Policy

Privacy

Last updated 1 September 2026

Two fields still need filling before launch: the grievance officer’s name and the registered postal address, marked [ … ] below. Indian law requires both to be real and reachable. This page describes the system accurately; that is not the same as legal advice, and a lawyer qualified in India should read it before you rely on it.

This is the notice required by the Digital Personal Data Protection Act, 2023. It describes what MyBills Technologies (“we”, “us”) does with personal data in MyBills Resort, and what you can require of us. It is written to be read rather than survived.

Who is responsible for what

Two groups of people appear here and the law treats them differently.

Resort owners and staff hold an account with us. For their data we are the Data Fiduciary — we decide why it is collected and we answer for it.
Guests are the resort’s customers. The resort decides what to record about them and why; we only process it on the resort’s instructions. For guest data the resort is the Data Fiduciary and we are its Data Processor.

This matters when you want something done. If you are a guest and want your details corrected or erased, the resort is the right place to ask — the decision is theirs, and we act on their instruction. If they do not respond, write to us anyway: we will pass it on and tell you that we have.

What we collect, and why

What	Why	Kept for
Your name, phone number, email	To create your account, sign you in, and send invoices and receipts	While the account exists, then 12 months
Your business name, address, GSTIN	They appear on the bills you issue and on ours to you	8 years, as tax law requires of invoices
Guest name, phone, email	Recorded by the resort to manage a booking and send a confirmation	The resort decides; deleted on their instruction
Guest identity documents	Only where a resort captures one at check-in, with the guest’s consent recorded at that moment	12 months by default, configurable per resort, swept automatically
Booking, payment and audit records	To run the service and keep an accurate record of who did what	8 years for anything with a tax consequence; audit entries for the life of the account
Request logs	Security and diagnosis. Method, path, status, duration, IP address. Never request bodies, never credentials	30 days

We use no advertising trackers and no analytics that follow you between sites. We do not build behavioural profiles. We do not sell anything to anybody — and if that ever changed it would need your fresh consent, not a quiet edit to this page.

Cookies and local storage

We set no advertising or analytics cookies. The app keeps a session token in your device’s keychain and a few interface preferences in local storage. That is all.

Children

Accounts are for people aged 18 or over. We do not knowingly create an account for a child, we do not track children, and we direct no advertising at them — we do not advertise at all. Where a resort records a child as part of a booking party it records a count and, at most, a name; that collection is the resort’s, under its own lawful basis, and the Act’s requirement of verifiable parental consent falls to them.

How it is protected

Personal data is encrypted before it reaches the database, with AES-256-GCM. The key is never given to the database, so a stolen copy of the database yields ciphertext.
Identity documents are encrypted before they reach storage, and every single time one is viewed an entry is written to the resort’s own audit log. There is no route by which we can read one without leaving that record.
Each resort’s data is isolated at the database level, not by application code remembering to filter. A query with no established scope returns nothing rather than everything.
Full Aadhaar images are deliberately not accepted. A resort may record a passport, driving licence, voter ID or a masked Aadhaar. That restriction is ours to impose, not yours to remember.
Access to the production system is by key only, and our own staff console cannot read guest names, phone numbers or identity documents at all.

Where it lives

All personal data is stored and processed in India, in Oracle Cloud Infrastructure’s Hyderabad region. We do not transfer personal data outside India. If that ever needs to change we will say so here first, and tell account holders directly.

Who else touches it

We keep this list short on purpose.

Oracle Cloud Infrastructure (Hyderabad, India) — servers, database and encrypted document storage.
GoDaddy Professional Email — sends transactional email such as verification, invoices and booking confirmations. It carries the message, not your records.

We send no SMS and run no WhatsApp integration. When a resort shares a booking link with a guest, that message goes from the resort’s own phone, through their own WhatsApp. We never see it.

Your rights

Under the DPDP Act you may:

Ask what we hold about you, and for a summary of how it is processed.
Have it corrected if it is wrong, or completed if it is partial.
Have it erased — unless we are required to keep it. Invoices and the records behind them carry a statutory retention we cannot shorten.
Withdraw consent at any time. Withdrawing is as easy as giving it: one message to the address below, no form and no retention call. Withdrawal does not undo processing that was lawful before it.
Nominate someone to exercise these rights for you if you die or become unable to. Tell us who, in writing, and we will record it.
Complain to us — and if we do not resolve it, to the Data Protection Board of India. You need no permission from us to go to the Board, and we will not ask you to exhaust anything first.

We answer rights requests within 30 days. If one will take longer we will tell you why before that period is out, rather than after.

If something goes wrong

If personal data is exposed we will notify the Data Protection Board and every affected person without undue delay — what happened, what data was involved, what we have done, and what you should do. We will not wait for certainty about the scope before telling you that something has happened.

Deleting your account

Write to us and we will delete your account and the personal data in it, except records we are legally required to retain. Deletion is real: identity documents are removed from storage, not merely unlinked from a row. We will tell you what was kept and why.

Staff accounts are deactivated rather than deleted while a resort is still trading, because a person’s name has to stay attached to the bookings and payments they handled for the record to mean anything. Deactivation ends every session immediately and removes all access.

Getting in touch

For data protection and privacy, including any request above:

Grievance Officer: [NAME TO BE FILLED]
Email: support@mybills.co.in
Post: MyBills Technologies, [POSTAL ADDRESS TO BE FILLED]

We acknowledge every privacy request within 72 hours and resolve it within 30 days.

Changes

If we change this notice we will update the date at the top and — where the change affects what we do with your data — tell account holders by email before it takes effect. We will not make a material change quietly.