KYC and Data Protection

We verify the identity of the businesses we onboard and the partners we pay. Verification helps confirm that a property is a genuine business, that a payout reaches the right person, and that we meet obligations under applicable Indian law relating to taxation, anti-money-laundering and records.

• Hospitality partners — the business subscribing to the platform, and the person authorised to act for it.
• Sales partners — any individual or firm receiving commission under the Sales Partner Agreement.

Guests are never asked to complete KYC. The guest experience requires no account and no identity document.

• Identity proof of the authorised person or partner (for example PAN).
• Business registration or incorporation details, where applicable.
• GST registration details, where the business is registered.
• Proof of the business address.
• Bank account proof in the name of the business or partner, for payouts and refunds.
• Any food or business licence we are required to sight for a property.

We ask only for what is needed for the relationship in question. We never ask for your full card number, CVV, UPI PIN, net-banking password or any one-time password.

1. You submit the documents through the channel we specify.
2. We check them for completeness and consistency, and may ask for clarification.
3. Bank details are confirmed before the first payout or refund is processed.
4. We record the outcome of the check, and the date it was completed.

We may decline or pause onboarding, or withhold a payout, where verification cannot be completed, where documents appear altered, or where the law requires it.

• Access is restricted to the staff who need it for verification, finance or compliance.
• Documents are transmitted over encrypted connections and stored with access controls.
• KYC documents are not used for marketing and are not sold.
• Access is logged, and removed when a staff member no longer needs it.

• Banking and payment partners, to the extent needed to verify an account or release a payout.
• Auditors and professional advisers, under confidentiality obligations.
• Government authorities, where disclosure is required by law or lawful order.

KYC records are retained for the period required by applicable law after the relationship ends — currently understood to be [KYC retention period] — and are then deleted or anonymised. Where a record is relevant to an ongoing dispute, audit or investigation, it is retained until that concludes.

We handle KYC data in line with the Digital Personal Data Protection Act, 2023 and applicable rules under the Information Technology Act, 2000. We collect it for the specific purposes described above, give notice of those purposes, and keep it no longer than necessary.

Your rights of access, correction, erasure and grievance redressal are described in the Privacy Policy. Note that a request to erase KYC data may not be capable of being met while a legal retention obligation still applies.

If a personal data breach affects your information, we will notify the relevant authority and affected individuals as required by applicable law, and set out what happened and what we are doing about it.

Questions about verification or the handling of your documents: [grievance@yourdomain.com], or write to [Grievance Officer name] at [Registered office address].