Privacy
Policy

Singh Empire is a banquet, dining and lodging house in Bidar, Karnataka. This policy applies to this website, singhempire.in, and to the enquiry, feedback, account and online-booking features on it.

Under India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here — we decide what is collected and why. Our registered address is Singh Empire, Behind Guru Nanak Hospital, Singh Enclave, Bidar, Karnataka 585402, India.

This policy covers the website only. Information you give us in person at the property — at check-in, at a banquet booking, or across the table — is handled under our ordinary hospitality practice and any documents you sign at the time.

We collect the details requested by the forms you choose to use. Optional visit and advertising measurement depends on your privacy choices. We do not buy personal information from third parties.

We do not record your screen. Session replay is switched off. Every /book and /account page, including nested booking and payment-result pages, is excluded from automatic page and form capture. Selected booking measurements use the separate, limited event handling described in section 4.

Razorpay's hosted checkout may ask for the payment details needed to complete your chosen method. Those details go to Razorpay and are not stored by this website. Our forms do not ask for card numbers, CVV, bank-account or UPI credentials, government ID, date of birth, or health information. If one of our forms appears to ask for those, do not fill it in — tell us at once.

When you create an account or fill in the enquiry, feedback or booking form, you consent to our using those details for the purpose named beside the form, including providing the account, booking and payment-verification service you requested.

You may withdraw it at any time by writing to us at the address in section 10. Withdrawing is as easy as giving it: one message is enough, you need not give a reason, and we will not make you justify it. Once you withdraw, we stop using your details and delete them unless a law requires us to keep them.

Withdrawing consent does not undo anything we lawfully did with your details beforehand — for instance, an enquiry we have already answered.

While the privacy banner is unanswered and booking measurement is enabled, Google Analytics 4 and Google Ads receive limited visit and booking measurements with analytics and advertising storage denied. These measurements do not use analytics or advertising cookies and do not include our stored campaign or ad-click identifiers. Google still receives ordinary network information with the request. Choose Only necessary to stop future optional measurement. Accepting a category permits its fuller measurement; Google Tag Manager manages configured Google tags. PostHog requires analytics permission, and Meta Pixel and Meta Conversions API require advertising permission. You can change these choices through Privacy settings.

Guest forms and account pages are excluded from automatic analytics capture. When measurement is enabled, the permitted selected events can report room categories, booking totals, the amount paid, the hotel balance and a pseudonymous transaction reference. This includes limited Google measurement before a privacy choice. Names, phone numbers, email, nationality, identity documents and special requests are not included. Your booking draft, sign-in, payment recovery and saved privacy choice use essential storage independently of optional tracking. Before optional permission, purchase deduplication is held only in page memory; after permission, a limited list may be stored for the permitted measurement categories.

Account access uses a private HTTP-only session cookie backed by Supabase Auth. Protected booking requests resolve that session and restrict records to the signed-in customer.

With the relevant optional permission, campaign labels and ad-click identifiers can be retained in this browser tab for up to 30 days to connect a visit with a booking. We remember privacy choices for up to 180 days and keep a limited list of pseudonymous measured transactions for up to 90 days to reduce duplicate reporting. Advertising tools receive the permitted event data and ordinary network information such as your IP address. With advertising permission, our server can send Meta a confirmed payment event together with your browser/click identifiers, IP address and browser information. We do not send guest contact details for advertising matching, and we do not sell personal information. We use a signed checkout consent receipt in your browser for up to 24 hours. Our server sends permitted matching information directly to Meta without a separate tracking database or retry queue. Changing your choice stops future sends from that browser; it cannot recall an event already submitted. Privacy choices are specific to each browser or device.

• Analytics runs only on the live site — it is switched off during development and on preview builds.
• Session recording, on-site surveys and dead-click tracking are all deliberately disabled.
• Our fonts are served from our own servers, so loading a page does not announce your visit to a font provider.
• Use Privacy settings to withdraw optional permission, or clear your browser storage. Optional tools are stopped when you withdraw; essential booking storage remains available. Signing in is required to read or manage your bookings.

Some photographs are delivered by external image services, including Cloudflare R2. Booking pages can load embedded Google Maps, and links can open Google Maps, WhatsApp or Instagram. Loading an external image or map, or following those links, shares network information such as your IP address with that provider. Their own privacy policies govern those services.

Your details are seen by the people at Singh Empire who need them to answer you. We do not sell personal data, and we do not share it for anyone else's marketing.

