1. Who we are
Orayo.ai (“Orayo”, “we”, “our”, “us”) is a members-only platform for booking stays — hotels, homestays, guest houses and hostels — and banquet venues in India. It is operated by Neurosync AI Technologies, which is the data fiduciary for the personal data described in this policy.
This policy covers:
- Guests — anyone who creates an account, searches, books, or posts an OrayoMAX or venue request on orayoai.com;
- Property partners — owners and staff of properties and venues who use the partner portal; and
- Visitors — anyone browsing our website.
Orayo is a marketplace. The accommodation or venue you book is supplied by the property, not by Orayo. Once a property receives your booking, it handles your data under its own responsibility — see section 5.
2. Information we collect
2.1 Your account
- Your email address, which is how you sign in — we send a one-time code to it; there is no password on a guest account
- Your name and phone number, if you add them
2.2 Your bookings and requests
- Searches you run: destination, dates, number of rooms and guests
- Bookings: the property, room and rate plan, dates, the name, phone number and email of the lead guest, the number of guests, and any special requests you write
- OrayoMAX and venue requests: destination, dates, rooms or headcount, and anything you add about what you need
- Cancellations and refunds on your bookings
- Messages you send us and our replies
2.3 Payments
Payments are processed by our payment gateway, Razorpay. Your card, UPI or bank details are entered on Razorpay’s checkout and go to Razorpay directly — Orayo never receives or stores your full card number or card security code. We receive and keep the payment reference, amount, status, method type, and the details of any refund.
2.4 Property partners
- Contact details of the people who register and manage a property, and of staff given access to the portal
- Business and verification details: legal name, PAN, GSTIN, bank account and IFSC, and the documents uploaded during verification
- Listing content: property details, photos, rooms, rates, policies and availability
- Agreements accepted in the portal, and when and by whom they were accepted
2.5 Technical information
- IP address, browser and device type, and the pages and features used, recorded in our server logs
- Your browser’s time zone, used to show dates correctly
- Information kept in your browser to keep you signed in — see section 9
3. How we use it
- To create and secure your account and sign you in
- To show you properties, availability and prices, and to take and confirm your booking
- To pass your booking to the property that will host you
- To take payment, issue payment receipts, and process cancellations and refunds
- To run OrayoMAX: send your request to properties that can host you, show you their offers, and turn the one you pay for into a booking
- To send you messages about your account and bookings — sign-in codes, confirmations, cancellations and refunds
- To verify property partners before they can take bookings, and to settle what we owe them
- To answer your questions and complaints
- To keep the platform secure, prevent fraud and misuse, and fix problems
- To meet our legal obligations, including tax and accounting records and lawful requests from authorities
5. Properties as independent data fiduciaries
Properties are independent businesses. Once your booking reaches a property, the property decides how it uses and keeps that information — for example, the identity documents it asks for at check-in, its registers, and the tax invoice it issues you. That use is governed by the property’s own practices and its own legal obligations, not by this policy. Questions about data a property holds should go to the property; we will help you reach them if needed.
6. How we protect it
- Data is encrypted in transit between your browser and our servers
- Card and bank payment details are handled by Razorpay, not by us
- Access to personal data inside Orayo is limited to people who need it for their role
- Partner accounts are separate from guest accounts, even on the same email address, and partner staff access is scoped by role
- Payment records are checked against the payment gateway before they are written, to prevent tampering
No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.
7. How long we keep it
- Your account — while it is open. When you ask us to delete it, we erase it unless a law requires us to keep part of it.
- Bookings, payments and refunds — for as long as tax, accounting and other laws require us to keep transaction records, even after you close your account.
- OrayoMAX requests — including offers that were not chosen, for as long as needed to run the service, resolve disputes, and meet our legal obligations.
- Partner verification records and accepted agreements — for the life of the partnership and afterwards for as long as the law requires.
- Server and security logs — for the period the law requires, and no longer than needed for security.
When data is no longer needed, we delete it or make it anonymous.
8. Your choices and rights
You can:
- See and update your name and phone number in your account
- Ask for a summary of the personal data we hold about you and how we use it
- Ask us to correct, complete or update it
- Ask us to erase it, and close your account
- Withdraw consent you have given us
- Nominate someone to exercise your rights if you die or become unable to
- Raise a grievance with us, and then with the Data Protection Board of India
Withdrawing consent or erasing your account does not undo bookings already made, and we may keep the records the law requires (section 7). How to exercise each right is set out in our DPDP notice.
9. Cookies and browser storage
We use your browser’s local storage to keep you signed in and to remember basic preferences. Signing out clears your session. We do not use advertising cookies or third-party tracking pixels.
Pages that show a map or use our web fonts load them from Google, and the booking page loads Razorpay’s checkout. Those providers receive your IP address and browser information when they load, under their own privacy policies.
10. Children
You must be 18 or older to create an Orayo account or make a booking. We do not knowingly collect personal data from children. If a booking includes children, we record only the number of guests the property needs to know. If you believe a child has given us personal data, write to us and we will delete it.
11. Where your data is processed
Orayo serves guests and properties in India. Some of our service providers may process data outside India. Where that happens, we transfer it only as the Digital Personal Data Protection Act, 2023 permits, and never to a country the Government of India has restricted.
12. Changes to this policy
We will update this policy when the platform or the law changes. The version and effective date at the top always show which version applies. If a change materially affects how we use your data, we will tell you by email or on the site before it takes effect.
13. Contact and grievances
For any privacy question, request or complaint, write to our Grievance Officer. Please write from the email address on your account, so we can verify it is you.
- Grievance Officer: contact@neurosync-ai.com
- Company: Neurosync AI Technologies