Privacy Policy

Hotel PMS is provided by SP Freelancer and 7 Galaxy Infotech (“we”, “us”). This policy explains how personal data is handled, under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules.

• For the people who use the service for a property — owners, managers and staff — we are the Data Fiduciary.
• For a property’s guests, customers and employees, the property is the Data Fiduciary and we are its Data Processor: we handle that data only on the property’s instructions. Guests should contact the property first about their data.

• Account data: name, email, phone, role, password (stored only as a hash), sign-in codes and device sessions.
• Property data: the business’s name, address, GSTIN, PAN, logo and settings given at registration.
• Data the property enters: guest names, contact details, addresses, stay details, identity documents and photos where the law requires them, bookings, invoices, payments, orders, staff and payroll records.
• Usage and security data: audit trails of who changed what, logs, IP address, browser type and error reports.

• to run the service: sign-in, bookings, billing, reports and the other features a property uses;
• to review and approve new properties;
• to keep the service secure, prevent misuse and investigate problems;
• to send service messages such as sign-in codes, approvals and notices;
• to meet legal duties, for example tax records or a lawful request from an authority.

We process account data on the basis of your consent, given when you register or are invited, and for the legitimate uses the DPDP Act allows (such as meeting legal obligations). You can withdraw consent at any time by writing to us; this stops further processing but does not affect what was done before, and some features may stop working. Properties are responsible for the basis on which they collect their guests’ data.

We do not sell personal data. We share it only with:

• service providers who host, store, back up or email for us, under contracts that protect the data;
• services a property connects itself, such as its email account, WhatsApp Business, payment gateways or channel managers;
• authorities, where the law requires it.

Where data is processed outside India, we do so only as the DPDP Act and government notifications allow.

We use a sign-in cookie and a cookie that remembers your property. The app also keeps some data in your browser — drafts, unsaved invoice rows and offline copies — so work is not lost if the connection drops. We do not use advertising cookies.

We keep data while the property’s account is active. After it ends we keep it for up to 90 days so it can be exported, then delete it, except records the law requires to be kept longer (such as tax invoices) and backups, which are overwritten on their normal cycle.

Each property’s data is kept in its own database. We use encrypted connections, hashed passwords, optional two-step sign-in, role-based access and audit trails. If a personal data breach happens, we will inform the affected property, the Data Protection Board of India and the people concerned as the DPDP Act requires.

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how it is used;
• ask us to correct, complete, update or erase it;
• withdraw consent;
• nominate someone to act for you if you die or cannot act;
• have your grievances addressed (see below).

Write to [legal contact email]. Guests should send requests to the property they stayed with; we will help the property answer them.

Accounts are for adults acting for a business. Where a property records a child’s details as a guest, it must do so with a parent’s or guardian’s consent as the DPDP Act requires.

[Grievance Officer name], SP Freelancer and 7 Galaxy Infotech, [registered address]. Email: [grievance officer email]. We aim to reply within 7 days and resolve a grievance within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

We will post any change here with its date, and tell properties about important changes by email or in the app before they take effect.