Privacy policy

Last updated: [date]

This policy explains how [Company legal name] ("Hotelat") handles personal data, in line with the Digital Personal Data Protection Act, 2023 and the rules under it.

1. Two roles

• Data we decide about (Hotelat is the data fiduciary): restaurant owners and their account details, sales partners who apply or work with us, and visitors of hotelat websites.
• Data restaurants put into Hotelat (the restaurant is the data fiduciary, Hotelat processes it on their behalf): their guests, customers, delivery addresses, staff records, attendance and payroll. Questions about that data should go first to the restaurant.

2. What we collect

• Account: name, email, mobile, business name and address, GSTIN, billing records.
• Partners: name, contact details, qualification, area, ID and address proof, PAN, photo, bank details, agreement and commission records.
• Usage: sign-in times, device and browser, IP address, error logs, AI usage counts.
• Location: only when staff or riders enable location for attendance or deliveries.

3. Why we use it

To provide and secure the service, bill and support customers, verify and pay partners, meet legal and tax duties, and improve Hotelat. We do not sell personal data and do not show third-party ads.

4. Sharing

Only with service providers we need to run Hotelat — hosting [provider/region], payments (Razorpay), email (Resend) and, when AI features are used, the AI provider (Anthropic or OpenAI) which receives only the text or images needed for that request — and with authorities when the law requires it.

5. Storage and security

Data is stored on servers in [India / region], encrypted in transit, with role-based access, audit logs and daily backups. Partner and employee documents are kept in private storage visible only to authorised people.

6. How long we keep it

Account and billing records for as long as the account is active and then as required by tax law ([8] years for invoices). Partner documents for the contract period plus [3] years. Rejected partner applications are deleted after [6] months.

7. Your rights

You can ask to access, correct or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance. Write to our Grievance Officer: [name], [email], [address]. We respond within [7] days. You may also approach the Data Protection Board of India.

8. Children

Hotelat is a business tool and is not meant for children.

9. Changes

We will post updates here and tell account owners about important changes by email.