Privacy Policy

Last updated: September 2026 • Compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act, Act No. 22 of 2023)

1. Data Fiduciary Identification

Dusty Compass is a specialized hotel growth and revenue consulting brand operated under the legal MSME registered entity Swami Multiverse Media ("we," "us," or "our"). Under the Digital Personal Data Protection Act, 2023, Swami Multiverse Media functions as the Data Fiduciary determining the purpose and means of processing personal data collected through dustycompass.in and related communication channels.

• Entity Name: Swami Multiverse Media
• Operating Brand: Dusty Compass
• Website: https://dustycompass.in/
• Official Communications: hello@dustycompass.in

2. Lawful Basis of Processing & Affirmative Consent

In strict accordance with Section 4 and Section 6 of the DPDP Act, we only process personal data where you have given Free, Specific, Informed, Unconditional, and Unambiguous consent through a clear affirmative action (such as ticking an unticked consent checkbox on our enquiry forms or clicking 'Accept All' on our cookie manager), or for specified legitimate uses recognized under Section 7 of the Act (such as issuing statutory tax invoices and complying with Indian taxation laws).

Consent is never a bundled condition for accessing our public research, case studies, or educational guides. You retain the absolute legal right to withdraw your consent at any time with the same ease with which it was provided.

3. Itemized Personal Data & Purpose Limitation (Section 6(1))

We adhere strictly to the principle of Data Minimization. We only collect the minimal personal data necessary to evaluate your hotel's growth bottlenecks and provide consulting solutions. The table below details every item of personal data, its specific purpose, and its retention timeframe:

4. Authorized Data Processors & Third-Party Transfers

Under Section 8(2) of the DPDP Act, Swami Multiverse Media engages verified Data Processors under strict confidentiality and security covenants. We do not sell, rent, or trade your personal data under any circumstances. Our authorized Data Processors include:

• Supabase Inc.: Secure database provider storing encrypted enquiry records. Data is protected with TLS 1.3 in transit and AES-256 encryption at rest.
• Razorpay Software Private Limited: RBI-authorized payment aggregator managing online transactions. Razorpay is certified PCI-DSS Level 1. Dusty Compass never stores or views your debit/credit card numbers or UPI MPINs.
• Google LLC (Google Analytics 4 & GTM): Aggregated website traffic and diagnostic telemetry. Activated only if you grant consent via our Cookie Manager.
• Microsoft Corporation (Microsoft Clarity): Aggregated visual session analysis and heatmaps to improve user navigation. Activated only if you grant consent.
• Cal.com, Inc.: Calendar scheduling platform for booking strategic onboarding calls.
• WhatsApp (Meta Platforms, Inc.): Encrypted channel for direct business communications and consultation scheduling.

5. Protection of Children’s Personal Data (Section 9)

In accordance with Section 9 of the DPDP Act, 2023:

• Dusty Compass provides professional B2B advisory services exclusively intended for hotel owners, general managers, and hospitality entrepreneurs aged 18 years or older.
• We do not knowingly collect, process, or solicit personal data from children under the age of 18.
• We do not engage in tracking, behavioral monitoring, or targeted advertising directed at individuals below 18 years of age.

6. Reasonable Technical & Security Safeguards (Section 8(5))

We maintain comprehensive technical and organizational safeguards to prevent personal data breaches, including:

• Transport Security: Strict HTTPS and TLS 1.3 encryption across all website endpoints.
• Access Control: Database Row Level Security (RLS) ensuring lead data is accessible exclusively to authorized consulting personnel.
• XSS & Injection Mitigation: Strict HTML entity sanitization on all dynamic inputs and security headers including CSP, HSTS, and X-Content-Type-Options.
• Breach Notification: In the unlikely event of a personal data breach, we will notify the Data Protection Board of India and all affected Data Principals promptly, fulfilling our obligations under Section 8(6) of the Act.

7. Statutory Rights of the Data Principal (Sections 11–14)

As a Data Principal under the DPDP Act, 2023, you hold the following enforceable statutory rights:

• Right to Access Summary (Section 11): You have the right to obtain a summary of your personal data being processed, a description of the processing activities, and the identities of all third-party Data Processors with whom your data has been shared.
• Right to Correction & Completion (Section 12): You have the right to request correction of inaccurate data, completion of incomplete data, or updating of your contact details.
• Right to Erasure ("Right to be Forgotten", Section 12): You have the right to request the complete deletion of your personal data unless retention is mandatory under Indian law (e.g. tax records).
• Right to Withdraw Consent (Section 6(4)): You can withdraw previously granted consent at any time without affecting the lawfulness of processing prior to withdrawal. You can click the floating "Privacy & Cookies" button at the bottom of our site or email us.
• Right of Grievance Redressal (Section 13): You have the right to have any complaint resolved through our Grievance Redressal Officer within published statutory timelines.
• Right to Nominate (Section 14): You have the right to nominate an individual who shall, in the event of death or incapacity, exercise your data rights.

To exercise any of these statutory rights, please send an email to hello@dustycompass.in with the subject line "DPDP Data Principal Request - [Your Name]".

8. Grievance Redressal Mechanism & Officer (Section 8(9) & Section 13)

In accordance with Section 8(9) and Section 13 of the DPDP Act, 2023, we have appointed an official Grievance Redressal Officer to address any questions, concerns, or data requests:

9. Right to Approach the Data Protection Board of India (DPBI)

Under Section 13(3) of the Digital Personal Data Protection Act, 2023, if your grievance is not resolved by our Grievance Redressal Officer within the statutory period, or if you are dissatisfied with the resolution provided, you have the legal right to lodge an appeal or complaint before the Data Protection Board of India (DPBI) in the manner prescribed by the Central Government of India.

10. Cookie Governance & Preference Management

Our website utilizes cookies categorized into Strictly Necessary (operational essentials) and Analytics/Performance cookies (Google Analytics & Microsoft Clarity). In compliance with the DPDP Act, non-essential cookies are only initialized after your affirmative consent. You can view our complete Cookie Policy or adjust your preferences at any time by clicking the floating "Privacy & Cookies" button located at the bottom-left of every page.