Privacy Policy

Arnav Harmony Farm is a farm resort and adventure park at Bharje, Pali, in Sudhagad taluka of Raigad district, Maharashtra. We operate the website arnavharmonyfarm.in and are responsible for the personal data described below.

We only collect what a booking or an enquiry actually needs.

• When you book: your name, email address, phone number, the dates and rooms you chose, the number of guests, and any notes you add.
• When you use the contact form: your name, email, phone, the topic you picked and your message.
• If you create an account: your email and name, so you can see your own bookings later.
• Automatically: anonymous usage statistics: pages viewed, approximate region, device type. These are aggregated and are not linked to your booking.

We do not ask for, and have no use for, your date of birth, gender, identity documents, or any of the special categories of personal data.

We never see your card, UPI or bank details. Payments are handled entirely by Razorpay, a PCI-DSS compliant payment gateway. You enter your details on Razorpay’s own secure interface; they return only a payment reference and a success or failure result to us. There is no point at which card data touches our servers, and we could not store it even if we wanted to.

• To hold and honour your booking, and to reach you about it, whether a confirmation, a change, or a problem on the day.
• To answer the enquiry you sent us.
• To meet our own accounting and tax obligations for money received.
• To understand, in aggregate, which pages people find useful so we can improve the site.

We do not sell your data. We do not share it with advertisers. We do not send marketing emails unless you have asked us to.

Booking records are held in a managed Postgres database (Supabase) hosted in the Asia-Pacific region. Access is restricted by row-level security, and staff accounts require multi-factor authentication.

Your phone number and any notes you leave with a booking are encrypted at rest with a key held separately from the database, so they are unreadable even to someone with a copy of the data. A staff member has to deliberately reveal a phone number to see it, and that action is written to an audit log.

Messages sent through the contact form are stored in readable form, because the whole purpose of an enquiry is that a person reads it and replies. Only signed-in staff can access them.

We use a small number of service providers, each for one job:

• Razorpay: takes the payment and processes refunds.
• Supabase: hosts the database and the booking functions.
• Vercel: serves the website.
• Google Analytics: anonymous, aggregated traffic statistics.

Beyond these, we disclose personal data only where the law requires it.

Bookings that expired without payment, and bookings you cancelled, are purged automatically 10 days after they end. Completed stays are kept for as long as we need them for accounts and tax. Contact enquiries are kept until they are closed and then removed in routine clean-up.

You can ask us what we hold about you, ask for it to be corrected, or ask us to delete it. Write to us at the address below and we will respond within 30 days. Where you ask for deletion, we may need to keep the minimum record of a completed transaction that tax law requires.

The site sets no advertising or tracking cookies. If you sign in to see your bookings, we store a session token in your browser so you stay signed in, and clearing your browser data signs you out. Analytics is aggregate and does not follow you to other websites.

The farm welcomes children, but the website is intended to be used by adults. We do not knowingly collect personal data directly from anyone under 18; a booking that includes children is made by the adult responsible for them.

If we change how we handle personal data we will update this page and the date above. Material changes will also be mentioned at checkout.