Privacy Policy
This policy covers both ilica.in (the consumer app, for guests and Rentals owners) and ilicaX / host.ilica.in (the homestay owner dashboard). Where something applies to only one, we say so.
1. Who we are
Ilica ("we", "us", "our") operates a hyperlocal property rental and homestay platform based in Assam, India. This policy explains what information we collect from guests, property owners ("hosts"), and visitors, why we collect it, and what rights you have over it.
2. Information we collect
Account information
To use Ilica or ilicaX, we collect your phone number, which we verify by SMS one-time password. We do not require or collect passwords — your phone number and the OTP sent to it are how you sign in.
Guest and booking information
When you make a booking or request, or when a host checks you in as a walk-in guest, we collect:
- Name, phone number, and for group bookings, the names of additional guests
- Age and gender, where provided at check-in (used for aggregate occupancy reporting shown to the host, not shared beyond that property)
- A photo of a government-issued ID, captured at check-in for homestay stays. This is collected because Assam tourism and police regulations require homestays to record guest identification. ID photos are uploaded directly to secure storage and are visible only to the specific property's host and to Ilica's own administrators for safety and compliance purposes — they are never shared with other hosts, other guests, or any third party outside of a legal request from a government authority.
- Check-in and check-out dates, room assigned, and amount paid
Location information
To show you nearby rentals and stays, the consumer app uses your device's location if you grant permission, or an address you search for manually. Hosts provide their property's location when creating a listing. We do not track your location in the background when the app is closed.
Payment information
Payments are processed by Razorpay, a licensed payment gateway. We do not store your card, UPI, or bank account details ourselves — Razorpay handles that directly and shares with us only what's needed to confirm a payment succeeded (amount, transaction ID, and status).
Device and usage information
We collect standard technical information — device type, app version, and a push-notification token (if you enable notifications) — used to deliver booking alerts and keep the app working correctly. We do not use this for advertising.
3. How we use your information
- To create and manage your account, and verify who you are via OTP
- To connect guests with hosts, and process the connection or booking fee
- To let hosts manage their own bookings, calendar, and guest records
- To send booking confirmations, check-in reminders, and (if enabled) push notifications
- To meet legal requirements around guest identification at homestays
- To detect and prevent fraud or abuse of the platform
4. Who we share information with
We do not sell personal information. We share it only in these situations:
| Recipient | What they receive | Why |
|---|---|---|
| The host you're booking with | Your name, phone, and (for homestay check-in) ID photo | So they can host you and meet legal ID requirements |
| Razorpay | Payment amount and your phone number | To process the payment |
| Google Firebase | Account and booking data | Our database, authentication, and file storage provider |
| Fast2SMS | Phone number | To deliver OTP and booking SMS |
| Resend | Email address (if provided) | To deliver booking confirmation emails |
| Government authorities | As legally required | Only in response to a valid legal request |
5. Data security
Guest and booking data is stored in Firebase (Google Cloud infrastructure) with access rules that restrict a host's visibility to their own property's bookings and guests only. ID photos are stored separately from other booking data and are not embedded directly in database records.
6. How long we keep your information
We retain booking and guest records for as long as your account is active, and for a reasonable period afterward to meet accounting, legal, and tax obligations. You can request deletion of your account and associated data at any time — see Section 7.
7. Your rights
Under India's Digital Personal Data Protection Act, you have the right to:
- Ask what personal data we hold about you
- Correct inaccurate information
- Withdraw consent and request deletion of your data, subject to our legal obligation to retain certain records (such as guest ID records required by tourism regulations, for the legally mandated period)
- Lodge a complaint with the relevant data protection authority
To exercise any of these rights, contact us using the details in Section 10.
8. Children's privacy
Ilica is not directed at children under 18. We do not knowingly collect information from minors beyond what's incidentally provided as part of a family group booking made by an adult guest.
9. Changes to this policy
We may update this policy as the product changes. We'll update the "Last updated" date above, and for material changes, we'll make a reasonable effort to notify active users directly.
10. Contact us
Questions about this policy or your data: ilica.services@gmail.com
This policy is written to accurately describe how Ilica actually works. It has not been reviewed by a lawyer. If you're relying on this for formal compliance purposes, have it reviewed against India's DPDP Act by a qualified professional before launch.