LEGAL

    Privacy Policy

    Learn how BookMyFarm collects, uses, protects, and manages your personal information when you use our platform and services.

    Last Updated: 18 September 2026

    This Privacy Policy explains how BookMyFarm handles personal information across its website, application, booking platform, customer support services, and related channels.

    01

    Introduction & Commitment to Privacy

    BookMyFarm (operated by Xvantage Infotech Pvt. Ltd., hereinafter "we," "us," "our," or "BookMyFarm") is committed to protecting your privacy and ensuring transparency in how we collect, use, disclose, and safeguard your personal data.

    This Privacy Policy explains our practices regarding personal data when you access or use our website, mobile application, booking platform, customer support services, and related channels (collectively, the "Platform").

    This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Rules, 2000, and the Information Technology Act, 2000.

    By using BookMyFarm, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree, please do not use our Platform.

    02

    BookMyFarm's Role as a Marketplace

    BookMyFarm operates as a digital marketplace platform that facilitates bookings and communication between property owners (Hosts) and travelers (Guests). We do not own, manage, operate, or control any listed properties.

    Host Data Responsibility: All property information, including descriptions, photographs, amenities, facilities, pricing, and policies, is provided solely by the Host. BookMyFarm does not independently verify the accuracy, completeness, authenticity, or legality of such information.

    Our Limited Role: We provide the technical infrastructure to enable Hosts and Guests to communicate, view listings, make bookings, and process payments. We do not guarantee property conditions, safety standards, or regulatory compliance.

    03

    Information We Collect

    3.1 Personal Identification Data

    • Full name, gender, date of birth
    • Email address and phone number
    • Identification details (passport, Aadhar, driver's license, PAN for Hosts)
    • Profile photograph and personal description
    • Account login credentials and passwords

    3.2 Contact & Address Information

    • Residential or business address
    • City, state, postal code, country
    • Alternative contact numbers or addresses

    3.3 Financial & Payment Data

    • Credit/debit card information (processed through secure third-party payment gateways; we do not store full card details)
    • UPI ID, net banking details, digital wallet information
    • Bank account details (for Hosts' payout)
    • Transaction history, booking amounts, refund records, invoice information
    • GST/Tax identification numbers (for Hosts)

    3.4 Booking & Transactional Data

    • Booking dates, check-in/check-out times, guest count
    • Property selected, room type, special requests
    • Cancellation history and refund details
    • Payment methods and transaction status
    • Booking amendments, disputes, and resolutions

    3.5 Communication Data

    • Messages, inquiries, and communication between Hosts and Guests on the Platform
    • Customer support tickets, chat logs, email conversations
    • Complaint records and dispute documentation

    3.6 User-Generated Content

    • Reviews, ratings, comments, and testimonials
    • Guest and Host photos, videos, and social media content
    • Questions, answers, and discussions posted on the Platform
    • Property descriptions and house rules (for Hosts)

    3.7 Technical & Device Data

    • IP address and geolocation data
    • Device type, operating system, browser type, app version
    • Cookies, web beacons, pixel tags, and tracking identifiers
    • Clickstream data, pages visited, time spent, search queries, and navigation patterns
    04

    Legal Basis for Processing Personal Data

    Under the DPDP Act, 2023 and Information Technology Rules, 2000, we process your personal data based on:

    • Your Consent: You have explicitly agreed to our Privacy Policy and data processing
    • Contract Performance: Processing is necessary to execute booking agreements, payment processing, and service delivery
    • Legal Obligation: Compliance with tax laws, anti-money laundering (AML), Know Your Customer (KYC), and regulatory requirements
    • Legitimate Interest: Improving Platform security, fraud prevention, analytics, and service optimization
    05

    How We Use Your Information

    5.1 Core Service Delivery

    • Account creation, verification, and authentication
    • Processing and confirming bookings between Hosts and Guests
    • Facilitating secure payments and refunds
    • Matching Guests with suitable properties
    • Enabling communication between Hosts and Guests

    5.2 Communication & Support

    • Sending booking confirmations, updates, and reminders
    • WhatsApp, SMS, and push notifications about bookings and offers
    • Customer support, technical assistance, and troubleshooting
    • Responding to inquiries, complaints, and feedback
    • Dispute resolution and mediation communications

    5.3 Marketing & Promotional Activities

    • Sending promotional offers, newsletters, and festive season campaigns (with consent)
    • Personalizing content and recommendations based on booking history
    • Conducting surveys, feedback collection, and satisfaction studies

    5.4 Safety, Security & Fraud Prevention

    • Verifying identity and preventing account takeovers
    • Detecting and preventing fraud and unauthorized transactions
    • Blocking suspicious or malicious accounts
    • Monitoring for policy violations and illegal activities
    • Background checks and identity verification (for Hosts)

    5.5 Compliance & Legal Obligations

    • Complying with tax laws (GST, income tax filing)
    • KYC/AML compliance and regulatory reporting
    • Responding to legal requests and government inquiries
    • Maintaining records for audit and compliance purposes
    06

    Sharing of Personal Data

    6.1 Host-Guest Information Exchange

    To facilitate bookings, we share the following information between Hosts and Guests:

    • Guest name, phone number, email: Shared with Host to enable communication and coordination
    • Guest count and special requests: Shared for property preparation
    • Host name, phone number, address: Shared with Guest for check-in coordination

    6.2 Service Providers & Third Parties

    We share data with trusted partners under confidentiality agreements:

