Privacy Policy

1. Information We Collect

We collect information that you give us directly, information generated when you use the platform, and information from third-party integrations you authorize.

Information You Provide

• Account & contact details: name, email, phone number, hotel/property name, city.
• Property & operational data: bookings, guest records, room inventory, billing entries, kitchen orders, housekeeping status — entered by you or your staff while operating the platform.
• Communications: messages you send to us through email, contact forms, demo bookings, or WhatsApp.
• Founding Partner interest: if you opt in via our forms.

Information Collected Automatically

• Device & usage data: IP address, browser type, device identifiers, pages visited, referring URL, timestamps.
• Cookies & similar technologies: see Section 9.

Information from Third Parties

• Meta / WhatsApp: when guests or hotel staff message a StayOS-managed WhatsApp Business number, Meta provides us with the message content, sender phone number, and delivery metadata required to operate the conversation.
• Payment processors: transaction status and limited billing metadata (we do not store full card numbers).

2. How We Use Your Information

We use personal information only for purposes that are necessary to operate StayOS or that you have consented to:

• Provide, maintain, and improve the StayOS platform and related services.
• Process bookings, payments, GST-compliant invoices, and operational records on behalf of your hotel.
• Send transactional and service communications (e.g., booking confirmations, check-in/out reminders, support replies, account notices).
• Respond to enquiries, demo bookings, and Founding Partner applications.
• Detect, prevent, and respond to fraud, abuse, security incidents, and policy violations.
• Comply with applicable law, including tax, accounting, and record-keeping obligations under Indian law.

We do not sell your personal information, and we do not use the contents of your guest data to train third-party AI models.

3. WhatsApp Business Messaging

StayOS uses the WhatsApp Business Platform (Cloud API) provided by Meta to deliver operational messages between hotels and their guests. This section explains how data is processed in that channel.

3.1 Categories of Messages

• Transactional & utility: booking confirmations, payment receipts, check-in / check-out reminders, room-ready notifications, and order updates.
• Customer support: replies initiated by a guest within the 24-hour customer service window.
• Authentication: one-time passcodes, where applicable.

We do not send marketing or promotional messages over WhatsApp without explicit, granular opt-in from the recipient, and we comply with Meta's WhatsApp Business Policy and Commerce Policy at all times.

3.2 Data We Process via WhatsApp

• Phone number of the guest or staff member.
• Message content (text, media, interactive responses) and delivery metadata.
• Profile information that the user has chosen to share with WhatsApp.
• Conversation history needed to provide service continuity and support.

3.3 How Long We Keep WhatsApp Data

• Conversation transcripts: retained for up to 90 days from the last message to provide support context, unless they are linked to a booking record.
• Booking-linked messages (e.g., confirmations, invoices): retained for the longer of (a) the duration of the customer relationship plus 12 months or (b) the period required by Indian tax and record-keeping laws.
• Aggregated, de-identified analytics: may be retained indefinitely.

3.4 Opt-Out & Stop Receiving Messages

3.5 Sub-processors for WhatsApp

Messages are routed through Meta Platforms, Inc. and its affiliates as part of the WhatsApp Business Platform. Meta processes the data in accordance with Meta's Business Terms and Privacy Policy.

4. Data Storage & Security

Personal data is stored in cloud infrastructure operated by reputable providers and is protected with industry-standard safeguards including:

• Encryption in transit (TLS 1.2+) and encryption at rest for databases and backups.
• Role-based access controls — only authorized personnel can access production data on a need-to-know basis.
• Audit logging of administrative access.
• Regular security reviews and prompt patching of known vulnerabilities.

No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify you and the relevant authorities as required by applicable law.

5. Sharing & Disclosure

We share personal information only in the following circumstances:

• Service providers (sub-processors): cloud hosting, database, email delivery, WhatsApp Business Platform (Meta), payment processors, analytics, and customer support tooling — bound by contractual confidentiality and data-protection obligations.
• Within your hotel organization: data is visible to authorized users at the property based on their role (owner, manager, front desk, kitchen, housekeeping).
• Legal & compliance: when required by law, court order, valid government request, or to protect rights, property, or safety.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to you where required by law.

We do not sell or rent personal information to third parties for their independent marketing purposes.

6. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, or as required by law:

• Account & subscription data: for the duration of your relationship with StayOS, plus a reasonable period to comply with legal and tax obligations.
• Booking, billing, and GST records: retained for the period required by Indian tax and accounting law (typically up to 8 years).
• Marketing and waitlist contacts: until you unsubscribe or request deletion.
• WhatsApp conversation data: as described in Section 3.3.
• Technical logs: typically up to 12 months.

7. Your Rights

Subject to applicable law (including India's Digital Personal Data Protection Act, 2023, and the GDPR where it applies), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data, subject to lawful retention requirements.
• Withdraw consent for processing that relies on consent (including WhatsApp messaging).
• Object to or restrict certain processing.
• Data portability — receive your data in a structured, machine-readable format.
• Lodge a complaint with your supervisory authority.

To exercise any of these rights, contact team@slasheasy.com. We will respond within 30 days, or sooner if required by law. We may need to verify your identity before fulfilling the request.

8. Children's Privacy

StayOS is a B2B platform intended for hotel operators and is not directed to children under 18. We do not knowingly collect personal information from children. If we learn that we have collected such data, we will delete it.

9. Cookies & Tracking

stayos.in uses a small number of essential cookies and similar technologies for session management, security, and basic analytics (e.g., understanding how visitors interact with the landing page). You can disable cookies in your browser; some functionality may be limited as a result. We do not use third-party advertising trackers.

10. International Transfers

Your data is primarily stored in India. Some sub-processors (including Meta for WhatsApp Business) may process data outside India. Where data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses and the privacy commitments of those providers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date and, for material changes, take reasonable steps to notify you (for example, via email or a prominent notice on the site). Continued use of StayOS after the change constitutes acceptance of the revised Policy.