Privacy Policy

1. Who we are

Tulastay is an independent hotel price-comparison service operated from India by Surya Narayan Mishra, who is the Data Fiduciary for personal data processed through the Service. Contact: hello@tulastay.com.

Some features described below are not yet available. This policy describes the data we collect today and the data we may collect as the Service grows. We will only collect data for a feature once it is live.

2. Personal data we collect

Data you provide to us

• Contact and correspondence: your email address and the content of messages you send us.
• Account data (if offered): your name, email address, login credentials and account preferences.
• Saved searches, price alerts and newsletter (if offered): your email address, the destinations, dates and preferences you save, and your communication choices.

Data collected automatically

• Log and device data: IP address, browser and device type, operating system, pages requested, referring URL, and date and time of access.
• Search data: destinations, dates and guest numbers you search for.
• Usage and analytics data: aggregated information about how the Service is used, such as pages viewed and features used.
• Cookies and similar technologies: see Section 5 and our Cookie Policy.
• Referral data: when you click a link to a booking partner, information that a referral was made from Tulastay.

We do not collect payment card details. Bookings and payments take place on partner websites.

3. How we use personal data

• to provide, operate and maintain the Service and show search results;
• to create and manage accounts, saved searches and price alerts, if you use them;
• to send emails you have requested, such as price alerts or a newsletter, which you can unsubscribe from at any time;
• to respond to your enquiries and requests;
• to understand usage and improve the Service;
• to measure referrals to booking partners and receive commissions;
• to keep the Service secure and prevent fraud, abuse and scraping;
• to comply with legal obligations and enforce our Terms of Use.

We do not sell personal data.

4. Legal basis and consent

We process personal data on the basis of your consent, or for legitimate uses permitted under the DPDP Act, such as data you voluntarily provide for a specific purpose, or compliance with law. Where we rely on consent, we will ask for it clearly and you may withdraw it at any time, as easily as you gave it. Withdrawal does not affect processing carried out before withdrawal.

5. Cookies and analytics

We use or may use the following categories of cookies and similar technologies:

• Strictly necessary — required for the Service to work and be secure.
• Preference — remember choices such as currency or recent searches.
• Analytics — help us understand how the Service is used. We prefer privacy-friendly analytics tools (for example Vercel Web Analytics or Cloudflare Web Analytics) that minimise or avoid identifying individuals.
• Affiliate tracking — set by booking partners or affiliate networks when you click a partner link, to record the referral.

We will ask for your consent before using any non-essential cookies. Details and choices are in our Cookie Policy.

6. Sharing with third parties

We share personal data only as needed with the following categories of recipients:

• Hosting and infrastructure providers (such as Vercel for hosting and Cloudflare for DNS, content delivery and security);
• Map providers (such as OpenStreetMap, whose tile servers receive your IP address when maps load);
• Analytics providers;
• Email service providers for correspondence, alerts and newsletters;
• Booking partners and affiliate networks, such as online travel agencies and affiliate networks, when you click a partner link (see our Affiliate Disclosure);
• Authorities and professional advisers, where required by law or to protect our rights.

Partner and third-party websites have their own privacy policies, which we do not control. Please review them before booking.

7. Transfers outside India

Our service providers may store or process personal data outside India. Such transfers are made in accordance with the DPDP Act and any restrictions notified by the Government of India, and we take reasonable steps to make sure your data is protected.

8. Data retention

We keep personal data only for as long as needed for the purposes described in this policy, or as required by law. Typically: server and security logs are kept for a limited period by our providers; account data is kept until you delete your account; email subscriptions are kept until you unsubscribe; and correspondence is kept as long as needed to deal with your request. We then delete or anonymise the data.

9. Security

We use reasonable security safeguards, including HTTPS encryption and reputable service providers, to protect personal data. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required by law.

10. Your rights

Under the DPDP Act, you have the right to:

• obtain a summary of the personal data we process about you and the processing activities;
• request correction, completion or updating of your personal data;
• request erasure of your personal data;
• withdraw consent at any time;
• nominate another person to exercise your rights in the event of death or incapacity; and
• have your grievances redressed.

To exercise these rights, email hello@tulastay.com. We may need to verify your identity before acting on a request.

11. Grievance redressal

If you have a concern about how we handle personal data, please contact our grievance contact at hello@tulastay.com with the subject line “Grievance”. We will acknowledge your grievance and respond within the time required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

12. Children

The Service is intended for adults. We do not knowingly process personal data of children (individuals under 18) without verifiable parental consent, and we do not track, behaviourally monitor or target advertising at children. If you believe a child has given us personal data, please contact us and we will delete it.

13. Third-party links

The Service contains links to third-party websites. We are not responsible for their content or privacy practices.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the “Last updated” date. Where changes are significant, we will provide additional notice where appropriate.

15. Contact us

Questions about this policy: hello@tulastay.com.