Galaxia ("we," "our," or "us") operates the Galaxia mobile application and the website galaxiaresorts.com (collectively, the "Service"). We are committed to protecting the privacy of our users. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and your rights regarding your personal data.
1Information We Collect
a) Information You Provide
- Account details: Name, email address, phone number provided during sign-up via Google OAuth or phone verification.
- Booking information: Property selections, stay dates, guest count, special requests, and celebration preferences.
- Payment information: We do not store full payment card details. Transactions are processed securely through third-party payment gateways (e.g., Razorpay).
- Communications: Messages you send via our chatbot, WhatsApp integration, or customer support channels.
b) Information Collected Automatically
- Device information: Device type, operating system, app version, and unique device identifiers.
- Usage data: Pages visited, features used, time spent on the app/website, and interaction patterns.
- Analytics: We use Vercel Analytics and Speed Insights to measure website performance and improve user experience. These tools collect anonymized, aggregated data.
c) Information from Third Parties
- Google OAuth: When you sign in with Google, we receive your name, email address, and profile picture from Google.
- Phone verification: When you sign in with your phone number, we receive a verified phone number via AWS Cognito.
2How We Use Your Information
- Service delivery: To process bookings, manage reservations, send confirmation vouchers, and provide customer support.
- Communication: To send booking confirmations, updates, check-in instructions, and respond to your inquiries.
- Personalization: To remember your preferences and improve your experience on future visits.
- Safety & security: To detect and prevent fraud, abuse, and unauthorized access to accounts.
- Analytics & improvement: To understand how our Service is used and to make improvements to features, performance, and reliability.
- Legal compliance: To comply with applicable laws, regulations, and legal processes.
3Data Sharing & Third Parties
We do not sell your personal data to third parties. We may share limited information with trusted service providers solely to operate our Service:
- Cloud infrastructure: Amazon Web Services (AWS) for hosting, authentication (Cognito), and data storage.
- Payment processing: Razorpay for secure payment handling.
- Analytics: Vercel for performance monitoring.
- Communication: WhatsApp Business API for chatbot and booking notifications.
All third-party providers are contractually obligated to protect your data and use it only for the purposes specified by us.
4How We Protect Your Data
- All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
- User passwords and authentication tokens are managed through AWS Cognito with industry-standard hashing and encryption.
- Admin access to backend systems is protected by role-based access controls and JWT-based authentication.
- We perform regular security reviews and follow industry best practices for data protection.
- Payment data is handled exclusively by PCI-DSS compliant payment processors — we never store card numbers on our servers.
5Data Retention
We retain your personal data only for as long as necessary to provide our services and fulfill the purposes described in this policy. Specifically:
- Account data: Retained while your account is active. Deleted within 30 days of an account deletion request.
- Booking records: Retained for up to 7 years for tax, legal, and business compliance purposes.
- Payment transaction records: Retained as required by applicable financial regulations.
- Analytics data: Aggregated and anonymized; not linked to individual users.
6Your Rights
You have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of any inaccurate or incomplete data.
- Deletion: Request deletion of your account and associated personal data. See our Account Deletion page for details.
- Portability: Request an export of your data in a commonly used format.
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, please contact us at admin@galaxiaresorts.com.
7Children's Privacy
Our Service is not directed to children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately at admin@galaxiaresorts.com and we will promptly delete the information.
8Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
9Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: