Privacy Policy · Baagly

1.What We Collect

When you create an account or book a stay:

Your name, email address and mobile number, and a password if you sign up with email. If you sign in with Google, we receive your name and email address from Google and never see your Google password.
One-time verification codes sent to your email or mobile, which are stored only as a hash and expire within minutes.
Booking details: the property, dates, number of guests, the amount paid, and any coupon used.
Anything you write to us or to a host through the Platform, including support requests.

When you list a property as a host, additionally:

Identity documents required by law before a listing can go live: your PAN number, and images of your PAN and Aadhaar cards, which are kept for verification. Of the Aadhaar number itself we store only the last four digits and a one-way hash used to detect duplicate accounts; the full number is not stored as text.
Bank account details for payouts, of which only the last four digits are shown back to you.
The property's address and map location, photographs, pricing and house rules — which are published as part of the listing.

Automatically:

Standard server logs: IP address, browser type, the pages requested and when. These are used for security and rate limiting and are not sold or shared.
Your approximate location, only if you tap "Near me" on the map page and grant permission. It is used in your browser for that session and is never sent to our servers or stored.

2.Payments

Payments are processed by PhonePe, a licensed payment gateway. When you pay, you are taken to a page operated by PhonePe, and your card, UPI or bank details are entered there.
We never receive or store your card number, CVV, UPI PIN or bank login. We receive only a payment reference, the amount, and whether the payment succeeded.
PhonePe's handling of your payment details is governed by its own privacy policy.

3.How We Use It

To operate your account, take and confirm bookings, and pay hosts.
To send you the emails and messages that a booking requires: verification codes, booking confirmations, payment reminders, cancellations and refunds. These are transactional, not marketing.
To verify hosts as the law requires, and to detect fraud, duplicate accounts and abuse.
To respond when you contact support.
We do not sell personal data, and we do not use it for advertising.

4.Who Can See It

The host of a property you book sees your name, the dates, the number of guests and the amount, so they can receive you. They do not see your payment details.
A guest who books sees the host's name and, once the booking is paid, the property's exact address and the host's verified mobile number, so the two can arrange arrival.
Platform administrators can see account, booking and verification details in order to approve listings, resolve disputes and process refunds. Identity documents are visible only to administrators, only for verification.
Service providers who act on our behalf: the payment gateway (PhonePe), our email, SMS and WhatsApp (Meta) messaging providers, and the servers that host the Platform. Each receives only what it needs to do its job.
Authorities, where the law requires it.

5.Cookies

We set one cookie: a secure, HTTP-only session cookie that keeps you signed in. It contains no personal details.
A short-lived cookie is used during Google sign-in to protect against forged sign-in attempts, and is cleared when sign-in completes.
Your browser may remember small conveniences such as a draft listing you were writing. That is stored on your device, not with us.
We do not use advertising or cross-site tracking cookies.

6.How Long We Keep It

Account details are kept while your account is active.
Booking and payment records are kept for as long as Indian tax and company law require, which can be up to eight years.
Verification codes are deleted within minutes of expiring.
Server logs are rotated and are not kept longer than necessary for security.

7.Your Rights

You can see and update your name, phone number and notification preferences from your account at any time.
You can ask us for a copy of the personal data we hold about you, to correct it, or to delete your account. Records we are legally required to keep, such as completed booking and payment records, will be retained for the required period.
To make any of these requests, write to us at the address below. We will respond within thirty days.

8.Who we are, and how to reach us

Baagly is operated by Shubh Gupta, sole proprietor trading as Shubh Traders, GSTIN 09EANPG5213E1ZT. That business is the data controller for the personal data described in this policy.
Address: Gate No. 2, Balaji Mandir Road, Near Balaji Mandir, Hallu Sarai, Sambhal, Uttar Pradesh 244302, India
Email: info@baagly.com
Phone: +91 99977 60912, every day 9am – 9pm IST
Questions about this policy, or a request about your data, can be sent to either.

