Privacy Policy

1. Introduction

HimLocal (incubated at IIT Mandi Catalyst, Kullu, Himachal Pradesh) respects your privacy. This Privacy Policy explains how we collect, use, and protect information when you visit partner.himlocal.com (our B2B marketing and onboarding site) or subscribe to HimLocal Partner OS (our SaaS software for hotels, restaurants, retail shops, and activity operators).

This policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000. For information about how we handle your customers’ data when you use our software, see Section 6 below.

2. What We Collect on This Site

2.1 Information you give us

• Enquiry / onboarding forms: name, business name, phone, email, location, vertical (hotel / restaurant / shop / activity)
• Account registration: email / phone, business details, GST number (optional)
• Support & contact requests: your message and contact details

2.2 Automatically collected information

• Server logs: IP address, browser type, operating system, referring URL, pages visited, time on site
• Google Analytics 4 (GA4): anonymised usage data — page views, session duration, device/browser, geographic region. GA4 is loaded only after you accept analytics cookies via our consent banner. We use property ID G-9PV16B60GD for this site. GA4 cookies: _ga and _ga_* (expire after 2 years). Data is processed by Google LLC and may be stored outside India.
• Cookie consent preference: stored locally to remember your cookie choices.

2.3 Within the Partner OS dashboard

When you log in to the admin dashboard to manage your property, restaurant, or store, we additionally collect:

• Account activity and audit logs (for security and compliance)
• Feature usage patterns (to improve the product)
• Billing and subscription details

3. How We Use Your Information

• Service delivery: providing and maintaining your subscription to the Partner OS
• Onboarding: setting up your account, property, menu, or store
• Billing: processing subscription fees and commission settlements via Razorpay
• Support: responding to enquiries, technical issues, and complaints
• Product improvement: understanding how partners use the platform (via GA4 and usage data) to make it better
• Marketing (with consent): sending product updates, feature announcements, and relevant offers to your registered email; you may unsubscribe at any time
• Legal & compliance: complying with applicable Indian law and regulatory requirements

4. Analytics & Cookies

4.1 Cookie categories

• Essential cookies: required for login, session management, and cookie-consent storage. Cannot be disabled without affecting core functionality.
• Analytics cookies (Google Analytics 4): track anonymised visitor behaviour — page views, session count, device type, referral source. Set only after you accept analytics cookies. You can opt out using the Google Analytics Opt-out Add-on or by declining cookies in our consent banner.
• Marketing cookies (Meta Pixel): loaded only after you accept marketing cookies, and only on pages where we run paid campaigns. Used to measure ad effectiveness.

4.2 Google Analytics data retention

GA4 retains event-level data for 14 months by default. Aggregated reports may be retained longer. See Google’s data retention policy.

5. Sharing Your Information

We do not sell your personal data. We share it only with:

• Razorpay: for payment processing and partner payout settlements
• Google LLC (GA4): anonymised usage analytics after consent
• AWS (SES, S3): email delivery and file storage
• IIT Mandi Catalyst: as our incubator, for reporting purposes only (no personal data shared)
• Legal authorities: where required by Indian law, court order, or regulatory demand

6. Your Customers’ Data (Partner Data Processing)

When you use the Partner OS to take bookings, orders, or payments from your customers, that data belongs to your business. HimLocal acts as a data processoron your behalf. We process your customers’ data only to operate the software you have subscribed to, and we do not use it for our own marketing or share it with third parties except as needed to run the service (e.g., Razorpay for payment processing).

As the data controller, you are responsible for obtaining any consents required under the DPDPA, 2023 and for publishing a compliant privacy policy on your own website.

7. Data Retention

• Account data: retained for the duration of your subscription plus 30 days after termination, then deleted or anonymised unless legally required to retain longer
• Transaction & billing records: retained for 7 years as required by Indian tax law (GST)
• GA4 analytics: 14 months event-level data retention (Google’s default)
• Support communications: retained for 2 years

8. Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA), you have the right to:

• Access: request a copy of personal data we hold about you
• Correction: request correction of inaccurate data
• Erasure: request deletion of your data (subject to legal retention obligations)
• Withdraw consent: for analytics or marketing at any time via the cookie consent banner or by contacting us
• Grievance redressal: raise a complaint with our Grievance Officer (see Section 10)

To exercise any right, email privacy@himlocal.com. We will respond within 30 days.

9. Security

We implement industry-standard security measures: SSL/TLS encryption in transit, encrypted storage at rest, OTP-based authentication, role-based access controls, and regular security reviews. Despite these measures, no system is completely secure — please notify us immediately at security@himlocal.com if you suspect a breach.

10. Contact & Grievance Officer

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or an in-platform banner at least 14 days before taking effect. The “Last updated” date at the top of this page always reflects the current version.