Privacy policy

• Browsing listings is free and needs no account. We do not ask you for anything to browse.
• If you pay to unlock a listing, we hold your name, your email address and a record of the payment. Because you transfer the money yourself rather than entering card details, no card number, CVV or bank login ever reaches us.
• If you are a host, we also hold the contact details you choose to publish behind the paywall, plus your listing content and photos.
• We use no tracking or advertising cookies.
• You can export your data and delete your account yourself from /settings. One condition applies: if you still have listings, you must delete those first. That is deliberate — removing a listing also removes the reviews guests wrote about it, so it has to be a decision you make knowingly rather than a side effect of closing your account.
• Some records survive deletion because Indian tax and company law requires it. Those records are kept with your identity removed.

Bnbdaddy is operated by Neurolink Duo Private Limited. That company decides what is collected and why, so it is the one answerable to you for it.

Neurolink Duo Private Limited

CIN: U62099HR2025PTC138414

GSTIN: 06AALCN0304L1ZK

Registered office: T-10 403, Lavanya Apartments, Sector 81, Narsinghpur, Gurugram, Haryana 122004, India

Email: admin@bnbdaddy.com

Phone: +91 90585 20232

WhatsApp: +91 8791923235

A rename of the site is planned but not decided. If the name changes, the company behind it stays the same and this policy still applies.

Bnbdaddy is a directory of holiday rentals, villas and homestays. You can look at every listing for free: photos, description, location, amenities, price and availability.

You pay a one-off fee to unlock one listing's host contact details. That is the only thing we charge a guest for. Writing a review is free, and is open to anybody who has unlocked that listing.

We are not a booking platform. We make no reservation, hold nothing and guarantee nothing. Once you have the host's details, you deal with the host directly, outside this service. That matters for privacy too: what you and the host then say to each other is between you, and we do not see it.

You do not need an account to browse, and we do not ask you to create one. We do not ask for your name, email or anything else to show you a listing.

The site measures traffic using privacy-friendly analytics provided by Vercel. It sets no cookie and identifies nobody. It tells us that a page was viewed, not who viewed it.

• Your email address. This is how we deliver what you paid for, how we send you a receipt, and how we can reach you about a payment problem. Without it we cannot give you the thing you bought.
• Your name. This identifies your account and, if you write a review, it is where the first name shown on the review comes from.
• Payment metadata: the amount, the currency, the date, and the transaction reference you give us. We need this to prove that a payment happened, to unlock the right listing for you, to handle refunds or disputes, and to keep our accounts straight.
• Any screenshot or receipt you attach when you tell us you have paid. This is held privately, is visible only to the small number of people who check payments, and is never published or shown to hosts. Please crop it before you send it: we only need the amount, the date and the reference, and a banking-app screenshot often also shows your balance and your other recent payments. We do not want those, and anything you do not send us is something we cannot lose.

We do not collect or store card details. There is no card checkout on this site at all, so nothing about your card ever reaches our systems — there is nothing for us to lose and nothing for us to protect.

We do not ask you for anything we do not use. If a field is not on this list, we are not holding it.

A host has everything above, plus the following.

• The property contact details you choose to publish behind the paywall: phone, WhatsApp, email and the full address. This is the thing guests pay to unlock, so it is the core of what we hold for you. You decide what goes in these fields. Please put in only what you are willing to have shown to a paying guest.
• Your listing content and photos. These are shown publicly and for free to anyone browsing.
• If you go through verification: a capture of your own booking dashboard, the video walk-through you record, which platform we confirmed you on, your review count and rating on the day we looked, and the reference number and pass-or-fail result from the identity provider. This material is held internally, is never shown to guests, and is not shown back to you either. The only thing anyone else ever sees is the badge.

We do NOT hold any identity document, passport, driving licence or facial verification scan, at any point and in any form. Those stay with the identity provider, who is set up to hold them. We receive their reference and whether you passed, and nothing else — which means that if our systems were ever breached, there is no identity document of yours in them to lose.

Be clear on the split. Your listing text and photos are public. Your contact details are shown only to someone who has paid to unlock that listing. Your verification record is shown to nobody. Most listings are not checked by us at all, and nothing in this policy should be read as us checking your listing for you.

Availability shown on a listing is imported from your own calendar. It may be out of date. We do not correct it.

A review holds three things: a rating, the text you write, and your first name. Nothing else about you is attached to it in public.

Only a guest who has paid to unlock a listing can review it. Paying buys the opportunity to write a review. It never buys a favourable one.

Reviews publish immediately. There is no approval step. A host cannot edit, hide or remove a review, and we will not remove one because a host asks us to.

You can correct your own review for 24 hours after posting. After that it locks.

A host may send you a link inviting you to review. It costs nothing, it is the same link for everybody, and it gives them no influence over what you write or whether it stays up.

• To perform our contract with you. Your email, your name and the payment record exist so that we can deliver the unlock you paid for. A host's contact details are held so that we can deliver them to a paying guest, which is what the host signed up for.
• Because the law requires it. Accounting and payment records are kept for years under Indian company and tax law. We have no discretion about this and neither do you.
• Because we have a legitimate interest in it. Keeping the site working, spotting errors, and protecting the service and its users against fraud and abuse. We keep this narrow. It is not a licence to do whatever we like with your data.
• With your consent, where consent is what is being relied on. A host publishing contact details behind the paywall is a deliberate act by that host, and a host can change or withdraw those details.

