Draft: needs legal review
Data processing note
Last updated 27 October 2026
This text is a working draft written for the pilot. It is not legal advice and has not been reviewed by a lawyer. Do not rely on it until it is reviewed and approved.
1. Roles
The hotel is the Data Fiduciary for guest and staff data it enters in HotelOS. HotelOS processes that data only on the hotel's instructions, as its Data Processor under section 8 of the DPDP Act.
2. Instructions
We process data to provide the modules the hotel switches on, and for nothing else. We do not sell data and do not use guest data to train AI models.
3. Sub processors
We use hosting, database, messaging and payment providers listed at [sub processor list]. We tell the hotel 30 days before adding one, and each is bound by terms at least as protective as these.
4. Security measures
Encryption in transit and at rest, row level security per hotel, duty based access, audit logs, backups, and access by our own team only when needed for support and logged.
5. Help with rights and breaches
We help the hotel answer requests from guests and staff, and we tell the hotel without delay, and within [72] hours, about any breach we find.
6. End of service
When the agreement ends we return the data as an export and then erase it within 60 days, except copies the law requires us to keep.
7. Audits
On reasonable notice, once a year, the hotel may ask for our security summary and answers to a written questionnaire.