Privacy Policy

Morni Hills Retreat & Heaven (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what personal information we collect, how we use and protect it, who we share it with, and the choices and rights you have — including when you interact with our website and with our automated assistant (“Simran”) on WhatsApp, Instagram, and Facebook Messenger.

1. Who we are

Morni Hills Retreat & Heaven is a boutique hill retreat located at 318, Bhoj Dharti, Udiyon, Morni Hills, Panchkula District, Haryana 134205, India. We are the data controller responsible for the personal information described in this policy. For any privacy question, contact us using the details in the Contact us section.

2. Scope of this policy

This policy applies to personal information we process when you:

• visit or interact with our website at mornihillsretreat.com;
• message our assistant Simran on WhatsApp, Instagram Direct, or Facebook Messenger;
• contact us by phone or email, or enquire about or make a booking; and
• respond to, or click through from, our advertisements (including click-to-message ads).

It does not cover the practices of third parties we do not control, such as Meta, payment providers, or other websites we may link to, which are governed by their own privacy policies.

3. Information we collect

3.1 Information you give us

• Contact details — your name, phone number, WhatsApp number, social media handle/profile name, and email address.
• Messages and enquiry content — the messages, questions, and any photos, voice notes, or files you send us through chat, email, or phone, and our replies to you.
• Booking details — check-in/check-out dates, number and type of guests, room/accommodation preferences, special requests, and similar reservation information.
• Payment information — when you pay a deposit or booking amount, payment is processed by our payment provider (Razorpay). We receive confirmation of payment status and limited transaction references; we do not store your full card or bank details on our systems.

3.2 Information we collect automatically

• Platform identifiers — when you message us, the messaging platform (WhatsApp/Meta) provides us with identifiers such as your WhatsApp ID or messaging-scoped ID and your public profile name, so we can reply to you.
• Conversation metadata — timestamps and message status needed to manage the conversation.
• Advertising attribution — if you reach us by tapping a click-to-message advertisement, Meta may share a referral reference (such as the ad and a click identifier) so we understand which campaign brought you to us.
• Website usage data — basic technical information such as your IP address, browser type, and pages viewed, collected by our web server and standard web infrastructure for security and performance.

4. How we use your information

We use your information only for legitimate business purposes, including to:

• respond to your enquiries and provide customer service through our assistant and our team;
• check availability, prepare quotes, and confirm and manage your booking;
• process deposits and payments and send you a secure payment link;
• arrange your stay and communicate important details before, during, and after it;
• improve our service, hospitality, and the quality of the assistant’s responses;
• understand which marketing campaigns are effective; and
• comply with our legal, tax, and accounting obligations.

We rely on your consent (for example, when you message us or opt in to updates), the performance of our agreement with you (to handle your booking), and our legitimate business interests (to operate, secure, and improve the retreat) as the bases for processing your information.

5. Automated & AI processing

6. How we share information

We do not sell your personal information. We share it only with trusted service providers who help us operate, and only as needed:

• Meta Platforms — WhatsApp, Instagram, and Messenger, which deliver messages between you and us.
• Anthropic — our AI provider, to generate the assistant’s replies (see Automated & AI processing).
• Razorpay — our payment provider, to process deposits and booking payments securely.
• Cloud hosting and infrastructure providers — who host our website and assistant on our behalf.
• Our host and team — the retreat’s owner/host and staff, so they can assist you and prepare for your stay.
• Authorities and advisors — where required by law, regulation, legal process, or to protect our rights and the safety of guests.

These providers process your information under their own privacy and security commitments and only for the purposes described above.

7. Messaging platforms & Meta

When you message us on WhatsApp, Instagram, or Messenger, your use of those services is also governed by Meta’s own terms and privacy policy. Our use of information obtained through the WhatsApp Business Platform and Meta’s messaging products complies with the WhatsApp Business Messaging Policy, the Meta Platform Terms, and Meta’s Privacy Policy. We use data we receive from these platforms only to communicate with you and provide the service you requested, and we do not use it for unrelated purposes.

8. Data retention

We keep your information only for as long as necessary for the purposes set out in this policy — typically for the duration of our communication with you, the lifecycle of your booking, and a reasonable period afterward to handle follow-ups, repeat guests, and our legal and accounting obligations. When information is no longer needed, we delete or anonymise it. You may request earlier deletion as described below.

9. How we protect your data

We apply reasonable technical and organisational measures to protect your information, including encryption in transit (HTTPS), access controls, and limiting access to those who need it. No method of transmission or storage is completely secure, but we work to protect your data and to address any incident promptly.

10. Your rights

Subject to applicable law, you may ask us to:

• access the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• delete your personal information (see below);
• restrict or object to certain processing; and
• withdraw consent at any time — for example, by replying STOP to opt out of further messages.

To exercise any of these rights, contact us using the details in the Contact us section. We will respond within a reasonable time.

11. How to delete your data

12. Cookies & analytics

Our website uses minimal cookies and may load third-party resources such as web fonts and an embedded map (for example, Google Fonts and Google Maps), which may set their own cookies or collect technical data under their own privacy policies. We do not use our website to build advertising profiles of you. You can control cookies through your browser settings.

13. Children’s privacy

Our services are intended for adults. We do not knowingly collect personal information from children under the age of 18 without the involvement of a parent or guardian. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Significant changes will be highlighted where appropriate. Please review this page periodically.

15. Contact us