Privacy Policy

Last updated 27 October 2026.

Who this applies to

This policy covers the StayOS Pro platform website, the hotel management application, and the booking engine a hotel publishes for its own guests.

What we collect

• Platform account data — name, business email, phone number, and the login history needed to detect and investigate account abuse.
• Hotel configuration data — rooms, rates, taxes, staff records and policies, which the hotel controls and which we process on its behalf.
• Guest data — reservation and identity information entered by the hotel or its guests. Hotels are the controller of this data.

Guest identity documents

Identity documents uploaded to StayOS Pro (passports, national IDs, driving licences, visas) are stored on a private, non-publicly-accessible filesystem. They are never served from a public URL. Access requires an authenticated user with the appropriate permission, and every download is recorded in the hotel's audit log. Documents are not exposed on any public booking page.

How we use it

• To operate the service: reservations, folios, invoices, payments and reporting.
• To send transactional messages a hotel has enabled, such as a booking confirmation.
• To maintain security: rate limiting, login monitoring and audit trails.

We do not sell personal data, and we do not use guest data for advertising purposes.

Payments

Card and UPI details are handled by the payment provider you configure and never reach the StayOS Pro servers. We store only the provider's transaction reference, status and amounts.

Retention and deletion

Finalised business records — invoices, payments, refunds, stock transactions and night audit entries — are retained for the period required by law and for audit purposes, and are not rebuilt from current data. Deleting a tenant removes its operational data on request, subject to any statutory retention obligation.

Your rights

Contact us to request access to, correction of, or deletion of your personal data. For guest data, hotels should contact us through their account so we can act on the correct tenant's records.

Security

We apply tenant isolation at the database query layer, role-based access control, hashed passwords, rate limiting, signature verification on payment webhooks and an append-only audit log. No system is perfectly secure, but a breach of one tenant's data is designed to be contained within that tenant.

Contact

Questions about this policy can be sent via the contact form.