1.What We Collect

When you create an account or book a stay:

Your name, email address and mobile number, and a password if you sign up with email. If you sign in with Google, we receive your name and email address from Google and never see your Google password.
One-time verification codes sent to your email or mobile, which are stored only as a hash and expire within minutes.
Booking details: the property, dates, number of guests, the amount paid, and any coupon used.
Anything you write to us or to a host through the Platform, including support requests.

When you list a property as a host, additionally:

Identity documents required by law before a listing can go live: your PAN number, and images of your PAN and Aadhaar cards, which are kept for verification. Of the Aadhaar number itself we store only the last four digits and a one-way hash used to detect duplicate accounts; the full number is not stored as text.
Bank account details for payouts, of which only the last four digits are shown back to you.
The property's address and map location, photographs, pricing and house rules — which are published as part of the listing.

Automatically:

Standard server logs: IP address, browser type, the pages requested and when. These are used for security and rate limiting and are not sold or shared.
Your approximate location, only if you tap "Near me" on the map page and grant permission. It is used in your browser for that session and is never sent to our servers or stored.

2.Payments

Payments are processed by PhonePe, a licensed payment gateway. When you pay, you are taken to a page operated by PhonePe, and your card, UPI or bank details are entered there.
We never receive or store your card number, CVV, UPI PIN or bank login. We receive only a payment reference, the amount, and whether the payment succeeded.
PhonePe's handling of your payment details is governed by its own privacy policy.

3.How We Use It

To operate your account, take and confirm bookings, and pay hosts.
To send you the emails and messages that a booking requires: verification codes, booking confirmations, payment reminders, cancellations and refunds. These are transactional, not marketing.
To verify hosts as the law requires, and to detect fraud, duplicate accounts and abuse.
To respond when you contact support.
We do not sell personal data, and we do not use it for advertising.

4.Who Can See It

The host of a property you book sees your name, the dates, the number of guests and the amount, so they can receive you. They do not see your payment details.
A guest who books sees the host's name and, once the booking is paid, the property's exact address and the host's verified mobile number, so the two can arrange arrival.
Platform administrators can see account, booking and verification details in order to approve listings, resolve disputes and process refunds. Identity documents are visible only to administrators, only for verification.
Service providers who act on our behalf: the payment gateway (PhonePe), our email, SMS and WhatsApp (Meta) messaging providers, and the servers that host the Platform. Each receives only what it needs to do its job.
Authorities, where the law requires it.

5.Cookies

We set one cookie: a secure, HTTP-only session cookie that keeps you signed in. It contains no personal details.
A short-lived cookie is used during Google sign-in to protect against forged sign-in attempts, and is cleared when sign-in completes.
Your browser may remember small conveniences such as a draft listing you were writing. That is stored on your device, not with us.
We do not use advertising or cross-site tracking cookies.

6.How Long We Keep It

Account details are kept while your account is active.
Booking and payment records are kept for as long as Indian tax and company law require, which can be up to eight years.
Verification codes are deleted within minutes of expiring.
Server logs are rotated and are not kept longer than necessary for security.

7.Your Rights

You can see and update your name, phone number and notification preferences from your account at any time.
You can ask us for a copy of the personal data we hold about you, to correct it, or to delete your account. Records we are legally required to keep, such as completed booking and payment records, will be retained for the required period.
To make any of these requests, write to us at the address below. We will respond within thirty days.

8.Who we are, and how to reach us

Baagly is operated by Shubh Gupta, sole proprietor trading as Shubh Traders, GSTIN 09EANPG5213E1ZT. That business is the data controller for the personal data described in this policy.
Address: Gate No. 2, Balaji Mandir Road, Near Balaji Mandir, Hallu Sarai, Sambhal, Uttar Pradesh 244302, India
Email: info@baagly.com
Phone: +91 99977 60912, every day 9am – 9pm IST
Questions about this policy, or a request about your data, can be sent to either.