We rely on a small number of technology providers to run this website. They process data on our instructions and for no purpose of their own:

• Vercel — hosts the website and serves its pages.
• Supabase — verifies customer sign-in and stores enquiries, customer and booking identifiers, contact and stay details, room allocations, price and state history, payment references, guest feedback, and any media attached to feedback.
• WhatsApp / Meta — delivers the verification code to the WhatsApp number you provide and handles messages you send to the hotel through WhatsApp.
• Cloudflare R2 — stores and serves the hotel photographs used by the booking engine.
• Razorpay — hosts payment entry, processes the selected online payment, and returns order, payment and event identifiers and status so we can verify it.
• Resend — delivers the notification email that tells our team a new enquiry has arrived.
• PostHog — website analytics and error reporting.
• Google Analytics — website analytics.

Some of these providers store and process data on servers outside India, including in the United States. Where that is so, we rely on their contractual commitments to keep the data secure and to use it only for the purposes we have set.

We may also disclose information if a law, a court, or a government authority validly requires it, or where it is genuinely necessary to protect the safety of our guests or staff.

• Enquiries — kept while we are dealing with your enquiry and for a reasonable period afterwards, so we can pick up the conversation if you return. Ask us and we will erase yours sooner.
• Unfinished website booking enquiries — retained for up to 90 days after the last enquiry, or erased sooner on request. Confirming a booking removes the enquiry from the active calling list; the reservation remains subject to our booking-record retention rules. If you ask us not to contact you, we keep a protected matching record to prevent further booking-assistance calls after the enquiry details are deleted. The browser-journey cookie expires after 24 hours.
• Customer accounts — kept while the account is active and afterwards only as long as needed for bookings, security, legal obligations, or a request you have made. You may ask us to close the account and erase data we are not required to keep.
• Bookings, room allocations, quote history and payment identifiers — kept as long as needed to provide the stay, maintain accounting and transaction records, handle disputes or payment exceptions, and meet legal obligations, then deleted or put beyond use.
• Booking retry and rate-limit records — kept only as long as needed to prevent duplicate or abusive requests, then expired or removed.
• Feedback and any attached media — kept while it is useful for improving the house, then deleted.
• The notification email — kept in our mailbox as ordinary business correspondence.
• Analytics — kept for the period our analytics providers retain it, in a form that identifies visits rather than people.
• The IP address used for spam-checking — about ten minutes, in memory, then gone.

When a retention period ends, or when you withdraw consent, we delete the data or put it beyond use.

The whole site is served over an encrypted connection. Enquiries and feedback go into a database configured to accept new entries from the website but never to hand them back to a visitor. Booking tables are in a private database schema and cannot be read directly with anonymous or ordinary browser database credentials. Booking APIs require a verified Supabase Auth session and return or change only records owned by that customer. Payment confirmation requires server verification against stored Razorpay order and payment details. Media attached to feedback goes into a private storage area that is not publicly listable.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your personal data, we will notify you and the Data Protection Board of India as the law requires.

As a Data Principal under the Digital Personal Data Protection Act, 2023, you may ask us to:

• Tell you what personal data of yours we hold and what we have done with it.
• Correct anything inaccurate, complete anything incomplete, or update anything that has changed.
• Erase your personal data, where we are not required by law to keep it.
• Register a grievance about how we have handled your data, and have it addressed.
• Nominate another person to exercise these rights on your behalf, should you die or become unable to act.

Write to the Grievance Officer in section 10. We will acknowledge you promptly and aim to resolve the matter within seven working days. There is no charge. We may need to confirm who you are before acting, so that no one else can make requests in your name.

If we do not resolve your grievance to your satisfaction, you may complain to the Data Protection Board of India.

This website and its customer accounts are meant for adults making enquiries about celebrations, dining and stays. A booking may include the number of children travelling, but the form does not ask for their names or other identifying details. We do not knowingly collect personal data directly from anyone under eighteen, and we do not track or profile children or direct advertising at them.

If you are a parent or guardian and believe a child has sent us their details, tell us and we will delete them.

For anything in this policy — a question, a request about your data, or a complaint — write to The Grievance Officer, Singh Empire:

• By email — info@singhempire.in
• By phone or WhatsApp — +91 74118 61212
• By post — Singh Empire, Behind Guru Nanak Hospital, Singh Enclave, Bidar, Karnataka 585402, India

Please mention that your message is about privacy, so it reaches the right hands quickly.

If we change how we handle your information, we will revise this page and move the date at its head. Where a change is significant, we will make it plain rather than leave you to find it. Please look at this page from time to time.