Privacy

An account holds your name, your email address and — if you set one — a password, which is stored hashed and cannot be read back. A profile holds what you choose to add: a telephone number, a date of birth, an anniversary, a country, a preferred currency. A booking holds what the stay requires: the guests' names as they will travel, contact details, the stay itself, and any document a house insists on (a PAN, a passport number) — asked for only when a rate requires it, and said so at the time.

If you sign in with Google, Google tells us your name and your email address, and that is all. We do not receive your contacts, your calendar, your files or anything else in your Google account; we never post or act as you; and we use what we receive only to create and sign you into your Kismet account. You can withdraw Kismet's access at any time in your Google account's security settings, and sign in with an email and password instead.

To make and manage your bookings, to run your account, and to speak with you about your stays — a confirmation, a payment deadline, a question from the house. That is the list. We do not sell your details, we do not rent them, and we do not use them for third-party advertising.

The property you book, and the travel supplier through which the booking is placed, receive what the booking needs — the guests' names, the stay, the contact details the house requires — because without them there is no reservation. Payments are processed by Cashfree Payments, a payment aggregator regulated by the Reserve Bank of India, which holds your payment instrument; Kismet does not. Where a rate or the law requires a PAN, it is verified through the same provider; what we keep afterwards is a one-way hash of the number and its last 4 characters, so the number itself can never be read back. No one else sees your details, and no list of our guests exists to be shared. We disclose what we hold only where the law requires it or a court orders it.

We use a product-analytics service, PostHog, to see how the site is used: which pages are opened, what is clicked, and recordings of sessions in which every field you type into is masked before it leaves your browser, so no name, email, card or document ever reaches the recording. We use Sentry to catch errors, with your identity never attached. Both serve to make the product work better and are never used for advertising.

We set the cookies the product needs to work: one that keeps you signed in, and one per booking that lets a confirmation link open its own record and no other. We set no advertising or cross-site tracking cookies.

Under the Digital Personal Data Protection Act, 2023 you may ask what we hold about you, have it corrected or completed, have it erased where we no longer need it, and withdraw a consent you gave; you may also nominate someone to exercise these rights for you. Write to the address below and we will answer within the time the law allows, and sooner where we can. If you are not satisfied, you may raise it with our Grievance Officer, and after that with the Data Protection Board of India.

Bookings are financial records and are kept as the law requires. Everything else is yours to take back: write to us and we will correct what is wrong or delete your account and profile. Deleting an account does not erase the record of stays already taken — those remain, as records of transactions that happened — but it removes everything volunteered beyond them.

Everything moves over encrypted connections. Passwords are hashed, booking records open only to a credential that proves the booking is yours, and access inside Kismet is limited to the people who need it to serve you.

To see what we hold about you, correct it, or have it removed: support@kismetstay.com. Kismet is operated from India by Kismet Stay Private Limited; the full registered particulars are under contact. The same address reaches our Grievance Officer, who acknowledges a grievance within 48 hours and resolves it within a month. When this policy changes, the date at the top changes with it.