Last updated: 8 October 2026
Saffron Studios Private Limited (CIN U74120MH2015PTC264101), trading as SaffronStays, is the Data Fiduciary for www.saffronstays.com. We engage the data processors and third parties below. Each is bound by contract to process personal data only on our instructions, to keep it secure, and to return or delete it when the engagement ends.
Recipients
| Recipient | Data shared | Purpose | Processed in | Runs when |
|---|---|---|---|---|
| Substack Substack Inc. | Name, email address | Sending the SaffronStays newsletter. Your details are enrolled by our own servers, not by a script in your browser, and only when you ask for the newsletter. | United States | Sent only when you tick the newsletter box at sign-up — never from the cookie panel |
| Razorpay Razorpay Software Private Limited | Name, email, phone, booking reference, amount | Payment processing and refunds. Card and UPI credentials are entered on Razorpay's own PCI-DSS certified surface — SaffronStays never receives them. | India | Runs without consent — the service cannot be delivered without it |
| ImageKit ImageKit Private Limited | IP address, device and browser characteristics | Serving and resizing property images. | India | Runs without consent — the service cannot be delivered without it |
| Cloudinary (legacy media only) Cloudinary Ltd. | IP address, device and browser characteristics | Serving guest photographs and videos uploaded before we moved to ImageKit. Those rows still hold Cloudinary URLs; nothing new is uploaded there. | Israel / United States | Runs without consent — the service cannot be delivered without it |
| Elfsight CDN (legacy images only) Elfsight LLC | IP address, page viewed, device and browser characteristics | Hosting for the team photographs on our About Us page, left over from a widget we no longer use. No Elfsight script runs on the site. Listed as necessary because these are page images, loaded with the page and not gated on a consent category — re-hosting them removes the vendor entirely. | Cyprus | Runs without consent — the service cannot be delivered without it |
| Zoko (WhatsApp Business Platform) Bourbon Science Inc., trading as Zoko, on WhatsApp's Business Platform (WhatsApp LLC, Meta Platforms, Inc.) | Name, mobile number, and the content of the message | Delivering service messages on WhatsApp — one-time passwords, booking confirmations and changes, payment links and payment reminders, check-in details, cancellation and refund updates, support replies, and follow-ups on an enquiry you made about a stay. WhatsApp is one of the channels we provide the service through; these messages carry no promotions. | United States | Sent from our own servers when you sign in, book, pay or ask us something — never from a script in your browser, and not dependent on the cookie panel. Write to us to have service messages sent by SMS and email instead. |
| OpenAI OpenAI, L.L.C. | The text of the enquiry or support conversation, which can include whatever you wrote in it — such as your name, travel dates and the home you asked about | Drafting replies and follow-ups on enquiries, sorting support tickets, and reading the tone of support chats, so the right person answers. A member of our team or our own systems decide what is sent; OpenAI only returns draft text and labels. | United States | Sent from our own servers when you enquire or contact support — never from a script in your browser, and not dependent on the cookie panel. |
| Google Sign-In Google LLC | Name, email address, profile picture | Optional social login, only if you choose to sign in with Google. | United States | Runs without consent — the service cannot be delivered without it |
| Facebook Login Meta Platforms, Inc. | Name, email address, profile picture | Optional social login, only if you choose to sign in with Facebook. | United States | Runs without consent — the service cannot be delivered without it |
| SaffronStays support chat Saffron Studios Private Limited (self-hosted widget) | Whatever you type into the chat, plus name, phone and email if you provide them | Live support chat and enquiry handling. | India | Runs only if you consent to functional technologies |
| Google Analytics 4 & Google Tag Manager Google LLC | Pseudonymous client ID, pages viewed, approximate location from IP, device characteristics | Traffic measurement and understanding how pages are used. | United States | Runs only if you consent to analytics |
| Microsoft Clarity Microsoft Corporation | Pseudonymous session ID, clicks, scrolls and pointer movement, pages viewed | Session replay and heatmaps, used to find broken or confusing screens. Clarity also synchronises its identifier with Microsoft's advertising domains (c.bing.com) as part of its own operation. | United States | Runs only if you consent to analytics |
| Meta Pixel & Conversions API Meta Platforms, Inc. | Pseudonymous browser and ad-click IDs, pages viewed, and booking, payment, enquiry and saved-villa events. The copy sent from our servers also includes your email, phone, name, city, state, PIN code and country, each hashed before it leaves our servers, and your SaffronStays account ID, IP address and browser type, which are not hashed | Measuring and targeting advertising on Facebook and Instagram. Booking steps, payments and enquiries are sent twice — once by a tag in your browser and once from our own servers — so that Meta can match the two copies and count each action once. Villa views and saved villas are sent by the browser tag only. | United States | The browser tag, and our servers' copy of booking steps and enquiries, are sent only after you accept marketing in the cookie banner. The copy of a completed payment comes from our payment system rather than your browser, so it follows the marketing preference on your account instead, which withdrawing marketing consent while signed in also switches off. Nothing is sent for an account whose date of birth shows the holder is under 18. |
| Google Ads Google LLC | Pseudonymous click and conversion identifiers | Measuring and targeting advertising on Google properties. | United States | Runs only if you consent to marketing & personalisation |
| Microsoft Advertising (Bing UET) Microsoft Corporation | Pseudonymous browser ID, pages viewed, conversion events | Measuring and targeting advertising on Bing and the Microsoft Audience Network. Fires from our tag manager container. | United States | Runs only if you consent to marketing & personalisation |
| WebEngage Webklipper Technologies Private Limited | Customer ID, name, email, phone, date of birth, booking and browsing events | Marketing campaigns, on-site personalisation and transactional notifications. | India | Runs only if you consent to marketing & personalisation |
Others we share data with
Property owners and caretakers
To deliver a confirmed booking we share the lead guest's name, contact number, guest count, arrival and departure dates, and any meal or accessibility preference you record, with the owner or caretaker of the home you have booked.
Statutory disclosures
Indian hospitality law requires stay records, and in some states guest identity details, to be made available to the police and to state tourism departments. We disclose personal data to a public authority only where the law requires it, and only to the extent required.
Professional advisers and corporate transactions
Auditors, lawyers and insurers under a duty of confidentiality; and, in a merger or acquisition, the acquiring entity, which becomes bound by this policy.
Transfers outside India
Recipients marked as processing outside India receive data under contractual safeguards. We do not transfer personal data to a country restricted by the Central Government under section 16 of the DPDP Act.
Change your mind
Consent-based recipients can be switched off at any time from your cookie preferences, or by writing to privacy@saffronstays.com. To ask what has been shared about you specifically, use the data request form.