Privacy policy
Updated
Who is responsible for your information
Zelax Global Solutions Pvt Ltd operates zelax.club for Aashiyana in Lonavala and decides how the personal information described here is used. Its CIN is U62099PN2024PTC231349 and registered office is A-801, 32 Pinewood Drive, Opposite TCS, Bohirwadi, Hinjewadi Phase 3, Pune, Maharashtra 411057, India. You can browse without an account or send a stay enquiry and use a private guest workspace. We use your information to respond, arrange your stay and support your visit. When online booking is available, Razorpay processes the payment as described below.
Private quotations and viewing activity
When you open a private quotation link, Zelax records anonymous browsing sessions, first and last viewing times, visible active reading time, sections explored, scroll progress, PDF opens and download requests, and contact or directions clicks. We also keep broad device and browser categories, browser language and time zone, and the referring website’s hostname when available. An approximate country, region and city may be derived from the connection address using a local location database; raw IP addresses are not saved in quotation activity, and the lookup is not sent to an external location service. These estimates do not identify who opened a link, prove that they read it, or establish their precise location. Viewing summaries are available to the authorised host team for quotation follow-up. This activity is separate from the optional website analytics in Cookie settings and does not use advertising pixels or cross-site tracking cookies. Your tab’s sessionStorage keeps a quotation-specific random visit reference and cumulative activity counters so reloads are not counted twice; it does not keep the private access key. Activity records are kept with the saved quotation; no automatic deletion period is currently configured. Contact harsh@zelax.club about access or deletion. A quotation link grants access to its customer-facing content, including any name or stay note shown in the PDF, to anyone who receives it, so share it only with your intended group.
Online bookings and payments
For direct online bookings, Zelax uses your name, email, phone, stay dates and guest count to check availability and manage your reservation in private Firebase Firestore records. Razorpay receives the payment amount, order reference and contact details needed for checkout. Card details, bank credentials and payment OTPs are entered in Razorpay; our app does not store them. We keep booking and payment references, amounts, status and your accepted terms for confirmation, reconciliation and support. A private booking link and recovery references may be kept in this tab’s session storage; keep that link private. Optional advertising and analytics do not receive guest details or payment references. A booking is confirmed only after our server verifies payment and reserves the dates.
Optional booking advertising measurement
A separate, optional checkout choice allows Zelax to send a confirmed, paid booking total and currency to Meta, together with a random conversion reference, a Meta ad-click reference and browser information. Names, email, phone, travel dates, meal or allergy details, payment references and private links are excluded. No advertising pixel runs on a private quotation or booking page. Without this choice, the booking still works. Public Cookie settings can separately allow this tab to remember its Meta ad-click reference for up to seven days; older saved consent does not enable this storage. A booking is sent only after our server verifies live payment and confirmation; test payments, cash bookings and unconfirmed payments are excluded, and pending events are suppressed if cancelled or refunded before delivery. Queued delivery is stopped when consent is withdrawn in the booking-status page. Already delivered events cannot be recalled there; contact harsh@zelax.club for privacy requests. Consent and delivery evidence are retained with private booking records; no automatic deletion period is configured. Meta's policies also apply.
Privacy requests and complaints
Email harsh@zelax.club for privacy questions, access, correction or deletion requests, or a complaint about our handling of your information. Include enough detail to identify the request; do not email passwords, verification codes or identity documents unless a secure verification method has been agreed. We may need to verify your authority before sharing or changing records. This is the company’s privacy and grievance contact channel. You can withdraw optional analytics in Cookie settings without emailing us.
Indian data-protection framework
Our handling of personal information is subject to applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as their provisions come into force. The Rules have phased commencement; publication of this notice does not mean every provision is already in force. The company is responsible for the processing it determines as the data fiduciary. Use the contact above for information requests and concerns; we will explain any applicable limits on deletion or disclosure.
Stay requests, profiles and private feedback
Submitting Plan a stay sends your name, email, phone number, dates, guest count, occasion, food-package choices and notes to our server and saves them in Firebase. The workspace also stores the preferences, itinerary, service requests, arrival confirmation and private feedback you submit, together with host replies, reservation status, quotes and stay instructions. The separate reservation workspace may hold a booking-linked guest checklist, house-rule acceptance, host approval of optional entry instructions and arrival/departure timestamps. A signed-in profile can save your name and preferences for later visits. These records remain available after a page reload. We use them to respond, prepare the stay, manage services and follow up. Your preferences, messages and feedback are shared within the private stay workspace and with the authorised host team; they are not published as public reviews. Only include information you are comfortable sharing for these purposes.
