Privacy notice

What Southlight Hospitality collects, why, how long it is kept, and how to make us change or delete it.

Last updated 18 September 2026

01Who this notice is from

The company: Southlight Hospitality Private Limited, a company incorporated in India on 16 September 2026, CIN U55101TS2026PTC222796. Registered office: Plot Nos 25, 26 and 27, Survey No 93, Indira Nagar, Gachibowli, Seri Lingampally, K.V. Rangareddy, Telangana 500032, India.
Our role: The company decides what personal data is collected and why, which makes it the Data Fiduciary under the Digital Personal Data Protection Act 2023.
How to reach us: contact@southlight.in. Write to this address for anything in this notice, including a complaint. It is also the grievance route described below.

02What we collect

This site has no forms, no accounts and no booking engine. Everything below is collected because you sent it to us, or because a stay or a listing cannot be run without it.

Messages you send: Your name, your phone number or email address, and whatever you write. This is the whole of what most people ever send us.
Stay details: The names of the people staying, the dates, arrival details, and anything you tell us about what you need. Collected only once a stay is being arranged.
Identity documents: A government-issued identity document for the lead guest, before travel. Indian law requires an accommodation provider to record who is staying, and to report the stay of a foreign national to the authorities. It is the most sensitive thing we hold about a guest and it is handled accordingly: seen by the fewest people who need it, and never sent to the homeowner.
Owner and property details: The address of the property, proof that you own it, and the bank details a payout is made to. Collected only from owners who choose to list a house. Bank and payment details are sensitive personal data or information under the Information Technology Rules 2011 and are treated as such.
Website logs: This site's own request log records the method and the path of a request and how long it took, and no address and no identifier. The platform hosting the site keeps its own access log in the ordinary way, which does include the address a request came from. Both exist to keep the site up and to investigate abuse.

03Why we collect it

To reply: To answer you. If you write to us and we do not keep what you wrote, we cannot reply.
To run a stay: To arrange and run a stay: to confirm dates, to tell the caretaker who is arriving, to send directions and access details, and to settle payment.
Because the law requires it: To meet a legal obligation. Guest identity records and reporting of foreign nationals are required of accommodation providers, and tax and accounting records are required of the company.
To take on a home: To assess a property, agree terms with its owner, and pay them.

04What we do not do

We do not sell personal data, and we do not share it for anybody else's advertising.
We do not run advertising or tracking cookies on this site. There is no analytics script on it, and no cookie is set to identify you.
We do not use what you send us to train machine-learning models.
We do not ask for an identity document to browse this site. It is asked for only when a stay is being arranged, and only for the lead guest.

05Who else sees it

The caretaker: The caretaker looking after the home you are staying in is told who is arriving and when. They are not given your identity document.
The homeowner: The owner of the house receives a statement of what their property earned. It does not carry guest identity documents.
Service providers: WhatsApp carries your message to us, and our email and hosting providers carry mail and serve this site. Each sees what it has to carry in order to work.
Where it is held: Some of these providers hold data on servers outside India, which the Digital Personal Data Protection Act 2023 permits except to countries the Central Government restricts. Personal data is not transferred to anybody outside India for any other reason.
Authorities: Police and tax authorities, where a law requires it. Guest registers and foreign-national reporting are the usual case.

06How long we keep it

Personal data is erased once the purpose it was collected for is finished, unless a law requires it to be kept for longer. These are the periods we work to.

An enquiry that goes nowhere: Kept while we are talking, and erased within twelve months of the conversation ending if it does not become a stay or a listing.
Stay and identity records: Kept for as long as the statutory guest-register and tax record-keeping periods require, and erased after that.
Owner records: Kept for as long as the property is with us, and for the period accounting and tax law requires afterwards.
Website logs: Kept in short rotation by our host, in the ordinary way of server logs, and not used to build a profile of you.

07Your rights

Under the Digital Personal Data Protection Act 2023 you can exercise all of these by writing to contact@southlight.in. We will not charge you and we will not ask why.

Access: Ask what personal data of yours we hold, what we have done with it, and who we have shared it with.
Correction: Have anything inaccurate, incomplete or out of date corrected or completed.
Erasure: Have your personal data erased, unless a law requires us to keep it. We will tell you which law, if that is the answer.
Withdrawal: Withdraw your consent at any time. Where the data was only held on your consent, withdrawing it means we stop and erase.
Nomination: Nominate somebody to exercise these rights on your behalf if you die or become unable to.
Grievance: Complain to us first, at contact@southlight.in. We aim to answer within thirty days. If you are not satisfied, you may take the complaint to the Data Protection Board of India.

08Security, children and changes

Security: This site is served over HTTPS only. Identity documents are held only as long as the periods above allow and are seen only by the people who have to see them. No system is perfect, and we will tell you if something happens that affects you.
Children: A stay is arranged with an adult, and the identity document we ask for is the lead guest's. Where a family is travelling we are told the names of everyone staying, which can include people under eighteen; that comes from the adult arranging the stay, who is the one consenting to it. We do not ask a child for anything directly, and we do not track, profile or advertise to children. Under the Digital Personal Data Protection Act 2023 anybody under eighteen is a child, and we will not process a child's personal data for any purpose beyond recording who is staying.
Changes: If this notice changes, the date at the top of this page changes with it. A change that affects what we do with data already collected will be told to you directly.