Privacy Policy

1. Who we are

MyPG World (“we”, “us”) is operated by Ekaiva Labs LLP. We run mypgworld.com (the “Website”), related APIs, and the MyPG World management application at app.mypgworld.com (the “App”). We help people find paying-guest (PG) accommodation and help owners list and, where they use the App, manage properties. We operate primarily from India.

This Policy explains what personal data we collect, how we use it, who can see it, and your rights.

Controller contact: support@mypgworld.com. Office: Jaypee Greens Wish Town, Sec 134, Noida, Uttar Pradesh — 201301.

2. Standards we follow (non-binding)

We strive to maintain high standards of data security. Our data protection practices are designed in alignment with the core principles of the Indian Digital Personal Data Protection Act (DPDPA) 2023 and CERT-In security guidelines, alongside global privacy frameworks like GDPR. While we use these frameworks as our guiding standard, this does not constitute a contractual guarantee of absolute legal compliance with every jurisdictional provision.

Where GDPR or other foreign laws apply to you, those rights sit alongside applicable Indian law (including the DPDPA 2023 and the Information Technology Act, 2000, where relevant).

3. Who this Policy covers

This Policy applies to everyone who uses our services, including:

• PG seekers — people browsing, searching, enquiring about, or reviewing listings on the Website.
• PG owners / listers — people who create an account and submit or manage PG listings on the Website (and related lead/analytics tools).
• App users — owners, staff, or tenants who use the management App (additional processing may occur there for tenancy, payments, and operations).
• Visitors who contact us via forms or email without creating an account.

4. Lawful bases

We process personal data only where we have a lawful basis, for example:

• Contract — creating an account, listing a PG, enabling enquiries between seekers and owners, providing App features you subscribe to.
• Legitimate interests — securing the service, preventing spam/fraud, verifying listings, understanding product usage in a privacy-respecting way, and improving search quality.
• Consent — where we ask you to agree (for example accepting Terms/Privacy at signup, cookie choices, or optional browser location).
• Legal obligation — where law requires us to retain or disclose information.

5. Data minimisation & purpose limitation

Under the Digital Personal Data Protection Act, 2023, we follow data minimisation and purpose limitation:

• Data minimisation — we collect only personal data that is necessary for the stated purpose. For example, PG seekers can browse listings without creating an account, and enquiries ask for name and phone — not government identity documents — for marketplace contact.
• Purpose limitation — we use personal data only for the purposes described in this Policy (and compatible uses permitted by law). We do not collect or store bank account details, corporate tax records, or payment-gateway credentials for Website classifieds listings while payments between seekers and owners remain offline.
• Owner identity (name, email, phone) may be verified for Legitimate Use — to reduce fake listings, mitigate platform liability, and keep the directory trustworthy — which is a different and narrower purpose than seeker browsing.
• If we introduce new purposes (for example native digital payments), we will update this Policy and, where required, obtain fresh consent or rely on another lawful basis before expanding collection.

6. Data we collect

Depending on how you use MyPG World, we may collect:

• Account data: name, email, phone (if provided), sign-in session tokens, and records that you accepted the Terms and this Privacy Policy (including version and time).
• Owner listing data: property name, city/area/address, map pin or coordinates, photos, rent, bed count, gender type, amenities, description, Google Maps link (if provided), and the owner contact number used on the listing.
• Listing workflow data: submission status (pending / rejected / live), rejection reasons (if any), verification flags, and which account submitted or owns the listing.
• Enquiry / lead data: seeker name, phone, message, property enquired about, enquiry time, and owner-side lead status (for example New / Contacted / Closed).
• Review data: rating, reviewer name, comment, and related flags (for example whether the reviewer indicates they visited).
• Usage / analytics events: listing views and call/WhatsApp button clicks (stored only when analytics cookie consent is active).
• Technical data: approximate device location if you allow it in the browser; one-way hashed IP addresses for abuse prevention and rate limiting; basic device/browser information sent with normal web requests.
• Cookie / consent audit: your accept, reject (including banner dismiss), or custom cookie choice, category flags, time, and a hashed IP.
• Support data: messages and contact details you send to support@mypgworld.com or through website contact/enquiry forms.
• Owner KYC (when used): Aadhaar verification status and last-4 digits only via DigiLocker / Surepass — never the full Aadhaar number in our systems — after a separate explicit KYC consent checkbox.
• App operational data (App only): additional tenancy, booking, payment, staff, and property-operations records you or your organisation enter in the App — governed by the same privacy principles and any App-specific notices.

