Privacy Policy
Last updated: October 2026
Stayva is a product owned and operated by Stvensi Technologies Private Limited, a company incorporated in India with its registered office in Hyderabad, Telangana ("Stayva", "we", "our", "us"). We provide property management software for PG owners, managers, and residents, and listings for people looking for a PG. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it — in compliance with the Digital Personal Data Protection (DPDP) Act 2023, the Information Technology Act 2000, and the SPDI Rules 2011. It applies to our web application, Android and iOS apps, and related services.
1. Who Is Responsible for Your Data
Stayva acts in different roles under the DPDP Act 2023, and your point of contact depends on which applies to you:
For PG owners & staff
Stayva is the Data Fiduciary for your account data. We decide how and why it is processed, and you can exercise your rights directly with us.
For residents / tenants
Your PG owner is the Data Fiduciary who collects your data during onboarding. Stayva is a Data Processor acting on their documented instructions. You may raise requests with your PG owner or directly with us — we will coordinate the response either way.
For people looking for a PG
When you search our listings, sign in with a WhatsApp code, send an enquiry or ask to be told about new PGs, Stayva is the Data Fiduciary for what you give us. An enquiry you send is passed to the owner of that PG, who uses it to reply to you and is responsible for their own use of it.
2. Data We Collect
We collect only what is needed to run the service — no more:
Resident Personal Data
- •Full name, mobile, email
- •Gender, permanent address
- •Identity proof number (masked — last 4 digits only)
- •Scanned ID document (for KYC), stored as the PG owner uploads it
Financial Data
- •Rent amount and payment history
- •Security deposit records
- •Invoices and receipts
- •Payment transaction references (we never see full card or bank details — see Section 4)
Property & Usage Data
- •Property, room, and bed assignments
- •Occupancy history
- •Maintenance tickets and notes
People Looking for a PG
- •Name, mobile number and email, when you sign in or send an enquiry
- •The city, locality and preferences you search for
- •Whether you asked to be emailed about new PGs
- •Messages you send us, including on WhatsApp
Account & Device Data
- •Owner/staff name, email, password (stored only as a bcrypt hash)
- •Role and permissions
- •Login timestamps and access logs
- •Push notification token (mobile app)
- •Crash and error diagnostics
We do not collect your precise location, contacts, photos (beyond documents you choose to upload), or any data from other apps on your device.
3. Purpose & Legal Basis
Under the DPDP Act 2023, personal data may be processed only with the consent of the person it is about (section 6) or for one of the legitimate uses the Act lists (section 7). Each purpose below rests on one of the two. We do not use your data for any purpose not listed here, and we never sell personal data:
| Purpose | Basis under the DPDP Act 2023 |
|---|---|
| Resident KYC verification & onboarding | Consent of the resident, obtained by the PG owner (section 6) |
| Rent invoicing, receipts & payment tracking | Consent of the resident, obtained by the PG owner (section 6) |
| Occupancy & property management | Consent of the resident, obtained by the PG owner (section 6) |
| Rent reminders and receipts sent to residents on WhatsApp or email | Consent of the resident, obtained by the PG owner (section 6) |
| Reading the details off an ID document you scan (sent to Google outside India) | Consent of the resident, confirmed by the PG owner before the scan (section 6) |
| Creating and running an owner or staff account, and billing for it | Legitimate use: data you gave us voluntarily for this purpose (section 7(a)) |
| Account security, authentication & fraud prevention | Legitimate use: data you gave us voluntarily to use your account (section 7(a)) |
| Maintenance and complaint management | Legitimate use: data you gave us voluntarily to have the request handled (section 7(a)) |
| Push notifications (rent reminders, updates) | Consent, given in your device settings and withdrawable there at any time (section 6) |
| Passing your enquiry to the PG you asked about | Consent, given when you send the enquiry (section 6) |
| Emails about new PGs in an area you searched | Consent, by opt-in, withdrawable from the unsubscribe link in every email (section 6) |
| Replying to messages and enquiries you send us | Legitimate use: data you gave us voluntarily to get a reply (section 7(a)) |
| Error monitoring & service reliability | Consent, given when you accept this policy. Personal identifiers are removed first (section 6) |
| Keeping financial records, and answering lawful requests from authorities and courts | Compliance with Indian law (sections 7(d), 7(e) and 8(7)) |
4. Who We Share Data With
We share personal data only with vetted service providers who process it under contract, solely to run Stayva. We never sell or rent personal data, and we never share it with advertisers or data brokers.
| Provider | Purpose | Data Involved |
|---|---|---|
| Razorpay | Payment processing (RBI-regulated) | Payment amount, transaction reference. Card/UPI/bank details go directly to Razorpay — Stayva never receives them. |
| Cloudflare (R2 object storage) | Encrypted storage of uploaded documents | KYC document scans, uploaded files |
| MongoDB Atlas | Hosting of the application database | Account, property, resident and billing records |
| Railway and Vercel | Hosting of the application and website | Data passing through the service while it is processed |
| Twilio and WhatsApp (Meta) | Sending WhatsApp messages: rent reminders, receipts, sign-in codes and replies | Name, mobile number and the content of the message, such as the amount due |
| Google (Gemini API) | Reading the details off an ID document when you use the KYC scan | The image of the document you scan, sent for reading at the time of the scan |
| Email delivery provider (SMTP) | Sending invoices, receipts, and service alerts | Name, email address, invoice contents |
| Grafana Cloud (Mumbai, India) | Application monitoring, logs and crash diagnostics | Technical diagnostics and application logs. Personal identifiers are redacted before the data leaves our servers, and the data is stored in India. |
| Google (Firebase Cloud Messaging) / Apple (APNs) | Push notification delivery on mobile | Anonymous device push token |
We may also disclose data where required by law — for example, to tax authorities, law enforcement acting under lawful process, or courts. We will notify affected users where the law permits us to do so.
