1. Who we are and what this covers
MyThikanas ("MyThikanas", "we", "us") provides software for paying-guest, hostel and co-living operators ("Operators") and a marketplace for people looking for accommodation. This policy applies to mythikanas.com, the organization websites we host on mythikanas.com subdomains, the marketplace, the management dashboard and the MyThikanas mobile apps (the "Service").
We process personal data in line with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them.
2. Operators' data and our role
When an Operator uses MyThikanas to manage its residents, staff and properties, the Operator decides what personal data to collect and why. For that data the Operator is the data fiduciary (controller) and MyThikanas processes it on the Operator's behalf and on its instructions. If you are a resident and have questions about your data held by your PG or hostel, please contact them first; we will help them respond.
For our own account holders, website visitors and marketplace users, MyThikanas is the data fiduciary.
3. Information we collect
Information you give us
- Account and organization details: name, email address, phone number, organization name, subdomain, logo and the details of users you add to your team.
- Property information: properties, rooms, beds, rent, amenities and photos.
- Resident information entered by Operators or by residents during onboarding: name, contact details, address, work or college, emergency contacts, identity documents and photos, tenancy, deposit, invoice and payment records, and complaints.
- Inquiries: the name, phone number, email, preferences, preferred visit date and message you submit when you request a visit or contact us.
- Billing: the plan you buy, coupon used and payment status. Card, UPI and bank details are entered on our payment partner's secure page and are not stored by us.
Information collected automatically
- Usage and device data: pages viewed, actions such as sign-in or sign-up, browser and device type, approximate location derived from IP address, and the date and time of requests.
- Security and diagnostic logs: IP address, sign-in attempts, and error and crash reports that help us keep the Service working and secure.
4. How we use information
- to create and secure accounts, including sending one-time verification codes by email;
- to provide the Service, such as showing listings and live availability, generating invoices, sharing onboarding and payment links and routing visit requests to the right Operator;
- to process subscription payments and prevent fraud;
- to send service messages about your account, billing, security and changes to the Service;
- to understand how the Service is used, fix errors and improve features; and
- to comply with law and respond to lawful requests from authorities.
We do not sell personal data and we do not use residents' identity documents for any purpose other than providing the Service to the Operator.
7. How long we keep data
We keep personal data for as long as the account is active and as needed to provide the Service. When an Operator closes its account, we delete or anonymise its data within a reasonable period, unless we must keep certain records (for example invoices and payment records) to meet legal, tax or accounting obligations. Security logs are kept for a limited period.
8. How we protect data
- All traffic to the Service is encrypted with HTTPS.
- Passwords are stored only as salted, one-way hashes (PBKDF2).
- Each organization's records are kept separate, and users only see the modules their role permits.
- Accounts are temporarily locked after repeated failed sign-ins, and sessions can be revoked when a password changes.
No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as required by law.
9. Your rights and choices
Subject to applicable law, you can:
- access a summary of the personal data we process about you;
- correct, complete or update inaccurate data;
- ask us to erase data that is no longer needed;
- withdraw consent you have given, without affecting processing already done;
- nominate another person to exercise your rights in the event of death or incapacity; and
- raise a grievance with us and, if unresolved, with the Data Protection Board of India.
To exercise these rights, write to support@mythikanas.com. If your data was entered by a PG or hostel, we may refer your request to that Operator.
10. Children
Accounts are for people aged 18 and over. Where an Operator houses residents under 18, the Operator is responsible for obtaining verifiable consent from a parent or lawful guardian before entering their data.
11. Where data is stored
Data is stored on secure servers operated by our hosting providers. Some service providers, such as analytics and email delivery, may process data outside India; where they do, we rely on safeguards permitted under Indian law.
12. Changes to this policy
We may update this policy from time to time. We will post the new version here with an updated date and, for significant changes, let account holders know by email or in the dashboard.
13. Contact and grievance officer
For any question, request or complaint about your personal data, contact our Grievance Officer at support@mythikanas.com. We aim to acknowledge requests within 48 hours and resolve them within the time allowed by law.