Book a stay

Privacy policy.

We collect only what a booking and the law need, keep it only as long as required, and never sell it.

Effective 16 September 2026. Read the terms and refund policy

1. Who is responsible for your data

  1. 1.1The Urban Hideout, a sole proprietorship of Mudit Kumar ("we") is the data fiduciary for personal data collected through https://theurbanhideout.in, WhatsApp and at check-in. Contact: muditchaudhary482@gmail.com or WhatsApp +91 85338 88088.
  2. 1.2This policy is issued under the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. What we collect and why

  1. 2.1Booking details: name, mobile number, email, stay type, dates and amount paid. Purpose: to make and manage your booking, send the confirmation and lockbox code, issue invoices, and handle cancellations and refunds. Legal basis: performance of the contract with you.
  2. 2.2Identity details at check-in: the type and number of the government ID of each guest, and for foreign nationals passport and visa details. Purpose and legal basis: legal obligation under the Sarais Act, 1867, local police guest-registration requirements and, for foreign nationals, the Registration of Foreigners Rules, 1992 (Form C).
  3. 2.3Payment: processed by Razorpay. We receive the payment ID, order ID, status and the last few digits or masked form of the instrument. We never receive or store full card numbers, CVV, UPI PIN or banking passwords.
  4. 2.4Messages: WhatsApp and email conversations with you, kept to serve your booking and to resolve complaints.
  5. 2.5Website usage: server logs (IP address, browser, pages, time) kept for security and to keep the site working. We do not run advertising trackers. The site uses only strictly necessary storage (for example to remember an admin session); no consent banner is needed for this.
  6. 2.6Reviews: if you choose to give a review, the text and first name you provide may be shown on the website with your consent, which you can withdraw at any time.

3. Who we share it with

  1. 3.1Razorpay Software Pvt. Ltd. (payment processing), Resend (transactional email delivery), Neon (database hosting) and Vercel (website hosting). Each processes data only on our instructions and under its own security commitments. Some of these providers store data outside India; transfers are permitted under the DPDP Act to countries not restricted by the Central Government.
  2. 3.2Police and government authorities, where the law requires guest records to be produced (for example under the Sarais Act or for Form C), or in response to a lawful order.
  3. 3.3Our accountant or legal adviser, under confidentiality, to the extent needed for tax compliance or a dispute.
  4. 3.4We do not sell personal data and do not share it with advertisers.

4. How long we keep it

  1. 4.1Booking and payment records: 8 years from the end of the financial year of the stay, as required for accounts under the Income-tax Act, 1961 and the Central Goods and Services Tax Act, 2017 (which requires records for 72 months from the annual return due date).
  2. 4.2Guest ID details: for the period required by police registration rules, then deleted. Photographs or scans of IDs, where taken, are deleted within 30 days of check-out unless a dispute or legal request is pending.
  3. 4.3Messages: 2 years after your last stay, then deleted. Server logs: 90 days.

5. Your rights

  1. 5.1Under the DPDP Act you may ask us for a summary of the personal data we hold about you, ask us to correct or update it, ask us to erase it where we no longer need it for a legal purpose, withdraw consent for anything that is consent-based (such as a published review), and nominate a person to exercise these rights if you are unable to.
  2. 5.2Send requests to muditchaudhary482@gmail.com from the email or mobile number used at booking. We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once it is operational, or to the Grievance Officer named below.
  3. 5.3You may also contact the Grievance Officer under Rule 5(9) of the SPDI Rules, 2011 for any discrepancy or grievance about your data.

6. Security

  1. 6.1Data is stored in encrypted databases with access limited to the proprietor. The website uses HTTPS throughout. Payment pages are served by Razorpay, which is PCI-DSS certified. Admin access is password-protected and not exposed to search engines.
  2. 6.2If a breach affecting your personal data occurs, we will inform you and the Data Protection Board as required by the DPDP Act.

7. Children

  1. 7.1Bookings may be made only by adults. Where a child stays as part of a family booking, the adult booker provides the child's ID details for legal registration and consents on the child's behalf as required by Section 9 of the DPDP Act. We do not knowingly collect any other data about children.

8. CCTV

  1. 8.1CCTV operates in the building's common areas under the control of the residents' association, for security. Footage is retained by the association for its standard period (normally 30 days). There are no cameras inside the Studio.

9. Grievance Officer and changes

  1. 9.1Grievance Officer: Mudit Kumar, muditchaudhary482@gmail.com, +91 85338 88088.
  2. 9.2We may update this policy; the effective date will change and, for material changes, we will notify guests with an upcoming booking by email. Effective date: 16 September 2026.