Privacy policy

Who is responsible

For the accounts of hosts and their staff, and for visitors to guestmitra.com, Saralyx Intelligence decides how data is used. For data a property enters about its own guests — bookings, ID proofs, payments — that property is responsible (the data fiduciary), and we process the data on its behalf only to provide the service.

What we collect

• Account data: name, email, mobile number and password (stored only as a secure hash) of property owners and staff; Google sign-in identifier if used.
• Property data: property details, rooms, prices, photos, bookings, invoices, payment records, menus and settings.
• Guest data entered by properties or by guests: names, phone numbers, email, address, people staying, ID proof details and photos, stay dates, requests and food orders, payment screenshots, reviews.
• Messages: enquiries, website AI chat conversations and room-assistant chats.
• Billing data: plan, subscription and payment status from our payment provider. We never see or store full card numbers or UPI PINs.
• Technical data: IP address, browser type and error logs, used to keep the service secure and working.

How we use it

We do not sell personal data and do not use it for advertising.

• To provide the service: bookings, check-in records, invoices, room pages, reminders and alerts.
• To send transactional messages by email, SMS, Telegram or WhatsApp — booking confirmations, payment requests and receipts, check-in and check-out messages, invoices, staff alerts and login codes. We do not send promotional messages without consent.
• To run the AI assistants: chat messages and the property’s own information (rooms, prices, availability, menu, rules) are used to write replies and to pass enquiries and requests to the property.
• ID scan (Premium AI, used only when the property’s staff choose it): photos of a guest’s ID are sent to the AI provider to read the name, ID number and address into the booking form. Staff check the result; the photos are kept only if staff save them as the guest’s ID proof.
• To bill subscriptions, keep the service secure, prevent misuse and fix problems.
• To meet legal obligations, such as GST invoicing and guest-registration rules.

Who we share it with

• The property concerned (for guest data) and its staff logins.
• Service providers that help us run GuestMitra, under confidentiality obligations: cloud hosting and database (Render, Supabase), file storage, email (Google), messaging (Meta’s WhatsApp Business Platform, Telegram, SMS providers), payments (Razorpay — for subscriptions, and for properties that connect their own Razorpay account), and AI (Anthropic, for the chat assistants and the ID scan). AI providers process chat text and ID photos only to produce replies and fill forms.
• Authorities, when required by law.

Where data is stored

Our servers and database are run by cloud providers and may be located outside India (currently in Singapore). Data is protected in transit and at rest by those providers and by the measures below, and transfers follow Indian law.

ID documents

ID proofs uploaded for guest registration are stored privately, are never public, and open only for the logged-in staff of the property concerned, through short-lived links.

How long we keep data

We keep data while the property’s account is active and as long as needed for legal, tax and accounting purposes. Properties can delete guests’ records and documents. When an account is closed we delete or anonymise its data within 90 days, except where the law requires us to keep it.

Your rights

You can ask to access, correct or delete your personal data, or withdraw consent, by writing to us. Guests of a property using GuestMitra can also contact that property directly; we will help it respond. We reply within 30 days.

Security

Data is encrypted in transit (HTTPS), passwords are hashed, payment keys are stored encrypted, private files have restricted access, database access is limited, and backups are kept. No system is perfectly secure; we will inform affected users and authorities of a breach as required by law.

Cookies

We use our own first-party cookies only: to keep you logged in, to remember that a guest unlocked their room page, and — on guestmitra.com, for 60 days — how you first found us (for example a Google search, one of our videos or a leaflet, or a friend's referral link), so we know which of our outreach works. We do not use third-party, advertising or cross-site tracking cookies.

Children

GuestMitra accounts are for adults running a business. Children’s data appears only as guests recorded by a property with their parent or guardian.

Grievance officer and changes

For privacy questions or complaints, write to our grievance officer at the email below. We may update this policy and will change the date above when we do.