We do not sell your personal data to anybody, and we do not use it for advertising.

You pay by transferring money to us directly, using UPI or a bank transfer, from inside your own banking app. That transfer happens entirely between you and your bank — we are not part of it and see none of your banking credentials. What reaches us is only what you choose to tell us afterwards: the transaction reference, and a screenshot if you attach one.

What we then hold is the payment metadata described above: amount, currency, date, your transaction reference, and any screenshot you sent.

The unlock is a digital good, released once we have confirmed your payment against our bank statement — usually within 24 hours. It is currently Rs 799 per listing including GST, charged in INR. Our long-term intention is to price at USD 10; today everything is charged in INR. Reviews are free and involve no payment at all.

We are a small operation and we do not run our own servers. The following companies process data on our behalf. Each one is used only for the job named, and only for the purposes described in this policy.

• Supabase. Our database, user accounts and file storage. This is where listing content, photos, account records and review text live. Supabase runs on Amazon Web Services infrastructure.
• Resend. Sends our transactional email, such as receipts and the delivery of what you bought. It processes your email address and the contents of those messages.
• Vercel. Hosts the website, and provides the analytics described under Cookies below.
• Anthropic. When a listing is published, we generate a search-engine description and an FAQ for it once, from the facts in that listing. No guest personal data is sent.
• Sentry. Error reports, and only if error reporting is switched on. It is configured not to send personal data. Its purpose is to tell us that something broke, not who it broke for.

We are an Indian company and the service is operated from India. Payments are received into an Indian bank account, and no third-party payment processor is involved in taking your money.

Some of the providers listed above operate outside India, so your data may be stored or handled outside India as part of running the site.

In practice this means your data may sit on servers in another country and be subject to that country's laws as well as India's. It does not mean the data is used for anything beyond what this policy describes. These providers act on our instructions and for the purposes named above.

• Accounting and payment records: kept for as long as Indian law requires. Under the Companies Act that is 8 years, and under GST law it is 6 years. This is not a choice we are making. If you ask us to delete a payment record inside those periods, we will have to say no, and we will tell you why.
• Your account, your name and your email: kept while your account exists. Deleted when you delete the account.
• Listing content and photos: kept while the listing exists.
• Reviews: kept indefinitely, because removing them would misrepresent a listing's history. See the next section for what happens to a review when you delete your account.

• Access and export. You can export your data yourself from your account settings at /settings. You do not need to ask us and you do not need a reason.
• Correction. You can correct your account details in settings. A host can correct listing content and contact details at any time. A review can be corrected by its author for 24 hours, after which it locks.
• Deletion. You can delete your account yourself from /settings. It is self-service. We do not put a retention offer or a support conversation in your way.

If something cannot be done in settings, write to admin@bnbdaddy.com and we will deal with it. Tell us enough to find your records — the email address on the account is usually enough. If we cannot do what you ask, we will say so plainly and tell you which rule stops us.

When you delete your account, your login, your name and your email address are destroyed.

Two things stay behind.

• Payment records. Kept because Indian company and tax law requires it, for the periods set out above. Your identity is detached from them, so what remains is a transaction, not a person.
• Reviews. Kept because a listing's review history would be misleading if past reviews vanished. Your identity is detached from them too.

We are telling you this before you delete rather than after. If retaining a detached review is not acceptable to you, do not write one.

We use no tracking cookies and no advertising cookies. There is no advertising network on this site and no third-party profiling.

The only cookies used are the ones strictly necessary to keep you signed in when you have an account. Without them you would be logged out on every page.

Our analytics, provided by Vercel, sets no cookie and identifies nobody. It counts page views. It does not follow you, build a profile of you, or know who you are.

This is why you are not being shown a cookie consent banner. There is nothing to consent to.

Here is what is actually true, without the usual padding.

• Card details never reach us, because there is no card checkout. A breach of our systems could not expose a card of yours, because we hold none. It could expose a payment screenshot you sent us, which is why those are stored privately and why we ask you to crop them first.
• Host contact details are released only after a payment for that listing. They are not on the public page.
• We do not run our own servers. Accounts, data and hosting sit with established providers, which means their security engineering is doing most of the work here.
• Error reporting, where enabled, is configured not to send personal data to Sentry.

What we will not claim: that we are unbreachable. We are a small company. No system is completely secure, and anyone who tells you otherwise is selling something. If we discover a breach affecting your data, we will tell you and tell you what we know.

Come to us first. Write to admin@bnbdaddy.com and describe the problem. You can also reach us on +91 90585 20232 or on WhatsApp at +91 8791923235. We would rather hear it directly than read it somewhere else.

If we do not resolve it, you can escalate to the relevant data protection authority in India. Using us first does not take that right away.

Nothing in this policy takes away rights that Indian law gives you and does not allow to be signed away.

If we change how we handle your data, we will publish the updated policy on this page. We will not change it quietly and pretend it always said that.

This policy is governed by Indian law. Courts at Gurugram, Haryana have jurisdiction.