7. How we use data (all users)

• Provide sign-in (email OTP or Google sign-in where offered), search, listing, enquiry, review, and account features.
• Show relevant PG results for a city or location you search or share.
• Prevent abuse (OTP limits, enquiry limits) and keep accounts and APIs secure.
• Communicate service messages (for example OTP codes, important account or listing notices).
• Improve the product using first-party analytics only when you consent to analytics cookies.
• Comply with law and respond to lawful requests.

8. Especially for PG owners — how your details are used

If you list a PG on the Website, please read this section carefully. It explains what becomes public, what stays private, and who can contact you.

• Account identity: when you submit a listing, we bind owner name, email, and contact phone to your signed-in account so listings cannot be created under someone else’s identity.
• Public listing profile: after verification, seekers can see property details you provide (name, location description, map position, photos, rent, amenities, gender type, description) and a Verified badge where applicable.
• Phone display: on public cards and detail pages your phone is masked (not shown in full). The full number is revealed only to a seeker who is signed in and submits an enquiry for that property.
• Leads: when a seeker enquires, we store their name, phone, and message and show them in your Lead inbox so you can call or WhatsApp them. You can mark leads as Contacted or Closed.
• Admin review: our authorised staff may view listing submissions (including contact and location details) to verify accuracy, approve, reject, or re-verify after material edits.
• Re-verification: if you change material listing details (for example address, map pin, rent, photos, contact), the listing may leave public search until re-approved.
• Analytics: we show you counts such as views, enquiries, and call/WhatsApp clicks for your listings so you can understand performance. Underlying IP addresses used for anti-abuse are stored as hashes, not shown to you as raw IPs.
• Reviews: seekers may leave public ratings/comments on your listing page. Average scores may appear on cards and in My listings.
• We do not sell your contact details to advertisers. We do not publish your email on public listing cards.

9. Especially for PG seekers — how your details are used

• Browsing and search can work without an account; creating an account (email OTP) is required to enquire and unlock an owner’s full phone number.
• When you enquire, your name, phone, and message are shared with the owner of that listing via their Lead inbox so they can respond.
• Your enquiry is limited (for example roughly one unlock per account per property per day) to reduce spam.
• If you leave a review, the name and comment you submit may be shown publicly on the listing.
• Optional browser location is used to improve nearby search results and may be stored locally on your device (preferences cookie category).

10. What is public vs private

• Public (after verification): listing content you choose to publish, masked owner phone, ratings/reviews, Verified / App-managed badges where applicable.
• Shared with the other party to a lead: full owner phone (to the enquiring seeker); seeker name/phone/message (to the owner).
• Private to you and MyPG World operators: account email, consent records, lead status you set, rejection reasons, export/erase actions, and internal security logs.
• Not sold: we do not sell personal data to third parties for marketing lists.

11. Sharing and subprocessors

We share data only as needed to run the service:

• With the other party to an enquiry (seeker ↔ owner), as described above.
• With processors such as cloud hosting/databases, email delivery, secure object storage for listing photos, content delivery networks (CDNs) that distribute public media, and map or geocoding providers — under appropriate arrangements.
• With authorised MyPG World staff for verification, support, and abuse handling.
• With KYC processors (for example Surepass / DigiLocker) when an owner chooses Aadhaar verification — under that processor’s terms and our instructions.
• If required by law, regulation, or valid legal process.
• If we reorganise our business, data may transfer to a successor under equivalent protections.

12. International transfers

Although we operate for users in India, some infrastructure or subprocessors may process data in other countries. Where GDPR-style safeguards would be expected, we rely on appropriate contractual and security measures with our providers.

13. Data deletion & retention

We keep personal data only as long as needed for the purposes in this Policy, then delete or anonymise it. Key periods in our systems today:

• Account erasure (right to be forgotten): when you erase your account from Account → Privacy & data (confirm by typing DELETE), we anonymise your identity in our live systems right away. The account is deactivated (soft tombstone), public listings are taken down, shortlists and listing/profile media we store are deleted, related enquiries and support content are anonymised, and you cannot sign in again. An anonymised erasure-proof record may remain for accountability.
• Media soft-delete grace (~30 days): listing and profile images we remove from secure object storage may briefly remain in a soft-deleted state, then are permanently purged under our storage lifecycle rules (target: within about 30 days).
• Secure system audit logs (~180 days): auth, activity, HTTP mutation, and routine consent audit logs are retained about 180 days (CERT-In-aligned), then purged from hot storage. Where cold archive export is enabled, hot rows are purged only after a successful export. Erasure-proof consent rows may be kept longer (target: about 3 years).
• Account and listing data (while active): kept while your account is active and as needed to provide the service and handle disputes or legal requirements.
• Lead/enquiry records: kept so owners can manage conversations and for abuse prevention. If you erase your account as a seeker, your enquiry content is anonymised. If you erase your account as an owner, leads on your listings are also anonymised so seeker contact details are not left linked to your former listings.
• Login OTPs: cleared after successful sign-in; unused OTPs are removed by our retention job (target: within 24 hours).
• Hashed IP addresses on analytics events: removed by our retention job (target: about 90 days).
• Hashed IP addresses on inquiries/reviews: removed by our retention job (target: about 180 days).
• Hashed IP addresses on cookie-consent audit rows: removed by our retention job (target: about 365 days).
• Archived listing snapshots (for example after abuse takedown): purged after about 30 days.
• Backups, email systems, and infrastructure access logs may retain residual copies until those systems’ own retention periods expire. Restores of backups are scrubbed so erased accounts are not treated as active identities. Our Aadhaar verification processor is instructed to delete session data where their API and contract allow; any residual processor retention is governed by that processor’s data processing terms.

14. Security & infrastructure

We use industry-standard measures including HTTPS, access controls, hashed IP storage for abuse prevention, rate limiting on sensitive actions (OTP, enquiries), and website authentication tokens scoped so they cannot call internal management APIs.

Public listing media is stored in secured object storage. Uploads may use short-lived signed (SAS) URLs. Public media URLs may be rewritten and distributed via content delivery networks (CDNs) for performance. No method of transmission or storage is perfectly secure. Keep OTP codes private; MyPG World staff will not ask you for your OTP.

15. Your rights

Subject to applicable law (including DPDPA 2023 and GDPR where it applies), you may:

• Access and portability: download a machine-readable JSON copy of your personal data from Account → Privacy & data (or email support@mypgworld.com). The export includes your account and profile details, consent and cookie records, Aadhaar verification metadata we store (status and last-4 only — never the full Aadhaar number), shortlists, listing requests and fuller listing details you submitted (including address lines, amenities, and image URLs), inquiries you sent, reviews, identity-change history, abuse reports you filed, support tickets and complaints you raised, and booking/check-in records linked to your account if any. Large collections are returned with pagination metadata so nothing is silently truncated. The export excludes other people’s personal data — in particular, seeker name, phone, and message content on leads you received as an owner (only aggregate lead counts by listing are included; full lead content stays in your Leads inbox while retained). Raw IP addresses, passwords, and OTP secrets are also excluded.
• Rectification: update your name in My account (and listing details in My listings). To change email or phone, request a change in My account — we send a verification code to your account email (and via SMS for phone changes when SMS is enabled), then our team reviews before applying.
• Erasure (right to be forgotten): erase your account from Account → Privacy & data (confirm by typing DELETE). See “Data deletion & retention” above for what happens immediately and what ages out later (media soft-delete, audit logs, backups).
• Listing removal: owners may remove a live PG listing or delete a pending/rejected listing request from Account → Manage listings. You must acknowledge the consequences before confirming. Removing a live listing takes it off public search immediately; we may retain lead/enquiry records and anonymised analytics for abuse prevention, audit, and legal compliance. Deleting a listing request permanently removes that submission. This is separate from full account erasure and does not by itself delete app-managed tenant or payment records — email support@mypgworld.com for app data questions.
• Restriction / objection: contact us about specific processing; we will assess your request under applicable law.
• Withdraw consent: where processing is based on consent (for example optional location or analytics), use Cookie settings in the website footer, Clear location & withdraw consent below, or Account → Privacy & data. You may also revoke site location in your browser settings or email support@mypgworld.com. Withdrawal does not affect prior lawful processing.
• Complaint: contact us first at support@mypgworld.com. Where GDPR applies to you, you may also lodge a complaint with your local supervisory authority. Under Indian law, you may also use any grievance mechanism required when notified.

16. Cookies and local storage

We show a cookie consent banner before optional (non-essential) trackers or preference features run. Closing the banner (X) is treated as Reject non-essential and is recorded as such. Optional categories are not pre-ticked. Reject non-essential is shown with the same prominence as Accept all.

Essential / security storage (always on for the service to work): remembering your cookie choice in localStorage (key mypg_cookie_consent_v1); website authentication tokens and related session data in sessionStorage (and HttpOnly auth cookies where used) for sign-in, CSRF/session security, and keeping you logged in on that browser tab; an HttpOnly analytics-consent flag cookie used only to enforce whether listing analytics events may be stored server-side.

Essential / security or purpose-specific third-party scripts (not analytics advertising cookies): Cloudflare Turnstile for bot protection on forms; Google Identity Services when you choose Sign in with Google; DigiLocker / Surepass widgets when an owner verifies Aadhaar for listing (separate explicit KYC consent checkbox). These load only on the relevant auth or KYC flows.

Optional analytics (off until you opt in): first-party listing view and contact-button events. Analytics events are gated in the browser and enforced on the server. We do not load third-party advertising cookies on the public Website. Any future analytics tags (for example GA4) will load only after analytics consent, via our consent-gated tracker loader.

Optional preferences (off until you opt in): approximate device location for nearby search, subject to your browser permission.

Each accept, reject (including banner dismiss), or custom cookie choice is logged on our servers for compliance audit (choice, category flags, time, and a hashed IP). If you are signed in, the log may be linked to your account.

Cookie and preference choices are stored per browser / device. Withdrawing cookies on Account → Privacy & data or Cookie settings updates this device immediately; other browsers or devices keep their previous local choice until you change it there or clear site data. You can change or withdraw choices anytime via Cookie settings in the website footer, Account → Privacy & data, Clear location & withdraw consent below, or by clearing site data in your browser.

17. Children

MyPG World is not directed at children under 16. If you believe we have collected data from a child, contact support@mypgworld.com and we will take appropriate steps.

18. Governing law

This Policy is governed by the laws of India. Courts in Noida, India have exclusive jurisdiction over disputes arising from this Policy, without limiting any mandatory rights you may have under applicable data-protection law (including the DPDPA 2023 and GDPR where it applies to you).

19. Changes

We may update this Policy from time to time. The “Last updated” date and policy version recorded at signup (currently 2026-07-25) will change when we do. Material changes may be highlighted on the site or by email where appropriate. Continued use after an update means you acknowledge the revised Policy.

20. Contact

Ekaiva Labs LLP (MyPG World). Email: support@mypgworld.com. Office: Jaypee Greens Wish Town, Sec 134, Noida, Uttar Pradesh — 201301.

21. Grievance Redressal & Data Protection Officer

In accordance with the Digital Personal Data Protection Act, 2023 (India) and the GDPR, we acknowledge all data-related grievances within 24 hours and aim to resolve them within 30 days.

Email: grievance@mypgworld.com

Address: Jaypee Greens Wish Town, Sec 134, Noida, Uttar Pradesh — 201301