Caretaker check-in and guest ID photos
The caretaker uses a password-protected dashboard to record the primary guest’s name, phone and optional booking ID, guest ID photos, infant count, payment and refundable-deposit amounts. ID is required for guests aged 2 or above; infants under 2 are exempt. Adults, or a child’s parent or guardian, should give permission before capture. At check-out, staff record feedback, optional damage photos/videos and the deposit refunded. These fields record payments; they do not transfer money. Records stay in Firestore and files in private Google Cloud Storage. Firebase Functions send ID images to Google Cloud Vision for text extraction. Recognisable details are suggested for review and can be corrected; this does not verify identity. Raw OCR text is not retained separately. The secure staff session lasts up to 30 days or until locked. Staff can preview their own draft IDs; after check-in, only authorised hosts can retrieve IDs. Staff can retrieve damage evidence for active stays; hosts can access it after departure. There are no public file links. File access expires 30 days after upload; automated deletion may finish later. Extracted details and registration/payment records have separate retention. Personal data and files are not placed in browser storage, public offline caches or analytics. A secure essential cookie keeps staff signed in. Registration does not confirm a booking or unlock the villa. For access, correction or deletion requests, email harsh@zelax.club.
Phone sign-in and verification
Phone sign-in currently supports Indian (+91) numbers. Choosing phone sign-in uses Firebase Authentication and Google reCAPTCHA to send a verification SMS. Google stores your number for sign-in and abuse prevention across its services. SMS or data charges may apply. Keep verification codes private. Private stay links remain available for existing reservations. Caretaker check-in is separate and uses a staff password instead of guest OTP.
Private stay access and existing arrival links
A private stay link gives access to the associated stay, including its details and the guest actions available in that workspace. Anyone holding it can use that access, so share it only with people you authorise. We remember the link access in this tab’s sessionStorage. Verified account contact details can connect matching stay requests to your account. The new workspace retrieves private records from the server and does not add them to the public offline cache. Existing /stay/ arrival links use a separate guest app that may keep previously opened booking details offline. On a shared device, sign out and clear site data after use. Clearing browser data does not delete server records; email harsh@zelax.club for help with your records or a disclosed link.
Gathering enquiries by WhatsApp or email
The separate Gatherings form prepares your name, date, expected attendance, occasion, timings, space preference, overnight-stay interest and optional notes on your device. That form does not save or transmit its contents to our server. Choosing WhatsApp or email opens a prepared message; you review and send it using that service. After you send it, we use the information to reply, discuss suitability and pricing, and manage the requested arrangements. This handoff differs from Plan a stay, which saves a request in Firebase. Do not include payment details or identity documents in either form.
Optional website measurement
Google Analytics runs only after you allow it in Cookie settings. It measures public pages, villa cards and photos viewed, time spent actively browsing, contact and social-link clicks, and stay-request steps. A saved-request event is sent only after the website accepts an enquiry; it is not a confirmed reservation or payment. Known referral sources, such as Google or Instagram, are reduced to fixed categories. Only approved source and medium values are used from campaign links; raw referral URLs and other query values are excluded. Our custom events never include form contents, names, contact details, dates, guest IDs or private stay links. Private guest and host workspaces are not measured. Google also receives technical browser and connection information. Advertising requires a separate choice when configured; personalised advertising stays off. Withdraw permission anytime in Cookie settings. Google's own policies and account retention settings also apply.
App installation and optional notifications
Installing the website adds a shortcut and offline essentials on your device. It does not enable notifications or analytics. Choosing Enable notifications asks your browser for permission. Firebase Cloud Messaging then uses a browser registration token, installation identifier and your chosen language to deliver occasional villa news, experiences and offers. The subscription endpoint adds that token to the selected public-news topic; it does not store it in a guest database or associate it with enquiries. Firebase keeps the delivery registration until it is deleted or expires under its service rules. Turn notifications off in zelax.club on your phone in the footer to unsubscribe this device; browser site settings can also block delivery. Clearing website data removes offline files and local preferences.
Technical data and display preferences
Firebase, Google and our hosting services may process IP addresses, browser details, page requests and security logs to deliver and protect the website and guest workspace. Display choices apply in the current session unless you enable “Remember on this device”; then your motion, text-size and contrast choices are stored in your browser for up to 180 days. These display choices are not sent to our guest database. Stay and profile preferences are different: when you save them in the workspace, they are stored on the server for you and the host team.
Services, retention and your choices
Firebase and Google provide hosting, database, authentication and optional messaging or measurement services. Airbnb, WhatsApp, Google Maps and email providers handle information under their own policies when you use them. Quotation pages show OpenStreetMap map tiles after private-link access is verified. The tile provider receives your network address, browser information and this site’s origin, but not the private quotation ID, access key or quotation details. We do not request your device’s location. We retain guest records and correspondence as needed for your request, stay, follow-up and applicable record-keeping requirements. Closing a tab, checking out, signing out or clearing browser storage does not automatically delete server records. Email harsh@zelax.club to request access, correction or deletion of information held for your stay or account; any limits on deletion will be explained. Clear display choices in Accessibility & preferences and withdraw optional measurement in Cookie choices. This notice will change if our use changes. The separate 30-day ID-file access limit and automatic deletion process apply to QR uploads; they do not set a deletion date for all guest registration details.