Last updated: 8 September 2026
Saffron Studios Private Limited (CIN U74120MH2015PTC264101), trading as SaffronStays, is the Data Fiduciary for www.saffronstays.com. We engage the data processors and third parties below. Each is bound by contract to process personal data only on our instructions, to keep it secure, and to return or delete it when the engagement ends.
Recipients
| Recipient | Data shared | Purpose | Processed in | Runs when |
|---|---|---|---|---|
| Substack Substack Inc. | Name, email address | Sending the SaffronStays newsletter. Your details are enrolled by our own servers, not by a script in your browser, and only when you ask for the newsletter. | United States | Sent only when you tick the newsletter box at sign-up — never from the cookie panel |
| Razorpay Razorpay Software Private Limited | Name, email, phone, booking reference, amount | Payment processing and refunds. Card and UPI credentials are entered on Razorpay's own PCI-DSS certified surface — SaffronStays never receives them. | India | Runs without consent — the service cannot be delivered without it |
| ImageKit ImageKit Private Limited | IP address, device and browser characteristics | Serving and resizing property images. | India | Runs without consent — the service cannot be delivered without it |
| Cloudinary (legacy media only) Cloudinary Ltd. | IP address, device and browser characteristics | Serving guest photographs and videos uploaded before we moved to ImageKit. Those rows still hold Cloudinary URLs; nothing new is uploaded there. | Israel / United States | Runs without consent — the service cannot be delivered without it |
| Elfsight CDN (legacy images only) Elfsight LLC | IP address, page viewed, device and browser characteristics | Hosting for the team photographs on our About Us page, left over from a widget we no longer use. No Elfsight script runs on the site. Listed as necessary because these are page images, loaded with the page and not gated on a consent category — re-hosting them removes the vendor entirely. | Cyprus | Runs without consent — the service cannot be delivered without it |
| Google Sign-In Google LLC | Name, email address, profile picture | Optional social login, only if you choose to sign in with Google. | United States | Runs without consent — the service cannot be delivered without it |
| Facebook Login Meta Platforms, Inc. | Name, email address, profile picture | Optional social login, only if you choose to sign in with Facebook. | United States | Runs without consent — the service cannot be delivered without it |
| SaffronStays support chat Saffron Studios Private Limited (self-hosted widget) | Whatever you type into the chat, plus name, phone and email if you provide them | Live support chat and enquiry handling. | India | Runs only if you consent to functional technologies |
| Google Analytics 4 & Google Tag Manager Google LLC | Pseudonymous client ID, pages viewed, approximate location from IP, device characteristics | Traffic measurement and understanding how pages are used. | United States | Runs only if you consent to analytics |
| Microsoft Clarity Microsoft Corporation | Pseudonymous session ID, clicks, scrolls and pointer movement, pages viewed | Session replay and heatmaps, used to find broken or confusing screens. Clarity also synchronises its identifier with Microsoft's advertising domains (c.bing.com) as part of its own operation. | United States | Runs only if you consent to analytics |
| Meta Pixel Meta Platforms, Inc. | Pseudonymous browser ID, pages viewed, booking events | Measuring and targeting advertising on Facebook and Instagram. | United States | Runs only if you consent to marketing & personalisation |
| Google Ads Google LLC | Pseudonymous click and conversion identifiers | Measuring and targeting advertising on Google properties. | United States | Runs only if you consent to marketing & personalisation |
| Microsoft Advertising (Bing UET) Microsoft Corporation | Pseudonymous browser ID, pages viewed, conversion events | Measuring and targeting advertising on Bing and the Microsoft Audience Network. Fires from our tag manager container. | United States | Runs only if you consent to marketing & personalisation |
| WebEngage Webklipper Technologies Private Limited | Customer ID, name, email, phone, date of birth, booking and browsing events | Marketing campaigns, on-site personalisation and transactional notifications. | India | Runs only if you consent to marketing & personalisation |
Others we share data with
Property owners and caretakers
To deliver a confirmed booking we share the lead guest's name, contact number, guest count, arrival and departure dates, and any meal or accessibility preference you record, with the owner or caretaker of the home you have booked.
Statutory disclosures
Indian hospitality law requires stay records, and in some states guest identity details, to be made available to the police and to state tourism departments. We disclose personal data to a public authority only where the law requires it, and only to the extent required.
Professional advisers and corporate transactions
Auditors, lawyers and insurers under a duty of confidentiality; and, in a merger or acquisition, the acquiring entity, which becomes bound by this policy.
Transfers outside India
Recipients marked as processing outside India receive data under contractual safeguards. We do not transfer personal data to a country restricted by the Central Government under section 16 of the DPDP Act.
Change your mind
Consent-based recipients can be switched off at any time from your cookie preferences, or by writing to privacy@saffronstays.com. To ask what has been shared about you specifically, use the data request form.