This Privacy Policy explains what personal data bookmyplusone collects, why, who sees it, how long we keep it, and the rights you have over it. bookmyplusone is operated by AK Infinite Labs, Navi Mumbai ("we", "us"), which is the Data Fiduciary for your personal data under the Digital Personal Data Protection Act, 2023.
This policy is the notice the Digital Personal Data Protection Act, 2023 asks for, and our privacy policy under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It is part of our Terms of Use. By ticking the box to agree, when you join or when this policy changes in a way that matters, you consent to us processing your personal data as described here.
1. What we collect
When you create an account
- Your first and last name, email address, mobile number and date of birth (to confirm you are 18 or older).
- Your password, which we keep only in a form that cannot be turned back into the password.
- Anything you add to your profile, such as a picture, the languages you speak and your city.
To confirm who you are
- Which ID and its number: an Aadhaar, a PAN card, a passport, a driving licence or a voter ID card. For an Aadhaar we keep only the last four digits. Any other number is kept encrypted, shown masked, and opened by our team only for a recorded reason.
- Photos of the ID (its front, and its back when you send it) and a selfie. An Aadhaar must be masked; one sent unmasked is deleted.
- When you agreed to these being used to confirm who you are.
- A person on our team compares them with your account, including your name and date of birth, and records what they checked. We do not use any Aadhaar for authentication through UIDAI.
If you are a companion
Your profile photos, video bio, description, activities, rate and availability, and the bank details you give us for payouts. The law treats bank details, like passwords, as sensitive personal data, and we protect them as such.
When you book or are booked
The booking itself (who, when, for how long, the activity and the meeting place), the note sent with a request, the messages exchanged about the booking, any reviews, and any problem or safety report.
When you pay
Payments are handled by our payment partner, Razorpay. We receive the amount, the payment status and a payment reference, but never your full card details.
When you use the site
- Pages and time: which pages are opened, when and for how long, where a visit came from (such as a search engine or a link), and your device type, browser and operating system.
- Approximate location: the city you are in, worked out from your IP address on our own servers, using IP to City Lite data from DB-IP (db-ip.com), licensed under CC BY 4.0. We do not keep your IP address for this, and we never use GPS.
- Sign-ins: when you sign in, from which city and on which device, including failed attempts.
- If you are not signed in, this is linked only to a random number stored in your browser, not to you. If you are signed in, it is linked to your account, using a cookie that tells us which sign-in your browser belongs to.
- Our servers also record IP addresses in their security logs, to protect against fraud and abuse, and keep them only as long as security and the law require.
When you write to us
What you tell us, and our replies.
2. Why we use it
- To create and run your account, and to sign you in securely.
- To confirm identities, and to review companion applications, photos, videos and profile changes.
- To show companions to customers, and to arrange, confirm, remind people about and complete bookings.
- To take payments, issue receipts and refunds, and pay companions their earnings.
- To send the emails a booking or account needs, such as sign-in codes, confirmations, reminders and receipts.
- To keep people safe: to look into reports, prevent fraud and misuse, enforce our Terms and Community Guidelines, and help the authorities where the law requires.
- To understand how the site is used, so we can fix problems and improve it.
- To meet our legal obligations, such as keeping tax and accounting records.
We rely on your consent, and on the other lawful grounds the Digital Personal Data Protection Act, 2023 allows, such as the purposes for which you gave us the data and meeting legal obligations. We do not sell your personal data, and we do not use it for advertising.
3. Who sees it
- The other person on a booking sees what they need: a companion's public profile; a customer's first name, the initial of their last name and their picture; the booking's details; and, once a booking is confirmed, the meeting place. Neither side sees the other's phone number or email address through us, and we hide contact details in messages.
- Our team sees what their role needs. Staff can open someone's ID documents, private messages or phone number only for a stated reason, such as a safety report, and every such look is recorded.
- Service providers that process data for us under contract and only on our instructions: cloud hosting and storage, email delivery, text messages, and payments (Razorpay).
- Authorities, such as the police or a court, where the law requires it, or where it is needed to protect someone's safety.
- A buyer or successor, if our business is sold or reorganised, who must keep to this policy.
4. Where it is kept
Our servers are in India. Some of our service providers, such as those that deliver email or store photos and videos, may process data outside India. Where they do, we use providers that keep it secure, and only as the Digital Personal Data Protection Act, 2023 allows.
5. How long we keep it
- Your account and profile: while your account is open.
- ID documents, the ID's number and your selfie: while your account is open, and deleted when you delete it, unless we need them for an investigation that is still open or a legal claim. You can also withdraw your consent to them from Account → Agreements: they are then deleted, and booking waits until you confirm your identity again.
- What you agreed to: a record of each agreement (these policies, the Companion Agreement, the safety pledge and your consent to the ID check), with when and from where, for as long as your account is open.
- Product analytics: for 365 days, after which they are deleted automatically.
- Bookings, payments and refunds: as long as tax and accounting laws require, which is generally eight years.
- When you delete your account, we erase your profile, photos, videos, ID documents, saved searches and analytics, and keep only what the law requires, without your name attached wherever possible.
- Your sign-up record, after your account closes: the name, email address, phone number and date of birth you signed up with, when you joined, and what you had agreed to, kept apart from everything else for 180 days, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ask, and then deleted. Only staff answering a complaint or a lawful request can look at it, and every look is recorded.
6. Your rights
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- ask for a summary of the personal data we hold about you and how we use it;
- have inaccurate or incomplete data corrected, completed or updated;
- have your data erased, which you can do yourself by deleting your account from your account settings;
- withdraw your consent at any time, as easily as you gave it, by deleting your account or writing to our Grievance Officer. Withdrawing doesn't affect what was done before, but without your consent we cannot keep running your account;
- name someone to exercise these rights for you if you die or become unable to; and
- have your grievances addressed by us, and then, if you are not satisfied, complain to the Data Protection Board of India.
To use any of these rights, write to our Grievance Officer (below). We may ask you to confirm who you are first. You can also ask for this policy in any language listed in the Eighth Schedule to the Constitution of India.
7. How we protect it
All traffic to the site is encrypted. Passwords are stored only as hashes. ID documents are kept in private storage that is never public. Staff accounts need two-step sign-in, staff see only what their role allows, and private information can be opened only for a recorded reason. No system is perfectly secure, but if a breach affects your personal data we will tell you and the Data Protection Board as the law requires.
8. Cookies and storage in your browser
We use a small number of first-party cookies and browser storage:
- Sign-in cookies, which keep you signed in and keep your account secure;
- a visit cookie, which tells product analytics which sign-in your browser belongs to, and is removed when you sign out;
- a random visitor number and visit number in your browser's storage, for product analytics.
We do not use advertising cookies or third-party tracking.
9. Children
bookmyplusone is only for adults aged 18 or over. We do not knowingly collect data about anyone younger. If we find that we have, we delete it.
10. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. When a change matters, we ask you to read and agree to the new policy the next time you use the Platform. A smaller change, such as a correction or new contact details, applies once it is published.
11. Grievance Officer and contact
For any question, request or complaint about your personal data, use our complaints page, which gives you a reference to follow it by, or contact our Grievance Officer:
- Ravi Gupta, Grievance Officer
- Email: help@bookmyplusone.com
- Phone: 7037242641
- Address: AK Infinite Labs, Navi Mumbai
We acknowledge every complaint within 24 hours and resolve it within 15 days, or sooner where the law requires.