Privacy Policy

How we handle your personal data, and your rights under India's Digital Personal Data Protection Act, 2023.

Version 2026-07-30 · effective 30 July 2026

Who we are

•Brick & Bamboo operates the villa at Gulwadi, Karjat, Raigad District, Maharashtra 410201, India and the website brickandbamboo.in. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary responsible for the personal data described here.
•You can reach us about anything in this policy at stay@brickandbamboo.in or +91 98207 73845.

•Contact details you give us when booking or enquiring: your name, email address and phone number.
•Booking details: your dates, the number of adults, children and infants in your group, your cuisine and menu-set choices, dietary requirements, occasion, and any notes or special requests you send us.
•Payment records: the amount, date, status and payment reference for each transaction. Card and bank details are handled entirely by our payment gateway — we never see or store your card number, CVV, UPI PIN or net-banking credentials.
•Account data: if you create an account, your login email and authentication session. We do not store your password in readable form.
•Basic technical data your browser sends when you visit, such as approximate location and device type, used only to keep the site working and secure.

•To take, confirm and manage your booking — this is the core purpose, and without this data we cannot host you.
•To prepare for your stay: your menu choices, headcount and dietary needs go to our kitchen so the right food is shopped for and cooked.
•To take payment and issue receipts, and to process refunds where they are due.
•To contact you about your booking — confirmations, reminders about your advance or menu, and directions before arrival.
•To keep records we are required to keep, and to resolve disputes.

•We process your data on the basis of the consent you give when you make a booking or send us an enquiry, and for the legitimate uses permitted under the DPDP Act where you have voluntarily provided data for a specified purpose.
•We do not use your data for advertising or profiling, and we do not sell it.

•Our payment gateway (Razorpay), to process payments and refunds.
•Our email provider (Resend), to send you booking confirmations and reminders.
•Our hosting and database providers (Vercel and Supabase), who store the site and its data on our behalf.
•Our own staff and kitchen team, limited to what they need to host your stay.
•Authorities, where we are legally required to disclose.
•We do not sell, rent or trade your personal data to anyone, ever.

•Our data is held with cloud providers who may store or process it on servers outside India. Where that happens, it is done in line with the transfer conditions permitted under the DPDP Act.
•Access is restricted to the people who need it, and the database enforces per-user access rules so one guest can never see another guest's booking.

•Booking and payment records are retained for as long as needed to run the business and to meet tax and accounting obligations — generally eight years from the end of the relevant financial year.
•Enquiries and waitlist entries that do not lead to a booking are deleted once they are no longer useful, normally within twelve months.
•If you ask us to delete your account, we remove your personal data except where we are legally required to keep a transaction record.

•Right to access — ask us what personal data we hold about you and what we have done with it.
•Right to correction and completion — have inaccurate or incomplete data fixed. You can edit most of it yourself from your dashboard.
•Right to erasure — ask us to delete your personal data where we are not required to keep it.
•Right to withdraw consent — withdraw your consent at any time. This does not affect anything already done on the basis of your earlier consent, and it may mean we can no longer host a booking.
•Right to nominate — nominate another person to exercise your rights on your behalf in the event of death or incapacity.
•Right to grievance redressal — raise a complaint with us first, using the details below. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
•To exercise any of these, email stay@brickandbamboo.in from the address on your booking. We will respond within a reasonable period and in any case within the timelines set by law.

•We collect the number of children and infants in a group so we can prepare beds, meals and safety arrangements. We do not knowingly collect any other personal data about children.
•Bookings must be made by an adult aged 18 or over, who is responsible for the group.

•We use only the cookies and local storage needed to make the site work — chiefly to keep you logged in and to remember a booking you have started so you do not lose it.
•We do not use advertising cookies or third-party tracking pixels.

•Data is transmitted over encrypted connections and stored with access controls that restrict each guest to their own records.
•No system can be guaranteed completely secure. If a personal data breach occurs that affects you, we will notify you and the Data Protection Board of India as required by the DPDP Act.

•This policy is version 2026-07-30, effective 30 July 2026. If we make a material change we will update this page and the version number, and where appropriate we will tell you directly.

Brick & Bamboo
Gulwadi, Karjat, Raigad District, Maharashtra 410201, India
stay@brickandbamboo.in · +91 98207 73845

See also our Terms & Conditions, including the cancellation and refund policy.