    • Payment gateways: Razorpay, Stripe for secure payment processing
    • SMS/WhatsApp providers: Twilio, MessageBird for notifications
    • Email service providers: SendGrid for transactional emails
    • Analytics providers: Google Analytics, Mixpanel for usage insights
    • Cloud storage providers: AWS, Google Cloud for secure data hosting
    • Identity verification services: Third-party KYC providers

    6.3 Legal & Regulatory Disclosure

    We may disclose your data when required by law:

    • Court orders and legal proceedings
    • Law enforcement requests (with proper documentation)
    • Government agencies for tax or security purposes
    • Enforcing our Terms of Service and protecting Platform integrity

    6.4 What We DO NOT Do

    • Sell data: We do NOT sell your personal data to third parties
    • Share with advertisers: We do NOT share your data with unaffiliated advertisers
    • Rent or lease data: We do NOT rent or lease your data
    07

    Data Retention & Deletion

    7.1 Retention Periods

    • Active account data: Retained while your account is active
    • Booking & transaction records: Retained for 7 years per GST compliance
    • Communication data: Retained for 2 years for dispute resolution
    • Payment data: Retained for 10 years per banking requirements
    • Deleted account data: Removed within 30-90 days unless legal hold applies
    • Analytics & logs: Retained for up to 1 year for performance analysis

    7.2 Account Deletion

    • You may request account deletion by contacting [email protected]
    • We will delete personal data within 30 days
    • Some data (transaction records, tax compliance) may be retained per legal obligations
    • Deletion is permanent and cannot be undone
    08

    Data Security & Protection

    8.1 Security Measures

    • Encryption: TLS/SSL encryption for data in transit; AES-256 for data at rest
    • Secure servers: Hosted on AWS/Google Cloud with redundancy and backup
    • Access controls: Role-based access restrictions; only authorized staff access sensitive data
    • Authentication: OTP-based verification, two-factor authentication (2FA) support
    • Regular audits: Penetration testing and security assessments

    8.2 Payment Card Information (PCI DSS)

    • We do NOT store: Full credit/debit card details on our servers
    • Payment processing: Handled by PCI DSS-compliant third-party gateways
    • Tokenization: Only secure tokens are stored for recurring payments

    8.3 Data Breach Notification

    In the event of a confirmed data breach, we will:

    • Notify affected users within 72 hours (per DPDP Act, 2023)
    • Inform regulatory authorities as required by law
    • Provide details of the breach and recommended actions
    09

    Cookies, Tracking Technologies & Analytics

    9.1 What Are Cookies?

    Cookies are small text files stored on your device to enhance your browsing experience. They enable login persistence, remember preferences, and track usage patterns.

    9.2 Types of Cookies We Use

    • Essential cookies: Necessary for login, security, and basic Platform functionality
    • Preference cookies: Remember your language, theme, and settings
    • Analytics cookies: Track page views, referral sources, and user behavior
    • Marketing cookies: Enable retargeting ads and conversion tracking

    9.3 Controlling Cookies

    • Browser settings: You can disable cookies in your browser settings
    • Cookie consent: We request consent for non-essential cookies on first visit
    • Do Not Track: If your browser sends a "Do Not Track" signal, we will honor it
    10

    Your Rights & Privacy Choices

    10.1 Rights Under DPDP Act, 2023

    As a data principal in India, you have the following rights:

    • Right to Access: Request a copy of your personal data held by BookMyFarm
    • Right to Correct: Rectify inaccurate, incomplete, or outdated data
    • Right to Erase: Request deletion of personal data in certain circumstances
    • Right to Restrict: Limit how we use your data temporarily
    • Right to Withdraw Consent: Opt out of specific data processing activities

    10.2 How to Exercise Your Rights

    To exercise any of these rights, submit a written request to:

    Email: [email protected]

    Include: your full name, email, phone, account ID, and specific request details.

    We will respond within 30 days of receiving your request.

    10.3 Opt-Out of Marketing Communications

    • Email: Click "Unsubscribe" at the bottom of promotional emails
    • SMS: Reply "STOP" to BookMyFarm WhatsApp/SMS messages
    • App: Disable push notifications in app settings
    • Account settings: Update communication preferences in your BookMyFarm profile
    11

    Children's Privacy & Age Restriction

    BookMyFarm is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

    If you are under 18: You may only use BookMyFarm with the explicit consent and supervision of a parent or guardian.

    If we become aware that we have collected data from a minor without parental consent, we will delete such data immediately and terminate the account.

    12

    International Data Transfers

    BookMyFarm operates primarily in India. However, your data may be processed by our service providers in other jurisdictions (e.g., AWS regions in the US).

    Data Protection: Even when transferred internationally, we ensure your data remains protected under appropriate safeguards.

    By using BookMyFarm, you consent to the transfer of your personal data outside India in accordance with this Privacy Policy and applicable law.

    13

    Contact Us

    Privacy Inquiries

    Email: [email protected]

    General Support: [email protected]

    Phone: +91 92777 78778

    Mailing Address

    BookMyFarm (Xvantage Infotech Pvt. Ltd.)

    319 Platinum Point, Sudama Chowk

    Mota Varachha, Surat

    Gujarat 394101, India

    14

    Updates to This Privacy Policy

    BookMyFarm may update this Privacy Policy periodically to reflect changes in law, business practices, or technology.

    Material Changes: If we make significant changes, we will notify you via email at least 30 days before the change takes effect.

    Continued use of BookMyFarm after changes become effective constitutes your acceptance of the updated Privacy Policy.

    By using BookMyFarm, you acknowledge that you have read, understood, and agree to this Privacy Policy and our data handling practices. If you do not agree with any part of this policy, please do not use our Platform.

    © 2026 BookMyFarm (Xvantage Infotech Pvt. Ltd.). All rights reserved.