Privacy Policy

Last updated: 30 October 2026

Skylet (skylet.space) is a marketplace that connects people who have rooftop space ("hosts") with people who want to use it ("renters"). It is operated by Slashh Labs Pvt Ltd, WellWork, Vasavi MPM Grand, Plot No. 8-3-3231 1.12, Ameerpet X Roads, Ellareddyguda, Hyderabad 500073 ("Skylet", "we", "us"). This policy explains what personal data we collect, why, who we share it with, and the choices and rights you have. It is written to meet the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and the rules under them.

1. What we collect

When you create an account: your name, email address and password. We store your password only as a one-way hash — we can never see it. We email you a code to verify your address and, if you ask, to reset your password.

When you book or request a roof: the dates, purpose and group size, your name, phone number and optional organisation, plus any note you write. Your phone number is for Skylet (for example, to help with a booking); it is never shown to the host.

When you list a roof (hosts): the roof's neighbourhood, city, state and PIN code, an optional building or society name, its position on the map, its specifications, prices and your photos. Your display name is shown on the listing.

Messages: what you write to hosts or renters through Skylet's messages.

Saved roofs: the roofs you save. If you share your list, anyone with the link can see the roofs on it and your first name, until you stop sharing.

Questions on roof pages: questions you ask about a roof, and hosts' answers, are public once answered, with the asker's first name.

Reports and blocks: if you report a roof or a person, we keep your report, who you reported and why, so our team can look into it. The person you report isn't told who reported them. If you block someone, we keep that so they can't message you or request your roof.

Invites: if you sign up through someone's invite link, we record who invited you, and they can see your first name and whether you have listed a roof or booked one.

Hosts' calendars: if a host connects their own calendar, we store its link and read only which days are busy. Each roof's calendar link (for the host's phone) shows renters' first names and group sizes.

Host records and stats: we count how often a host cancels confirmed bookings and how quickly they reply, to show the "Reliable host" badge and order search results. We count views of each roof's page per day, with nothing about who viewed it.

Payments: payments are made through Razorpay. Your card, UPI and bank details are entered on Razorpay's secure checkout and are never seen or stored by Skylet. We keep the payment's reference numbers, amount, status, the type of method used (e.g. "UPI" or "card"), and any refunds.

Identity check (the blue tick): if you choose to verify your identity, you sign in to DigiLocker (the Government of India's document wallet) and agree to share your Aadhaar or PAN with Skylet, through our verification partner Cashfree. From that document we keep only the name on it, which document it was, and its last 4 characters — the Aadhaar number only ever reaches us masked. We use the date of birth once, to confirm you're 18 or over, and don't keep it, nor your address or photo. We also keep a one-way code made from the document, so the same person can't verify two accounts. Others see only a blue tick next to your name, never your document.

Host payouts: to pay you, hosts give the name on their account and either a UPI ID or a bank account number and IFSC. We store these encrypted, use them only to pay you, require your password to change them, and email you whenever they change.

Location:

• Searching for a place sends what you type to our maps provider (Amazon Location Service) to suggest areas. We don't save your searches.
• In the "List your roof" flow, if you allow it, your browser shares your current location once to suggest your neighbourhood. We store only the neighbourhood and map pin you choose for the listing — not where you were.

Technical data: our servers keep short-lived technical logs (for example error reports) to keep the service secure and working. We do not use advertising or analytics cookies or third-party trackers. Your browser stores a sign-in token in its local storage so you stay signed in. Clearing it, or signing out, removes it.

2. Why we use it

• To run your account and sign you in securely (verification and password reset emails).
• To show listings, run search and maps, and handle bookings, payments, refunds and host payouts.
• To let hosts and renters contact each other, and to send you service emails — for example a booking request, a confirmation, a new message, or a refund.
• To show the blue tick on verified accounts, so hosts and renters know who they're dealing with.
• To keep Skylet safe: preventing fraud and abuse, enforcing our Terms, and resolving disputes.
• To meet legal obligations, such as tax and accounting records.

