Privacy Policy

legal name, registered address. Contact: privacy@beddesk.in.

Grievance Officer — required under the DPDP Act and the IT Rules: name, privacy@beddesk.in, phone. We respond within 30 days of any request or complaint.

From hostel owners (as Fiduciary): name, business name, phone, email, address, GSTIN, staff names and roles, login credentials (passwords stored hashed, never in plain text), payment records, usage logs, IP address and device information.

From residents (as Processor, entered by the hostel): name, phone and WhatsApp number, alternate phone, email, gender, date of birth, permanent address, occupation and institution, emergency contact details, identity document images and the last four digits of the identity number, room and bed allocation, rent and payment history, meal opt-out records, WhatsApp message history with the Service, and exit and settlement details.

We do not collect: biometrics, location tracking, card or bank credentials, or data from anyone under 18 without the verifiable parental consent the DPDP Act requires.

To provide the Service; to authenticate users; to send transactional WhatsApp and email messages; to bill subscriptions; to provide support; to detect abuse and secure the platform; and to comply with the law.

Hostels may upload images of identity documents, including Aadhaar. We handle them as follows:

• Stored in a private, encrypted store, never publicly accessible.
• Reachable only through links that expire in 60 seconds, and only for the hostel’s owner and manager roles.
• Only the last four digits of an identity number are stored in readable form.
• Every view, download and deletion is logged, and that log is available to the hostel.
• Deleted three months after the resident leaves, automatically. The hostel is reminded 7 days beforehand.
• Sent to our AI provider only to read the printed fields — not retained by them, never used to train a model, and full identity numbers are never transmitted.

Also disclosed where required by law or valid legal process, and to a successor on a business transfer, with notice.

Encryption in transit and at rest; database-level tenant isolation using row-level security; role-based access; private document storage with short-lived signed links; audited access to identity documents; hashed passwords; daily backups.

No system is perfectly secure. In a breach we will notify the Data Protection Board of India and affected persons as the DPDP Act requires.

Access, correction, completion, updating and erasure; nomination of someone to exercise your rights on your behalf; grievance redressal; and withdrawal of consent.

• Hostel owners: write to privacy@beddesk.in.
• Residents: contact your hostel — they are your Data Fiduciary. We will help them act on your request.

Residents receive messages only where their hostel has recorded their consent. Reply STOP at any time to stop notifications. Messages are delivered by Meta and are subject to WhatsApp’s own privacy terms.

Essential cookies only — session and security. We do not use advertising or tracking cookies. If we add analytics we will disclose the tool here first.

The Service is not intended for anyone under 18. A hostel accommodating a minor must obtain verifiable parental consent before entering their data, as the DPDP Act requires.

Material changes are notified 15 days in advance, by email and in the app.