compromised device or insecure network, from phishing or malware, or from communication conducted outside the Platform.

17.1 If we become aware of a personal data breach or security incident affecting personal data under our control, we will act promptly to investigate, contain and remedy it, and to prevent its recurrence.

17.2 We will notify the Data Protection Board of India and each affected Data Principal in the form and within the timelines prescribed under the DPDP Act and the rules made under it, and we will notify any other authority or regulator where Applicable Law requires.

17.3 You must inform us immediately, at support@paulstays.com or +91-7699002674, if you suspect unauthorised access to your account, misuse of your personal information, suspicious payment activity, a fake communication purporting to come from PaulStays, or a phishing attempt.

18.1 We use cookies, pixels, tags, scripts, local storage and similar technologies to make the Platform work, to keep it secure, to understand how it is used, and — with your consent — to personalise what you see and to measure our campaigns.

18.2 On your first visit, we will ask for your consent to any cookie that is not strictly necessary. You may change your preferences at any time through the cookie settings on the Platform, and you may block or delete cookies through your browser settings. Blocking essential cookies may prevent parts of the Platform from working.

18.3 Some browsers offer a “Do Not Track” signal. There is at present no common industry standard for how such signals should be honoured; we therefore rely on the cookie consent choices you make on the Platform.

19.1 We use technology tools to improve stay discovery, search relevance, recommendations, fraud detection, customer support and platform performance. These tools may draw on your booking history, search behaviour, destination and stay-type preferences, price range, location, device data and interaction data.

19.2 We do not use automated processing in any manner that creates unlawful discrimination. We do not make any decision that produces a legal or similarly significant effect on you based solely on automated processing, without appropriate human review, where such review is required by law.

19.3 Where automated tools are used to flag suspected fraud or misuse, a human being reviews the flag before any account is suspended, any payout is withheld, or any Booking is cancelled on that basis.

20.1 If you post a review, rating, photograph, comment or other content on the Platform, or tag PaulStays on social media, that content may be visible to other Users and to the public. Please think before you post.

20.2 Do not include personal information, private documents, contact numbers, payment details, identity documents or sensitive information in a public review or comment. We may redact or remove such information where we find it.

20.3 We may use reviews, testimonials, photographs and feedback for platform improvement and for marketing and promotional purposes, subject to Applicable Law and to the licence you grant us under the Terms and Conditions.

20.4 We may remove content that is fake, incentivised, paid, abusive, defamatory, unlawful, privacy-invasive, irrelevant or misleading, or that otherwise breaches our Terms and Conditions. We do not, however, remove a genuine negative review merely because a Host objects to it.

21.1 Subject to your preferences and to Applicable Law, we may send you offers, destination updates, stay recommendations, promotional campaigns and newsletters by email, WhatsApp, SMS, telephone, app notification or other channels.

21.2 You may opt out of promotional communication at any time by using the unsubscribe option provided, by replying with the opt-out instruction where applicable, by adjusting your account preferences, or by writing to support@paulstays.com.

21.3 Even after you opt out of marketing, you will continue to receive communications that are essential to your Booking and your account — including booking confirmations, payment receipts, check-in instructions, refund updates, safety and weather advisories, security alerts, policy changes and other transactional or legally required messages. These are necessary to the performance of your Booking and cannot be switched off while you have an active account or Booking.

22.1 The Platform is intended for use by adults. In line with our Terms and Conditions, you must be at least eighteen (18) years of age to register an account, make a Booking or list a property. We do not knowingly allow a minor to create an account, list a property or make a Booking independently.

22.2 We do not knowingly collect personal data from a child as an account holder, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

22.3 Where a child travels as part of a family or group Booking, the information relating to that child must be provided by the parent, lawful guardian or responsible adult Guest making the Booking — and we collect only the minimum needed for the Stay, typically a first name and an age. Verifiable consent of the parent or guardian is the basis on which we process it, and providing that consent is the responsibility of the person making the Booking.

22.4 Where we process the personal data of a person with a disability who has a lawful guardian, we do so on the basis of that guardian’s consent.

22.5 If we become aware that a minor has created an account or provided personal data without lawful consent, we will delete that information and deactivate the account without delay. A parent or guardian with any concern about a child’s information may write to support@paulstays.com

23.1 The Platform may contain links to, or integrate with, third-party websites, maps, payment gateways, social media pages, travel services, local vendors and other external platforms. Following such a link takes you outside the Platform.

23.2 We do not control these third parties and are not responsible for their privacy policies, security practices, terms, content, service quality, payment processes or data handling. Before you share information with any third-party platform, please review its privacy policy and terms.

24.1 For any privacy-related question, complaint, data access request, correction request, deletion request, withdrawal of consent, data misuse complaint or legal notice, please contact us. We take every complaint seriously and will investigate it fairly.

PaulStays Customer Support

Grievance Officer

24.2 We will acknowledge your grievance within twenty-four (24) hours of receipt and will make reasonable efforts to resolve it within fifteen (15) days, or within such shorter period as Applicable Law may require.

24.3 If you remain dissatisfied after we have responded, you may refer the matter to the Data Protection Board of India in accordance with the DPDP Act.

25.1 We may update, amend or replace this Privacy Policy from time to time to reflect changes in the law, in technology, in our business practices, platform features, payment processes, security requirements or operational needs. The revised version will be published on the Platform with an updated Effective Date.

25.2 Where a change is material — for example, where we begin using your data for a genuinely new purpose — we will give you reasonable prior notice by email, app notice, website notice or other reasonable means, and, where the change requires it, we will seek your fresh consent before it takes effect.

25.3 We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the revised Effective Date signifies your acceptance of the updated Privacy Policy, save where fresh consent is required by law.