1. About this notice
The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 give you — the “Data Principal” — rights over your digital personal data, and place duties on the organisations that decide how it is used — “Data Fiduciaries”.
This notice tells you, in plain terms, what personal data Orayo.ai processes, why, and how to exercise your rights. Orayo.ai is operated by Neurosync AI Technologies. It applies to guests, property partners, and visitors to orayoai.com.
2. Who is responsible for your data
- Orayo (Neurosync AI Technologies) is the Data Fiduciary for your account, your searches, bookings, OrayoMAX and venue requests, payment records, and the partner data used to verify and settle with properties.
- The property you book is a separate Data Fiduciary. Once it receives your booking, it is responsible for how it uses and keeps that data, including the ID it collects at check-in and the tax invoice it issues.
- Razorpay processes your payment and is responsible for the card, UPI and bank details you enter on its checkout. Orayo does not receive your full card details.
- Our other service providers — cloud hosting and email delivery — process data only on our instructions.
3. Personal data and purposes
3.1 Guests
- Email address — to create your account and sign you in with a one-time code, and to send booking messages
- Name and phone number — to identify the lead guest and let the property contact you about your stay
- Search and booking details (destination, dates, rooms, number of guests, special requests) — to find availability, make the booking, and pass it to the property
- OrayoMAX and venue requests — to send your requirement to properties that can meet it, without revealing who you are, and to turn the offer you pay for into a booking
- Payment references, amounts and refunds — to confirm bookings, issue receipts and refunds, and keep records the law requires
- Messages to us — to answer you and resolve complaints
3.2 Property partners
- Contact details of owners and staff — to run portal accounts and contact the property
- PAN, GSTIN, bank account and verification documents — to verify the business before it can take bookings, and to settle what we owe it
- Agreement acceptances — to record who accepted which agreement, and when
3.3 Everyone
- IP address, device and usage logs — to keep the platform secure, prevent fraud, and fix problems
We collect only what these purposes need.
4. Consent and legitimate uses
We process your personal data on one of the grounds the DPDP Act allows:
- Consent — given when you create an account, make a booking, or post a request, after seeing this notice. Consent is limited to the purposes listed above.
- Legitimate uses — where the Act allows processing without separate consent, for example data you provide voluntarily for a specific purpose, compliance with a law or court order, or responding to a medical emergency.
Withdrawing consent. You can withdraw consent at any time as easily as you gave it, by writing to us (see section 6). Withdrawal does not affect processing that already happened. Because we cannot take or manage a booking without the data it needs, withdrawing consent means closing your account; bookings already made continue under their terms, and we keep the records the law requires.
5. Your rights
- Access — a summary of the personal data we process about you, the processing we carry out, and the other Data Fiduciaries and processors we have shared it with
- Correction, completion and updating — of data that is inaccurate, incomplete or out of date
- Erasure — of data that is no longer needed for the purpose it was collected for, unless a law requires us to keep it
- Grievance redressal — a response from us to any complaint about how we handle your data
- Nomination — naming someone to exercise your rights if you die or become incapable
6. How to exercise your rights
- Update your name or phone number yourself in your account.
- For anything else, email contact@neurosync-ai.com from the email address on your account, and say which right you are exercising.
- We may ask for information to confirm it is you before acting, so that no one else can see or change your data.
- We will respond within the time the DPDP Act and Rules require.
- There is no charge for exercising your rights.
For data a property holds about your stay, contact the property directly. We will help you reach them if needed.
7. Your duties
The DPDP Act also asks Data Principals to:
- Comply with applicable law when exercising their rights
- Not impersonate anyone when providing personal data
- Not suppress material information when providing personal data for an official document
- Not file false or frivolous grievances or complaints
- Provide only verifiably authentic information when asking for correction or erasure
8. Children
Under the DPDP Act, anyone under 18 is a child. Orayo accounts and bookings are for adults only, and we do not knowingly process a child’s personal data beyond the number of guests a booking needs. We do not track, profile or target advertising at children. If you believe a child has given us personal data, write to us and we will erase it.
9. Safeguards and breaches
We use reasonable security safeguards to prevent personal data breaches, including encryption in transit, role-based access controls, separation of guest and partner accounts, and logging of access to our systems. Card and bank payment details stay with Razorpay.
If a personal data breach occurs, we will inform affected users without delay — explaining what happened, the likely consequences, what we are doing about it, and what you can do — and report it to the Data Protection Board of India, as the Act and Rules require.
10. Retention and erasure
We keep personal data only as long as its purpose needs it, or as long as a law requires. Transaction records — bookings, payments and refunds — are kept for the periods tax and accounting laws set. Logs are kept for the period the Rules require. After that, data is erased or made anonymous. Our Privacy Policy sets out retention for each kind of data.
11. Transfers outside India
Some of our service providers may process data outside India. The DPDP Act permits this except to countries the Government of India restricts by notification. We will not transfer personal data to a restricted country.
12. Grievances and the Data Protection Board
If you are unhappy with how we have handled your personal data, write to our Grievance Officer at contact@neurosync-ai.com. We will acknowledge your complaint, look into it, and respond within the time the law requires.
If you are not satisfied with our response, you may complain to the Data Protection Board of India. The Act asks you to raise the grievance with us first.
13. Changes to this notice
We will update this notice when the platform, the Act or the Rules change. The version and effective date at the top show which version applies. We will tell you about material changes before they take effect.