We process your data because you asked us to provide the service (your consent, given when you sign up and use Skylet), and where the law allows or requires it. We don't sell your personal data, and we don't use it for advertising.

3. Who sees what

Everyone (public): a listing's title, photos, neighbourhood, city, specifications, prices and the host's display name, and whether someone has the blue tick. The building name, PIN code and exact map position are never shown publicly.

Between a renter and a host:

• When you send a booking request, the host sees your first name, your organisation (if you give one), the purpose, dates and group size, and your note. Once the booking is confirmed they see your full name. Your phone number and email are never shared with the host, and the host's are never shared with you.
• All communication between renters and hosts happens in Skylet's messages. Phone numbers, email addresses and links are hidden in messages, booking notes, arrival instructions, listings and reviews, and messages may be checked automatically for contact details or attempts to take a deal off Skylet.
• Once a booking is confirmed, the renter sees the roof's exact address and the host's arrival instructions.

Service providers who process data for us:

• Amazon Web Services: hosting, database, photo storage and delivery, email delivery (Amazon SES), maps and place search (Amazon Location Service).
• Razorpay: payments and refunds.
• Cashfree: identity checks through DigiLocker, for the blue tick.
• Google Workspace: our support and grievance email.
• TypeSafe: automated checks of messages sent before a booking is confirmed (see section 3).

Others: we may disclose information when required by law, a court or government authority, or to protect the rights and safety of our users or the public.

4. Where your data is stored

Your data is stored in India, on Amazon Web Services in Mumbai (the ap-south-1 region): our database, your photos, and the services that run Skylet. Pages and photos are delivered through global content-delivery networks, so they load quickly; those networks cache public content, not your account data. Our payment partner Razorpay and our verification partner Cashfree process data in India. The emails we send you (codes and booking notifications) are delivered through Amazon's email service in the United States, and emails you send to our support and grievance addresses are handled in Google Workspace.

We use encryption in transit (HTTPS) and keep stored photos and data private to our service.

5. How long we keep it

• Account and listing data: for as long as your account is open.
• Identity check: the name and last 4 characters from your document, until you delete your account.
• Bookings, payments and refunds: as long as required by tax, accounting and other laws (generally up to 8 years), even if you close your account.
• Messages: for as long as either participant's account is open, unless they're needed for a dispute.
• Technical logs: a short period, normally 30 days or less.

When data is no longer needed, we delete or anonymise it.

6. Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• ask for a summary of the personal data we hold about you and who we've shared it with;
• ask us to correct, complete or update it;
• ask us to erase it and close your account (we keep only what the law requires us to keep);
• withdraw consent — this means we can no longer provide the service to you;
• nominate someone to exercise these rights if you die or become unable to;
• raise a grievance with us, and if you're not satisfied, complain to the Data Protection Board of India.

You can delete your account yourself at any time: in the Skylet app (Profile → Delete account) or on the website (Account → Delete your account). See skylet.space/delete-account for what's deleted and what we keep.

To use any of the other rights, email support@skylet.space from the address on your account. We'll respond within the time the law requires.

7. Children

Skylet is only for people aged 18 or over. We don't knowingly collect data from children. If you believe a child has created an account, contact us and we'll remove it.

8. Security

We protect your data with HTTPS, hashed passwords, private storage, access controls, and rate limits against abuse. No online service is perfectly secure. If we become aware of a personal data breach affecting you, we'll notify you and the authorities as the law requires.

9. Changes to this policy

We'll update this page if our practices change, and email you about significant changes. The "Last updated" date shows the current version.

10. Contact and Grievance Officer

Privacy questions or requests: support@skylet.space

Grievance Officer: Lakshmi Supriya, Grievance Officer Slashh Labs Pvt Ltd, WellWork, Vasavi MPM Grand, Plot No. 8-3-3231 1.12, Ameerpet X Roads, Ellareddyguda, Hyderabad 500073 Email: grievance@skylet.space · Phone: +91 80968 03452

We acknowledge grievances within 24 hours and aim to resolve them within 15 days (within one month for consumer complaints).