Privacy Policy

Razorstay is software that hotels, resorts and restaurants use to run their properties. Who is responsible for your personal data depends on how you meet us:

• If you are a guest of a hotel that uses Razorstay, the hotel decides what it collects about your stay and why. The hotel is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). Razorstay processes that data on the hotel's behalf and only on its instructions, as its Data Processor.
• If you work at a hotel that uses Razorstay, visit our website, or ask us for a demo, Razorstay is the Data Fiduciary for your data.

Hotel teams

• Name, work email, phone number, the property you work at, and your role and permissions.
• Sign-in activity and a record of actions you take, such as changing a rate, approving a refund or cancelling a booking. Hotels use this record for accountability.

Guests (on behalf of the hotel)

• Contact and booking details: name, phone number, email, the dates and rooms booked, who you are travelling with, and special requests.
• Identity documents, when the hotel asks for them at check-in: for example passport, visa, Aadhaar or driving licence details and images. For foreign nationals, the hotel also records the details it must report under Form C.
• Orders and requests you place through the guest app or the hotel, such as food orders, housekeeping, laundry or taxi requests.
• Bills and payments: what you were charged, how you paid (for example cash, UPI or card) and the payment status. Razorstay does not process card payments itself and does not receive or store card numbers, CVVs or UPI PINs.
• Bookings from travel sites: if the hotel connects a channel manager, booking details from sites such as Booking.com or MakeMyTrip reach the hotel through it.

Website visitors and demo requests

• What you tell us in a contact or demo form, such as your name, property, phone number and email.
• Technical data needed to run the site securely, such as IP address, browser and device type, and error logs.

We use personal data only for these purposes:

• To provide the service hotels subscribe to: bookings, check-in, room service, housekeeping, billing, invoices and reports.
• To send messages the hotel sets up, such as booking confirmations, guest passes and invoices, by email or WhatsApp.
• To help hotels meet their legal duties, such as identity checks at check-in, Form C reporting for foreign guests, and GST invoicing and record-keeping.
• To keep the service secure, prevent misuse, and investigate and fix problems.
• To reply to demo and support requests, and, only if you opt in, to send product updates. You can unsubscribe at any time.

Where the law requires your consent, we or the hotel ask for it first, and you can withdraw it later. Some processing doesn't need consent because the law requires it, for example keeping tax records or reporting foreign guests.

We do not sell personal data. We do not use guest data for advertising, and we do not build profiles of guests across hotels.

Identity documents need extra care. For them:

• They are collected only when the hotel requires them, and the guest's consent to share them is recorded.
• Only staff whose role allows it can see them, and every access is tied to a named account.
• They are used for check-in and the hotel's legal reporting, and for nothing else.
• They are kept only as long as the hotel needs them or the law requires, then deleted on the hotel's instruction.

• The hotel you stay at or work for. Your data belongs to that hotel's account and isn't visible to other hotels.
• Service providers that run the service for us, bound by contracts to protect the data and use it only for us:
  • Google Cloud (Firebase), which hosts our application, database and file storage.
  • Meta (WhatsApp Business), which delivers WhatsApp messages when a hotel turns them on.
  • AIOSell, a channel manager. When a hotel connects it, AIOSell receives the hotel's availability and rates and sends bookings from travel sites.
• Authorities, when the law requires it, such as a valid order from a court or government agency, or a hotel's statutory reporting.
• A buyer or successor, if Razorstay is involved in a merger or acquisition, under the same protections described here.

Data is stored on Google Cloud. Some of it may be processed on servers outside India. We transfer data only as the DPDP Act permits, and with protections equivalent to those described here.

• Hotel account data: for as long as the hotel subscribes, then for a short period so the hotel can export its data, after which it is deleted.
• Guest data: for as long as the hotel instructs. Invoices, payments and accounting records are kept for the period Indian tax law requires.
• Demo and contact requests: until we have dealt with them, or for up to two years if you agree to hear from us.
• Security logs: for as long as needed to keep the service safe and investigate incidents.

• Data is encrypted in transit (HTTPS) and at rest on Google Cloud.
• Access is based on roles. Permissions are checked on our servers for every action, not just in the app.
• Changes to bookings, rates, refunds and invoices are recorded with who made them and when.
• Staff and partner integrations get only the access they need. API keys are limited to specific properties and actions.

No system is perfectly secure. If a breach affects your personal data, we will inform the hotel, you where we are responsible, and the Data Protection Board of India, as the law requires.

Under the DPDP Act you can:

• ask for a summary of the personal data held about you and how it is used;
• ask for it to be corrected, completed or updated;
• ask for it to be erased, unless the law requires it to be kept;
• withdraw consent you gave, which won't affect anything done before you withdrew;
• nominate someone to exercise these rights for you if you die or become unable to; and
• raise a grievance and get a response.

Guests should usually contact the hotel first, since it decides how your data is used. Anyone can also write to us at support@razorstay.com. We will verify your identity, act on the request ourselves or pass it to the hotel, and reply within the time the law allows. If you aren't satisfied, you can complain to the Data Protection Board of India.

Razorstay is not meant for anyone under 18 to use on their own. Hotels may record a child's details as part of a family booking, provided by the adult guest who is responsible for them.

We use only the cookies and browser storage the service needs to work. These keep you signed in, protect your session, and remember preferences such as light or dark mode.

We don't use advertising cookies or cross-site trackers.

If we change this policy in a way that matters, we will tell hotel administrators by email or in the app before the change takes effect, and update the date at the top. Earlier versions are available on request.

For privacy questions, requests or grievances, contact our Grievance Officer: