Privacy policy

Xentori is a boutique stay brand operated by M/S Luxe Suites, a partnership firm registered under the laws of India (GST: 30AALFL1862C1ZR; Udyam Registration: UDYAM-GA-02-0019011), with properties in Palolem, South Goa.

This Privacy Policy explains how M/S Luxe Suites ("we", "our", "us") collects, uses, and protects the personal data you provide when you use xentori.com and make a booking through it. It is drafted in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

By completing a booking on our platform, you acknowledge that you have read and understood this policy.

We collect only what is necessary to complete and manage your stay.

Information you provide directly:

• Full name
• Email address
• Phone number
• Booking details — check-in and check-out dates, number of guests, property booked

Payment data:

Payments are processed entirely by Razorpay Internet Private Limited. We do not collect, store, or have access to your card number, UPI credentials, or any other payment credentials. Razorpay's handling of your payment data is governed by their privacy policy.

Automatically collected information:

• IP address and browser type (standard web server logs)
• Pages visited and time spent on site

We do not use third-party tracking pixels, behavioural advertising networks, or social media trackers.

We process your personal data for the following purposes:

• To confirm, manage, and fulfil your booking
• To send you booking confirmation and pre-arrival information
• To contact you regarding your stay if anything requires attention
• To maintain financial and booking records as required by Indian tax and consumer protection law
• To improve our service based on aggregated, non-identifiable usage patterns

We do not use your personal data for profiling, automated decision-making, or targeted advertising.

Under the DPDP Act, 2023, we process your personal data on the basis of your consent, which you provide by submitting your booking, and to fulfil our contractual obligations in relation to your stay.

Certain data (such as financial records related to your booking) is retained to comply with legal obligations under the Income Tax Act, the Goods and Services Tax Act, and the Consumer Protection Act, 2019.

We share your personal data only with:

• Razorpay Internet Private Limited — to process your payment securely
• Supabase Inc. — our cloud database infrastructure provider, which stores booking and guest records on servers that meet industry security standards
• Our on-ground operations team — to prepare your accommodation before your arrival

We do not sell, rent, or trade your personal data to any third party for commercial purposes.

We may disclose personal data if required by a court order, government directive, or applicable law.

• Booking and financial records: 7 years from the date of the transaction, as required by Indian tax law
• Guest contact information: 3 years from your last interaction with us, unless you request erasure earlier
• Web server logs: 90 days

After the applicable retention period, personal data is securely deleted.

As a data principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: You can request a summary of the personal data we hold about you
• Right to correction and erasure: You can ask us to correct inaccurate data or erase data we are not legally required to retain
• Right to grievance redressal: You can raise a complaint with our Grievance Officer and receive a response within 48 hours
• Right to withdraw consent: You may withdraw your consent to processing; this will not affect any processing already done, and will not apply to data we are legally obliged to retain

To exercise any of these rights, contact us at anurag@xentori.com.

We use only functional, session-based cookies necessary for the website to operate — for example, to maintain your session state during booking. We do not use advertising cookies, cross-site tracking cookies, or persistent analytics cookies.

The Razorpay checkout widget may set its own cookies as part of the payment process. These are governed by Razorpay's cookie policy.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Access to booking records is restricted to authorised personnel only. Payments are handled exclusively by Razorpay, which is a PCI-DSS-compliant payment processor.

No method of transmission over the internet is completely secure. If you believe your data has been compromised, contact us immediately.

Our services are intended for guests who are 18 years of age or older. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe a minor has provided us with personal information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. Continued use of our website after changes are published constitutes your acceptance of the revised policy. For material changes, we will make reasonable efforts to notify you directly.

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, our Grievance Officer is available for any data-related concerns.