1. Introduction

Welcome to XTSY ("Company", "we", "our", or "us"). XTSY is a hospitality and tourism company operating traveller hostels, luxury accommodations, and curated travel experiences in Northeast India. We are committed to protecting your personal information and your right to privacy.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website xtsy.one, use our mobile applications, make bookings, or engage with our accommodation and travel services.

By accessing or using our services, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access the site or use our services.

This policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act)of India, General Data Protection Regulation (GDPR) for EU visitors, and Google API Services User Data Policy.

2. Information We Collect

2.1 Personal Information You Provide

We collect personal information that you voluntarily provide when you:

Create an Account: Name, email address, phone number, password
Make a Booking: Full name, contact details, address, emergency contact information
Process Payments: Payment card details (processed by secure third-party providers)
Contact Us: Any information you provide in communications
Subscribe to Newsletter: Email address and communication preferences

2.2 Google Sign-In Data Access

🔐 Why We Use Google Sign-In

We use Google authentication solely to verify your identity and provide a seamless booking experience. This eliminates the need to remember another password while ensuring secure access to your account.

What we access:

Your name – to personalize your experience
Your email address – to create your account and send booking confirmations
Profile picture (optional) – to display in your account

What we NEVER access:

Your contacts or address book
Your files, documents, or Google Drive
Your calendar or Gmail
Your location history or browsing data
Any other Google account data

2.3 Phone Authentication

When you sign in using Phone OTP, we receive:

Phone Authentication: Your phone number for verification purposes only

2.3 Automatically Collected Information

Device Information: Browser type, operating system, device identifiers
Usage Data: Pages visited, time spent, navigation patterns (anonymized)
Location Data: General geographic region based on IP address
Cookies: Session cookies and analytics cookies (see Section 7)

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Service Delivery

Process and manage your accommodation bookings
Facilitate check-in/check-out procedures
Provide customer support and respond to inquiries
Send booking confirmations and important updates

3.2 Account Management

Create and manage your user account
Authenticate your identity when you sign in
Maintain your booking history and preferences

3.3 Communications

Send transactional emails (booking confirmations, receipts)
Marketing communications (with your consent)
Important service announcements and policy updates

3.4 Business Operations

Improve our website and services through analytics
Detect and prevent fraud, abuse, and security incidents
Comply with legal obligations

4. Legal Basis for Processing

We process your personal data based on:

Contractual Necessity: To fulfill bookings and provide services you request
Consent: For marketing communications and optional features
Legitimate Interests: For fraud prevention, security, and service improvements
Legal Obligations: Tax records, regulatory compliance, law enforcement requests

5. How We Share Your Information

We may share your information with:

5.1 Service Providers

Payment Processors: Razorpay for secure payment handling
Authentication Services: Firebase/Google for account authentication
Analytics Providers: To understand website usage (anonymized data)
Communication Platforms: WhatsApp for customer support (user-initiated)

5.2 Legal Requirements

Government authorities when required by law
Law enforcement in response to valid legal requests
Courts or regulators as part of legal proceedings

⚠️ We NEVER sell your personal data to third parties for advertising or marketing purposes.

6. Data Retention

We retain your personal data for the following periods:

Data Type	Retention Period
Account Information	Until account deletion + 30 days
Booking Records	7 years (legal/tax compliance)
Payment Records	7 years (financial regulations)
Communication Records	3 years
Analytics Data	Anonymized and aggregated indefinitely

7. Cookies and Tracking Technologies

We use the following types of cookies:

Essential Cookies: Required for website functionality and authentication
Analytics Cookies: Help us understand how visitors use our site (anonymized)
Preference Cookies: Remember your settings and preferences

You can control cookies through your browser settings. Disabling essential cookies may affect website functionality.

8. Your Rights

You have the following rights regarding your personal data:

Right to Access: Request a copy of your personal data we hold
Right to Rectification: Correct inaccurate or incomplete information
Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
Right to Restrict Processing: Limit how we use your data in certain circumstances
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests or for marketing
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at admin@xtsy.one. We will respond within 30 days.

9. Data Security

We implement industry-standard security measures including:

SSL/TLS encryption for all data transmission
Encryption of sensitive data at rest
Regular security audits and vulnerability assessments
Access controls and authentication for staff
Secure data centers with physical security
Employee training on data protection practices

While we take extensive measures to protect your data, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Your data may be transferred to and processed in countries outside India, including the United States (where our service providers like Google and Firebase operate). When we transfer data internationally, we ensure appropriate safeguards are in place.

11. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information.

12. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on our website. Your continued use of our services after changes constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related questions, concerns, or to exercise your rights, contact us:

Email: admin@xtsy.one

15. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and its amendments. Any disputes shall be subject to the exclusive jurisdiction of the courts in Shillong, Meghalaya.