Vilawala — Book any home, anywhere

Vilawala.com ("we", "our", "us") respects your privacy. This policy explains what data we collect and why.

1. Information we collect

Account data: name, email, phone (optional), password hash, role (user / owner / admin), profile photo.
Property listing data (Owners): property name, type, address, city, GPS coordinates, description, house rules, photos, pricing (daily / monthly / yearly in ₹ INR), amenities, facility checklist.
Booking data: check-in / check-out dates, guest count, coupon codes used, transaction details, payment status.
Payment data: only the payment identifier and amount are stored on our servers. Full card numbers, CVV or bank credentials are handled exclusively by our PCI-DSS-compliant payment partner (PayU / Razorpay).
Usage data: pages visited, search queries, device type, browser, and IP address (used for security and abuse prevention).
AI chat data: messages exchanged with our AI assistant are stored to improve support and enable escalation to human agents.

2. Why we collect it

To create and maintain your account and provide our services.
To match Users with Owners and facilitate bookings.
To process payments, refunds and payouts.
To send booking updates, notifications and receipts.
To detect and prevent fraud, abuse and platform violations.
To comply with applicable Indian law.

3. Cookies & local storage

We use strictly-necessary cookies (session, authentication token) and local storage (language preference, chat session id) to make the Platform work. We do not use advertising or third-party tracking cookies.

4. Third-party services

Payment gateway: PayU / Razorpay — for payment processing and settlement.
Object storage: Emergent object storage — for property and profile photos.
AI assistant: Google Gemini (via Emergent LLM key) — for support chat.
Maps: OpenStreetMap / Nominatim — for property locations.
Web push: browser VAPID push service (Google FCM / Mozilla) for installed-PWA notifications.

5. Data security

Passwords are hashed with bcrypt. Authentication tokens are HTTP-only, secure, and expire after 30 days. All data is transmitted over TLS/HTTPS. Access to production data is restricted to the proprietor. We do not sell, rent or trade your personal data.

6. Data retention

Account data is kept as long as your account is active. Booking, payment and transaction records are retained for at least 7 years to comply with Indian tax and financial recordkeeping rules. You can request deletion of your account and non-mandatory data at any time by writing to support@vilawala.com.

7. Your rights

Access, correct or download your personal data.
Request deletion of data not required for legal recordkeeping.
Withdraw consent for optional communications.
Raise a grievance under the IT Rules 2021 — see Contact page.

8. Children

Vilawala.com is not intended for anyone under 18. We do not knowingly collect data from minors.

9. Updates

This policy may be updated; the "Last updated" date will change. Material updates will be announced via in-app notification.

Privacy Policy