Privacy Policy

This Privacy Policy explains what personal data OurGate collects, why we collect it, how it is stored and secured, who it is shared with, and what rights you have over it. It applies to both Host companies and the Guests they invite to verify a booking.

We process Guest identity data on the basis of explicit consent, given at the point of upload after the Guest has reviewed our Terms & Conditions. We process Host account and billing data on the basis of contractual necessity — to provide the service the Host has signed up for.

• Identity documents are stored in a private object storage bucket, never publicly accessible.
• Documents are viewed only via short-lived, single-use signed links generated on demand.
• Passwords are hashed, never stored in plain text.
• Guest sessions are scoped to a single booking and expire automatically.
• Access to guest identity data within a Host account is controlled by a permission system — not every team member can view it by default.

OurGate is based in India, and this Privacy Policy is written to stand on its own for whichever regional data protection law applies to you: India's Digital Personal Data Protection Act 2023 (DPDPA) for Indian users, the EU/UK General Data Protection Regulation (GDPR) for individuals in the European Economic Area and the United Kingdom, and the California Consumer Privacy Act (CCPA) for California residents. Each is addressed as a full set of obligations in the sections below — not merely as a shared "principle" borrowed into a single India-centric policy. Where these frameworks overlap (purpose limitation, data minimization, access and deletion rights), we apply the more protective standard to everyone, regardless of where you are located.

If you are located in the European Economic Area or the United Kingdom, the GDPR applies to our processing of your personal data.

Lawful basis for processing

We process Guest identity data on the basis of Article 6(1)(b) — performance of a contract (completing the booking verification you or the Host initiated) — and, for limited fraud-prevention and security purposes, our legitimate interests under Article 6(1)(f). We process Host account and billing data on the basis of contractual necessity, to provide the service the Host has signed up for.

Your rights

Subject to applicable exceptions, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data ("right to be forgotten"), subject to any overriding legal retention obligation.
• Restriction of processing in certain circumstances.
• Portability — receiving your data in a structured, commonly used, machine-readable format, or having it transmitted to another controller.
• Objection to processing based on legitimate interests.

You also have the right to lodge a complaint with your local data protection supervisory authority. For EU/UK data protection inquiries, contact urbanescape09@gmail.com. OurGate does not currently maintain a formally appointed EU representative; [EU representative contact — TBD].

If you are a California resident, the CCPA (as amended by the CPRA) gives you the right to:

• Know what personal information we collect, use, and disclose about you.
• Delete personal information we have collected from you, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information.
• Non-discrimination for exercising any of these rights.

We do not sell or share personal information as those terms are defined under the CCPA, and we do not use Guest identity data for cross-context behavioral advertising. Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" opt-out mechanism is required; if that changes, we will add one here and provide a clear opt-out link. To exercise any CCPA right, contact urbanescape09@gmail.com.

If you are located in India, the Digital Personal Data Protection Act 2023 gives you rights as a data principal, including the right to access a summary of your personal data and the processing activities carried out on it, the right to correction and erasure of your personal data, the right to grievance redressal (see Section 11 below), and the right to nominate another individual to exercise these rights on your behalf in the event of death or incapacity. Requests can be made through the verification link itself or by contacting us at the details in Section 11.

We use a minimal set of cookies and local browser storage required to keep you logged in and to remember that you have acknowledged our cookie notice. We do not use third-party advertising or tracking cookies.

Guest identity documents are retained to support the Host's booking records unless a deletion request is submitted. To request deletion, a Guest can use the request option on their verification link, or contact us directly at the details below. We aim to action deletion requests within a reasonable time and will confirm once complete.

OurGate is intended for use by adults booking or managing accommodation. We do not knowingly collect identity documents from individuals under the age of 18. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.

In the event of a personal data breach that is likely to result in a risk to the rights of affected Guests or Hosts, we will take prompt steps to contain and assess the breach and will notify affected individuals and, where legally required, the applicable data protection authority, without undue delay.

OurGate is based in India, and the underlying commercial agreement between OurGate and its Host companies is governed by the laws of India; any dispute arising under it is subject to the exclusive jurisdiction of the courts at Ghaziabad, Uttar Pradesh, India. This governs the contract itself — it does not limit the data protection rights described in Sections 5a (GDPR), 5b (CCPA), or 5c (DPDPA) above, which apply to you based on your own location regardless of this jurisdiction clause.

For any privacy questions, data access requests, correction requests, or erasure requests, contact our Data Protection Contact at urbanescape09@gmail.com or by phone at 9958780399. This is the same contact point for GDPR, CCPA, and DPDPA inquiries alike. For Indian users specifically, this contact also serves as our Grievance Officer as required under India's Digital Personal Data Protection Act and applicable IT Rules. We aim to acknowledge grievances promptly and resolve them within a reasonable time.