Privacy & data

JuxTravel is a brand of Hostsphere India Private Limited, a company incorporated in India. For the personal data described in this policy, Hostsphere India Private Limited is the Data Fiduciary under the Digital Personal Data Protection Act, 2023.

This policy covers:

• the JuxTravel app on Android and any future platforms;
• juxtravel.com and its sub-pages, including the homestay owner waitlist;
• support conversations, whether in-app, over email or on WhatsApp.

It does not cover what happens once you are at a host's property, or what a host does with information you give them directly. Hosts are independent businesses and are responsible for their own handling of your data. It also does not cover third-party websites we link to.

a. Information you give us Name, phone number, email address, profile photo, date of birth where required, travel preferences, trip briefs written in your own words, saved stays, party composition, accessibility or dietary notes you choose to add, Moments and reels you post, reviews you write, and anything you tell us in a support ticket.

b. Information created as you use JuxTravel Bookings, trip plans, group voting activity, Passport stamps and history, saved stays, Moments activity and interactions, support ticket history and our replies, notification and communication preferences.

c. Device and technical information Device model, operating system version, app version, IP address, language, time zone, mobile advertising identifier where applicable, crash reports, diagnostic logs, and in-app interaction events.

d. Location [[Confirm before publishing.]] With your permission, we use your device location to show nearby stays, estimate travel effort in the Reality Layer, and help with directions during a trip. You can refuse this at the OS prompt or switch it off later in your device settings, and JuxTravel will still work — you will just need to type where you are going. We do not track your location in the background unless you separately enable a feature that says it does.

e. Payment information Payment amount, currency, date, method type, last four digits, and a payment reference or token. We do not store your full card number, CVV or UPI PIN. Payments are processed by Razorpay Software Private Limited, which handles your card details under RBI's tokenisation framework. See section 06.

f. Verification information You choose one of: driving licence, passport, voter ID or Aadhaar. We store the number you enter, the photograph of the document and the selfie taken with it — they are not discarded after review. To keep the community trustworthy, we may ask travellers and hosts to verify identity. This can include a government-issued identity document, a selfie for liveness matching, and for hosts, proof of ownership or authority over the property and any required local registration. No third-party verification vendor is used. Submissions are reviewed by a member of our team.

g. Communications WhatsApp messages you exchange with us, emails, and in-app messages, together with delivery and read status where the channel provides it.

h. Information from others Information a host or a fellow traveller in your group gives us about you — for example when someone books on your behalf or adds you to a group trip.

We process your personal data for the purposes below. Under the DPDP Act, we rely either on your consent or on a legitimate use permitted by the Act.

We will not use your personal data for a new purpose that is materially different from these without telling you and, where required, asking again.

Where we rely on consent, we ask for it clearly and separately, and we keep a record of what you agreed to and when.

You can withdraw consent at any time, and it should be as easy to withdraw as it was to give. In the app: [[There is no withdraw-consent control in the app today — see the note at the end of this section. Do not describe a path that does not exist.]] Withdrawal is not retrospective — it does not undo processing that already happened lawfully — and some features stop working without the underlying consent. For example, if you withdraw location consent, Reality Layer travel estimates will be less accurate.

Open point for the build, not for counsel. The app has a privacy & data screen with Download your data, Privacy policy, Control your moments and Delete account — but no general withdraw-consent control. DPDP s.6(4) expects withdrawal to be as easy as giving consent was, so this clause cannot be finalised by writing a path; it needs the control to exist first.

Withdrawing consent is not the same as deleting your account. Section 12 covers deletion.

Your host. When a booking is confirmed, your host receives your name, contact number, number of guests, dates and any notes relevant to the stay. Hosts need this to receive you. Before confirmation, hosts see only what is necessary to respond to a request.

Razorpay. Payments are processed by Razorpay Software Private Limited. Card details go to Razorpay, not to us. Razorpay processes them under its own privacy policy and under RBI rules.

Service providers. We use third parties for hosting, databases, notifications, WhatsApp messaging, analytics, crash reporting and customer support tooling. They act on our instructions, are bound by contract, and may not use your data for their own purposes. Razorpay (payments) · Supabase (database, authentication and file storage) · ImageKit (image storage and delivery) · Google (application hosting on Cloud Run in Mumbai; Maps and Places; Workspace for email) · Meta (WhatsApp for login codes and trip messages; Instagram for hosts who connect an account) · OpenAI (matching and recommendations) · OpenWeatherMap (weather and air quality) · Vercel (this website and the api.juxtravel.com alias)

AI providers. See section 08.

Authorities. Where we are legally required to — for example a valid order from a court, a police request, or a tax or regulatory authority.

Corporate transactions. If Hostsphere India is involved in a merger, acquisition or restructuring, data may transfer as part of that, subject to this policy.

We do not sell your personal data.

What the host receives

When you book, the host has to be able to receive you, so on confirmation we pass them:

• your name;
• your phone number;
• the dates, and how many people are coming.

They receive this to host you and for nothing else. Hosts are contractually barred from using it for marketing, from moving the booking off JuxTravel, and from sharing it further.

Before a booking is confirmed the host sees only what your trip brief contains — not your name or your contact details.

