Privacy notice
Effective: 21 August 2026
Village Miles is currently operated as a pre-incorporation interest-only pilot by Sai Praveen. Privacy and grievance requests may be sent to support@villagemiles.com. Final registered-entity details, retention schedule, lawful paid-launch notices, and the production processor list remain required before paid public bookings.
1. Data we process
Account and authentication data; name, email, private phone number and verification status; profile, language and home-area details; government-ID document and review record; guest, Host and Co-host links; listing text, prices, media, Instagram links and property or residency evidence when enabled; availability, bookings, services and synthetic payment records; encrypted-at-rest booking messages; moderation events, stay check-ins, reports, support decisions and reviews; and security data such as session, IP-derived rate-limit, timestamp and device/request metadata.
2. Why we use it
To create and secure accounts; assess host interest; verify phone and identity; review host authority and listings; connect declared adults; process booking requests; disclose authorized participants; prevent double-booking, fraud and off-platform circumvention; provide chat, check-in, reviews and support; investigate safety or service concerns; enforce policies; maintain audit trails; comply with law; and measure the pilot using aggregate metrics. We do not reuse private verification evidence for advertising or unrelated profiling.
3. Visibility
Public listings show approved host profile and listing information, approximate—not exact—location, approved verification categories, host-provided Instagram links, and anonymous aggregate ratings when eligible. Booking participants see names, roles, verification status, selected services and booking information needed for the stay. Phone numbers, email addresses, exact home address, ID documents, document numbers, private reports and raw booking messages are not public.
4. Administrators and processors
Authorized administrators may review identity documents, listing submissions, moderation events and reports. Conversation content may be decrypted only for an active booking report through the audited support route. The MVP uses Cloudflare for hosting, D1 database, object/media storage and security, and may use Google or Microsoft for optional sign-in and an SMS provider for OTP. Instagram links take users to Instagram under its own terms. A complete production processor list and cross-border assessment remain launch requirements.
5. Consent and choices
Users choose whether to create an account, submit a listing, upload an ID, link an adult, add optional services, provide Instagram links, or submit a review. Essential account, security and booking records are required to provide the requested feature. Consent may be withdrawn for optional processing, but withdrawal does not invalidate earlier lawful processing and may make a feature unavailable.
6. Children
The MVP does not permit child accounts or direct collection of a child's phone, email, government ID, precise profile, or independent consent. A responsible adult may record only the child's name, age category and relationship for capacity and safety. Do not add a child unless legally authorized. Public launch requires verified-parent/guardian procedures and any other obligations applicable when child data is processed.
7. Retention and deletion
Data is retained only while reasonably needed for the feature, account security, disputes, fraud prevention, audit or law. The MVP does not yet run a production deletion schedule; therefore testers must not upload unnecessary real sensitive data. Replaced identity files are deleted from object storage when a new document is accepted by the upload workflow. A record-by-record retention schedule, account deletion workflow, legal holds and backup deletion process are mandatory before public launch.
8. Security
Controls include server sessions, phone uniqueness and rate limits, private object storage, file-signature validation, encryption at rest for booking messages, role-scoped access, audited administrator actions, content-security headers and minimized public data. No system is perfectly secure; report suspected account or data compromise through support and do not upload secrets or payment credentials.
9. Your requests
Subject to applicable law, users may request information about processing, access, correction, completion, erasure, consent withdrawal and grievance review. Profile corrections are available in the account area; booking-linked requests may use support. General privacy and grievance requests may be sent to support@villagemiles.com. A documented response workflow, nominee process, and statutory response timetable remain required before paid public bookings.
10. Cookies
The MVP uses essential authentication and security cookies. It does not currently claim to use advertising cookies or sell personal data. Any future analytics or marketing cookies must be separately disclosed and, where required, consent-controlled before use.
11. Changes
Material changes will be dated and notified as required. This notice does not reduce rights provided by applicable law.