Privacy Policy
Last updated: October 4, 2026 • GDPR & SOC-2 Ready
At Staykar Resort, we believe customer data privacy is a fundamental architectural requirement. This policy explains what information we collect, how we isolate your multi-tenant data, and the strict zero-knowledge principles applied to your workloads.
1Information We Collect & Store
We collect minimal personal information strictly necessary to provide the platform services:
- Account Identity: Full name, verified work email, and bcrypt/Argon2-hashed passwords.
- Organization Details: Workspace name, custom domain CNAME mappings, and Indian GSTIN (for tax compliance).
- Billing Tokens: Masked card references and Razorpay customer IDs (we do not store raw CVVs or full credit card numbers).
- System Telemetry: Anonymized API invocation metrics, storage bandwidth bytes, and security audit logs.
2Cryptographic Multi-Tenant Isolation
Unlike legacy architectures where multiple tenants query shared unfiltered collections, Staykar Resort implements automated document-level criteria wrapping in MongoDB 7.0 and Java 21 Virtual Threads.
Every database read and write operation is bound to a cryptographic tenant context token. Cross-tenant leakage is mathematically impossible at the persistence layer.
3Pluggable Cloud Storage Encryption
All customer assets and documents stored on AWS S3 or Cloudflare R2 are encrypted using industry-standard AES-256 server-side encryption. Public access is disabled by default; access is granted exclusively through short-lived presigned URLs.
4Zero Data Selling & Third-Party Disclosures
We do not sell, rent, or monetize your organizational data to advertisers or third parties. Data is shared strictly with operational sub-processors (Razorpay for billing, Cloudflare for CDN/DDoS edge protection, AWS for infrastructure).
5Your Data Rights (GDPR & DPDP India)
You maintain the absolute right to export, modify, or permanently delete all workspace records. Requests for data eradication can be triggered self-service from your workspace settings or by emailing our data protection officer.