Your data is stored and processed in India. We primarily store personal data on servers located in Mumbai, India (asia-south1). Some of our service providers process data outside India. India's DPDP framework permits transfers except to countries the Central Government restricts, and we do not transfer personal data to any restricted country. Where data leaves India, contractual safeguards apply.

JuxTravel uses automated processing to make the product work — Jux Fit matching, the Reality Layer, and the AI travel companion.

• What feeds it: your trip brief, stated preferences, saved stays, past bookings, and where you allow it, location.
• What it produces: suggestions, match scores, effort and trade-off estimates. These are estimates and editorial judgements, not guarantees. You always choose what to book.
• Third-party models: OpenAI. Prompts are processed outside India.
• Training: We do not use your personal data or your content to train AI models.
• No solely-automated decisions with legal effect are made about you. If verification or fraud checks flag your account, a person reviews it before any account restriction, and you can contest the outcome via section 17.

This website sets no cookies and uses no analytics, tag manager or advertising pixel. Our website uses strictly necessary cookies to function. None are used, so no consent banner is required. If that changes, this section and a banner must change with it. The app does not use cookies, but does use device identifiers and SDKs as described in section 03(c).

Open point for the build, not for counsel. No retention schedule is implemented anywhere in the codebase today — there is no purge job, no expiry and no cutoff, so nothing here can be filled by reading the code. Each row needs a period chosen and then built; publishing a table the system does not enforce is a promise that quietly fails, and DPDP requires erasure once the purpose is served rather than at our convenience.

One row is already partly answered: verification documents are now deleted when an account is deleted, along with the files behind them. What is still undecided is how long they are kept while an account stays open.

When a retention period ends, we erase the data or irreversibly de-identify it.

[[Align this section with your actual Security & Access document — do not overclaim.]] We apply reasonable security safeguards, including encryption of data in transit and at rest, role-based access control with least privilege, row-level security on our databases, logging and monitoring of access, retained for at least one year, secure backups, and contractual security obligations on our processors.

No system is perfectly secure. Please use a strong sign-in method, keep your device secure, and tell us immediately if you think someone has accessed your account.

If a personal data breach occurs, we will notify each affected user without delay, describing what happened, the likely consequences, what we are doing about it, and what you can do. We will also report to the Data Protection Board of India within the timelines set by the DPDP Rules.

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we process about you and who we have shared it with.
• Correction and completion — fix what is wrong, complete what is missing, update what has changed.
• Erasure — ask us to delete personal data we no longer need, subject to legal retention.
• Nominate — nominate another individual to exercise your rights if you die or become incapacitated. [[Build this into the app; it is specific to Indian law and commonly missed.]]
• Withdraw consent — see section 05.
• Grievance redressal — see section 17.

How to exercise them. In the app: You → Settings → Privacy & data. Or email privacy@juxtravel.com from your registered email address. We respond within 30 days. We may ask you to verify your identity first, because we are not going to hand your travel history to someone who is not you.

Data export. A self-service export is not live yet. Until it ships, ask us and we will send you a copy of your bookings, profile and Moments within 30 days. The right does not wait for the feature.

You can delete your account in the app: You → Settings → Privacy & data → Delete account. If you no longer have the app installed, use https://juxtravel.com/delete-account, which explains the same process and requires no download.

When you delete:

• Your name, phone number, email address and profile photo are erased.
• What you wrote — messages, reviews, Moments and support tickets — is erased.
• Bookings, payments and payout records are retained without your personal identifiers, because tax and company law require us to keep transaction records.
• Places you hosted are unpublished rather than deleted, so past guests keep their own booking history.

Deletion is not reversible. If you have an active booking or an unresolved payment, we will complete or cancel it first.

JuxTravel is intended for people aged 18 and over. You may book for children travelling with you, but a child may not hold an account.

If we process the personal data of anyone under 18, we will obtain verifiable consent from a parent or lawful guardian, and we will not carry out behavioural tracking or targeted advertising directed at children. The same protections apply to a person with a disability who has a lawful guardian.

If you believe a child has created an account, tell us at privacy@juxtravel.com and we will remove it.

We send two kinds of message:

• Transactional — booking confirmations, changes, payment receipts, support replies, safety notices. These are part of the service and cannot be switched off while you hold a booking.
• Marketing and product updates — offers, new features, trip inspiration. These are opt-in and you can opt out at any time, in your notification preferences, by replying STOP on WhatsApp, or by using the unsubscribe link in any email.

WhatsApp messages are sent through a WhatsApp Business Solution Provider and are subject to WhatsApp's own terms.

We will update this policy as JuxTravel changes. Where a change is material, we will notify you in the app or by email before it takes effect. We will also remind you of this policy at least once a year, as Indian law requires. The version and effective date at the top always tell you which version you are reading, and .

Step 1 — Support. Raise a ticket in the app, or email support@juxtravel.com.

Step 2 — Grievance Officer. If Support has not resolved it, contact our Grievance Officer, appointed under the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020.

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. Consumer complaints under the E-Commerce Rules are acknowledged within 48 hours and resolved within one month.

Step 3 — Data Protection Board of India. If you are not satisfied with how we have handled a complaint about your personal data, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

JuxTravel is a brand of Hostsphere India Private Limited.