This policy explains how Nestinga, South Civil Lines, Roorkee, District Haridwar, Uttarakhand 247667, India ("Nestinga", "we"), handles personal data when you use nestinga.com. Under India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for it; for people in the European Union, the EEA and the UK we are the controller under the GDPR. This policy is also published as the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 require.
Questions, requests and complaints about your data: our Grievance Officer at souravchauhanrajput@gmail.com, +91 87556 48094.
What we use and why
- Your account: name, email, password (stored only as a one-way hash), phone if you add it. To run your account (contract).
- Bookings: what you booked, the names and emails of the guests you book for, answers to the host's registration questions (which can include dietary or health information you choose to give), and acceptance of a waiver with its time and IP address. To make and manage the booking with the host (contract) and keep the records the law requires (legal obligation). Health information is sensitive personal data: we use it only to pass it to the host for your booking, with your consent, which you give by entering it.
- Payments: when you pay online through Nestinga, the payment provider handles your card or account details; we keep payment references, amounts and refunds, never full card numbers. For the booking (contract) and accounting (legal obligation).
- Messages and reviews you write, and listings you save. To provide those features (contract); reviews are public.
- Enquiries: the dates, party size, message and phone number you send a host, with your name and email, which you agree the host receives so they can reply and arrange the booking. On some hosts' plans Nestinga reads an enquiry first and passes it on only if it's genuine. To check it (our legitimate interest in keeping spam and scams away from hosts) and pass it on (your consent, which you can withdraw by deleting your account; the host keeps what they already received).
- Reports you send about listings: your name, email and report. To handle the report as the law requires (legal obligation).
- Hosts: business details (shown on listings, as consumer law in India and the EU requires), verification documents (kept private), team members, their Nestinga plan and how and what they paid for it. For the host relationship (contract, legal obligation).
- Security: sign-in attempts, a two-factor secret for admins (encrypted), IP addresses for limits against abuse (kept only briefly, or as a one-way hash for reports), and server logs. To keep Nestinga and its users safe (legitimate interest, legal obligation).
We don't sell personal data and don't use it for advertising.
Who we share it with
- The host you book with, message or send an enquiry to: what that booking or enquiry needs. After an enquiry the host has your email and phone and is responsible for using them only for it.
- Service providers that work for us and only on our instructions: our hosting provider (the servers Nestinga runs on, with your data and files), Resend (sending email, USA), payment providers when you pay online through Nestinga (Stripe, Razorpay), Google (only if you choose to sign in with Google), and OpenStreetMap: your browser loads map images from it, and we send it hosts' addresses (never guests') to place listings on the map.
- Authorities, when the law requires it, for example a lawful request from an Indian government agency under the Information Technology Act, 2000, or to protect someone's safety.
Some of these providers are outside India and the EU, for example in the USA. We share with each only what it needs to do its job.
How long we keep it
- Your account: until you delete it. Deleting it removes your name and contact details from Nestinga straight away.
- Bookings, payments and invoices: 8 years, as Indian tax and accounting law requires; after you delete your account they're kept without your name or contact details.
- Messages: as long as the booking or enquiry they belong to; your contact details in them are blanked when you delete your account.
- Reports and moderation decisions: 3 years, so we can deal with any dispute about them.
- Host business details: while the host is on Nestinga and 6 months after it leaves. Verification documents: while the host is on Nestinga and 1 year after.
- Server logs: up to 1 year, for security and to investigate misuse. Records of admin actions: 8 years.
Your rights
You can:
- get a summary of your personal data and what we do with it, and download it ("Download my data" in your profile);
- correct, complete or update it in your profile, or ask us to;
- delete your account and your data ("Delete my account"), except what the law makes us keep;
- withdraw consent you gave, as easily as you gave it (what we did before stays lawful);
- name another person to exercise these rights if you die or can't act yourself;
- have your complaint handled by our Grievance Officer.
In the EU, EEA or UK you can also object to uses based on our legitimate interests, ask us to restrict a use, and take your data to another service.
Write to the Grievance Officer for anything you can't do from your profile. We answer within 30 days, and complaints within 15 days. If you're not satisfied, you can complain to the Data Protection Board of India, or, in the EU, EEA or UK, to the data protection authority where you live or work.
Children
Nestinga isn't for children: you must be 18 or older to have an account, and we don't knowingly collect children's data except the names a parent or guardian gives when booking for them. If you book for others, make sure you're allowed to give us their details.
Security
We protect personal data with reasonable security practices: encrypted connections (https), passwords stored only as one-way hashes, admin accounts with two-factor sign-in, access limited to the people who need it, and backups. If a breach affects your data, we'll tell you and the authorities as the law requires.
Cookies
Only the cookies Nestinga needs to work (sign-in and security). See the Cookie notice.
Changes
We'll show the date of the latest version here and tell you about important changes.