1Who we are
StayYoo is a platform for booking hotels located in India. It is owned and operated by VPROVE SOLUTIONS PRIVATE LIMITED (CIN: U72900AP2019PTC110242), having its registered office at 18-1-318, Bhavani Nagar, Tirupati, Andhra Pradesh – 517501, India ("StayYoo", "we", "us", "our").
This Privacy Policy explains how we collect, use, store, share and protect your personal data when you use https://www.stayyoo.com, our mobile site or the StayYoo apps for iOS and Android (together, the "Platform"). It follows the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") and the Information Technology Act, 2000, and the rules made under it.
This policy is currently available in English. You can ask for it in any other language listed in the Eighth Schedule to the Constitution of India by emailing support@stayyoo.com.
Hotels listed on StayYoo, and third-party websites linked from the Platform, have their own privacy practices. Please review their policies separately.
2Our role and where your data is processed
VPROVE SOLUTIONS PRIVATE LIMITED is the "Data Fiduciary" for personal data collected through StayYoo. We decide why and how your data is processed, and we are responsible for protecting it.
StayYoo operates only in India. Your personal data is stored and processed in India. If a service provider processes data outside India, it will do so only in a country that is not restricted by the Government of India under the DPDP Act.
3How we ask for your consent
We process your personal data only with your consent or where the DPDP Act otherwise allows it. We ask for consent through short, clear notices when you sign up, make a booking or turn on optional features. Each notice lists the data we need and why, and you give consent by a clear action, such as ticking a box or tapping "I agree".
Marketing messages, location access and analytics cookies are optional. Saying no to them does not affect your ability to book a hotel.
4Information we collect
4.1 Information you give us
- Account details: name, mobile number, email address, gender, date of birth and profile picture.
- Booking details: hotel, check-in and check-out dates, number of rooms and guests, and special requests such as room preferences, accessibility needs or dietary requirements.
- Co-guest details: names and ages of other guests you book for. By sharing them, you confirm that each adult guest has agreed, and that you are the parent or lawful guardian of any child whose details you share.
- Identity documents: details or copies of government ID (such as Aadhaar, passport, driving licence or voter ID) where a hotel or the law requires it, including for contactless or web check-in. Foreign nationals may need to share passport and visa details for guest registration.
- Billing details: billing name, address and GSTIN, if you want a GST invoice.
- Communications: messages, emails and calls with our support team.
- Reviews and ratings: reviews, ratings and photos you post about a hotel. These are shown publicly with your name or display name.
4.2 Information from third parties
- Social login: if you sign in with Google, Facebook or a similar account, we receive your user ID, name, email address and profile picture, as allowed by your settings on that service.
- Payment information: payment status, transaction ID and partial card or UPI details from Razorpay. Your full card number, CVV, UPI PIN and net-banking passwords go directly to Razorpay and are never stored by us.
4.3 Information collected automatically
- Device and usage data: IP address, device type, operating system, browser, app version, pages viewed and searches.
- Location: your device location, only if you allow it, to show hotels near you.
- Cookies: essential cookies that keep you logged in and keep the Platform secure. Analytics and advertising cookies are used only with your consent.
5Why we process your data
| Ground under the DPDP Act | Purpose |
|---|---|
| Your consent (Section 6) | Creating and managing your account |
| Your consent (Section 6) | Making, changing and cancelling bookings, and sharing booking details with the hotel |
| Your consent (Section 6) | Processing payments, refunds and GST invoices |
| Your consent (Section 6) | Sending booking confirmations, check-in details, reminders and support replies |
| Your consent (Section 6) | Detecting and preventing fraudulent bookings and protecting your account |
| Your consent (Section 6), optional | Showing hotels near you, personalising results and using analytics cookies |
| Your consent (Section 6), optional | Offers and updates by email, SMS, WhatsApp or push notification |
| Legitimate uses (Section 7) | Complying with laws that require us to share information with government authorities (such as guest registration), complying with court orders, and responding to medical emergencies or disasters |
We collect only the data needed for each purpose, and we do not use it for purposes you have not agreed to.
7Withdrawing your consent
You can withdraw consent at any time, as easily as you gave it:
- Marketing: tap "Unsubscribe" in any email, reply STOP to our SMS or WhatsApp messages, or turn it off on our Privacy page at https://www.stayyoo.com/privacy-policy/.
- Location and cookies: turn them off on our Privacy page at https://www.stayyoo.com/privacy-policy/, in your device settings or through the cookie banner.
- Everything else: use our Privacy page at https://www.stayyoo.com/privacy-policy/ or email support@stayyoo.com.
Withdrawal does not affect processing done before it. Name, contact and ID details are essential for hotel bookings. If you withdraw consent for these, we may be unable to make or complete a booking, and the Cancellation and Refund Policy will apply. Once you withdraw consent, we and our service providers will stop processing that data, unless the law requires us to keep it.
8Your rights
Under the DPDP Act, you have the right to:
- Access: get a summary of the personal data we process about you, how we process it, and who we have shared it with.
- Correction and erasure: correct, complete or update your data, or ask us to erase it, unless the law requires us to keep it.
- Grievance redressal: raise a complaint with our Grievance Officer about how we handle your data.
- Nomination: nominate a person to exercise your rights if you die or become incapacitated.
To use these rights, go to our Privacy page at https://www.stayyoo.com/privacy-policy/ or email support@stayyoo.com with your registered mobile number or email address. We may ask you to verify your identity. We acknowledge your request within 24 hours and respond within 15 days.
9Complaints to the Data Protection Board of India
If you are not satisfied with our response, or do not hear from us within 15 days, you can complain to the Data Protection Board of India. The Board works online; details of how to file a complaint are published by the Ministry of Electronics and Information Technology at https://www.meity.gov.in.
10How long we keep your data
- Account data: kept while your account is active. When you delete your account or withdraw consent, we erase it unless the law requires us to keep it.
- Booking, invoice and payment records: kept for up to eight years, as required by tax, GST and company laws.
- Security and processing logs: kept for at least one year, as required by the DPDP Rules.
After these periods, data is securely deleted or anonymised. Our service providers must also delete it.
11Security
We protect your data with reasonable security safeguards, including encryption, masking or tokenisation where appropriate, role-based access controls, access logging, regular backups and secure hosting in India. Our service providers must apply the same safeguards. No online system is fully secure, so please keep your login details private.
12Data breaches
If a personal data breach affects you, we will tell you without delay by email, SMS or in-app notice. We will explain what happened, the likely impact, what we are doing about it, what you can do to protect yourself, and whom to contact. We will also report the breach to the Data Protection Board of India, with a detailed report within 72 hours, and to CERT-In where required.
13Children and persons with disabilities
Only adults aged 18 or older can create an account or make a booking. Where a booking includes a child, or a person with a disability who has a lawful guardian, we process their details only with the verifiable consent of the parent or lawful guardian making the booking. We use children's data only to complete the booking, and never for tracking, behavioural monitoring or targeted advertising.
14Changes to this policy
We may update this policy to reflect changes in law or in our services. We will update the "Last updated" date and notify you of significant changes by email or in-app notice. If a change involves a new purpose for your data, we will ask for your consent again.
15Grievance Officer and contact
Our Grievance Officer handles complaints and answers questions about how we process your personal data:
- Designation
- Grievance Officer
- Company
- VPROVE SOLUTIONS PRIVATE LIMITED
- Address
- 18-1-318, Bhavani Nagar, Tirupati, Andhra Pradesh – 517501, India
- support@stayyoo.com
We acknowledge complaints within 24 hours and resolve them within 15 days. For general questions, email support@stayyoo.com.