5. How We Protect Your Data
- ✓All data in transit is encrypted using TLS 1.2+
- ✓Passwords are hashed using bcrypt — never stored or transmitted in plain text
- ✓Aadhaar numbers typed into the service are masked before storage (last 4 digits only), consistent with the Aadhaar Act 2016 and UIDAI guidelines
- ✓A scanned copy of an ID is stored as it was uploaded, so it shows whatever the document shows. PG owners are required to upload only a masked Aadhaar, which hides the first 8 digits
- ✓Identity proof documents are stored in access-controlled, encrypted cloud storage (Cloudflare R2), served only via short-lived signed URLs
- ✓API access is protected by JWT authentication, role-based access control, and rate limiting
- ✓Strict multi-tenant isolation: one PG owner can never access another owner's data
- ✓Access logs are maintained to detect and investigate unauthorised activity
6. Data Retention
We keep personal data only as long as the purpose it was collected for remains, or as the law requires — whichever is longer. When the period ends, data is deleted or irreversibly anonymised:
| Data Type | Retention Period |
|---|---|
| Active resident records | Duration of tenancy + 6 months |
| Financial records (invoices, payments, expenses) | For the period required by Indian law, including the Information Technology Act, 2000 and the laws governing books of account |
| Identity proof documents, rent agreements and police verification forms | Duration of tenancy + 6 months, then deleted |
| An account you ask us to delete | Closed at once and permanently deleted after 30 days. Financial records are kept as above |
| A free trial that ends without a subscription | Read-only for 15 days, then deleted 30 days later |
| An account that is suspended or no longer used | Kept so that you can return. We may delete it after 2 years without use, with at least 30 days' notice by email |
| Enquiries sent to a PG | Held in that PG owner's account until the owner removes them or the account is deleted |
| Requests to be told about new PGs | Emails stop after 90 days, or at once when you unsubscribe |
| Security logs | 90 days |
| Audit trail of changes made in an account | 1 year |
| Push notification tokens | Until you log out, uninstall the app, or disable notifications |
7. Your Rights (DPDP Act 2023)
Right to Access
Obtain a summary of the personal data we hold about you and how it is processed
Right to Correction
Have inaccurate, incomplete, or outdated data corrected or updated
Right to Erasure
Request deletion of your personal data once it is no longer required or consent is withdrawn
Right to Withdraw Consent
Withdraw consent at any time, as easily as it was given — without affecting prior lawful processing
Right to Grievance Redressal
Complain to our Grievance Officer, and escalate to the Data Protection Board of India if unsatisfied
Right to Nominate
Nominate a person to exercise your rights in the event of death or incapacity
To exercise any right, email privacy@stayva.in from your registered email address. We will verify your identity and respond within the timelines prescribed under the DPDP Act. Exercising your rights is free of charge.
8. Mobile App Permissions
The Stayva Android and iOS apps request only the permissions they need, and each can be revoked in your device settings at any time:
- •Notifications: To deliver rent reminders, payment confirmations, and service updates. Optional — the app works without it.
- •Camera: Only when you choose to photograph an ID proof, a property, an expense receipt or a meter reading.
- •Photos: Only when you choose an existing photo to attach to a record.
- •Storage / Files: Only when you choose to upload or download a document (e.g. a KYC scan or invoice PDF).
9. Children's Data
Stayva is intended for users aged 18 and above. A PG owner must make sure that every resident they add is 18 or older, and is responsible for obtaining the verifiable consent of a parent or guardian that the law requires if they add anyone younger. We do not knowingly collect personal data of children as defined under the DPDP Act 2023, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a child's data has been submitted to us without verifiable parental consent, contact us and we will delete it promptly.
10. Data Breach Notification
In the event of a personal data breach, we will notify the Data Protection Board of India and affected users in the form and manner prescribed under the DPDP Act 2023 and its rules, including the nature of the breach, the data involved, and the steps we are taking to contain it and prevent recurrence.
11. Where Your Data Is Stored
Your data is stored on secure cloud infrastructure. Where any transfer of personal data outside India occurs (for example, through a cloud or email provider), it is done only to territories not restricted by the Central Government under the DPDP Act 2023, and under contractual safeguards requiring the same level of protection described in this policy.
12. Changes to This Policy
We review this policy periodically and update it when our practices, features, or the law change. Material changes will be announced in-app or by email before they take effect, and the "Last updated" date above will always reflect the current version. Continued use of Stayva after an update constitutes acceptance of the revised policy, except where fresh consent is legally required — in which case we will ask for it explicitly.
13. Grievance Officer & Contact
As required under the IT Act 2000 and the DPDP Act 2023, we have appointed a Grievance Officer. For any privacy question, rights request, or complaint, contact:
Name: Rao, Grievance Officer, Stvensi Technologies Private Limited (Stayva)
Address: PT NO 340, Sriramnagar, Kondapur, Serilingampally, K.V. Rangareddy - 500084, Telangana, India
CIN: U62099TS2025PTC206943
Email: privacy@stayva.in or support@stayva.in
Response time: Acknowledgement within 72 hours; resolution within 30 days of receiving the complaint
If you are not satisfied with our response, you may escalate your grievance to the Data Protection Board of India.
See also our Cookie Policy and Terms of Service.