Privacy policy

Under the Digital Personal Data Protection Act, 2023, the hotel is the Data Fiduciary for its guests' data: it decides to collect it, and it answers for it. Brandesia LLP, which operates Paperless Check-In, is a Data Processor acting on that hotel's instructions.

For the hotel's own account data — the owner's name, email and phone, billing records — Brandesia LLP is the Data Fiduciary.

Name, date of birth, gender, nationality, address, phone, email where given, the type of identity document and only its last four characters, the room and dates of stay, the purpose of visit, and a photograph of the identity document.

A full Aadhaar number is never stored. When one is typed to verify it, the number is checked in memory and discarded in the same moment; only four digits survive. There is no field anywhere in the system that could hold the other eight.

Every check-in records a consent: what the guest was told, which version of the notice they were shown, how they gave it, and when. A check-in cannot be completed without one. A guest may withdraw consent by asking the hotel.

The photograph is encrypted on the phone that took it, before it is written anywhere. The key that opens it is derived from a passphrase the hotel chooses and which we never receive.

Depending on the hotel's plan, the encrypted file stays on that phone or is uploaded to cloud storage that the hotel owns and connects. In both cases we can move the file and we cannot read it.

One consequence is worth stating: if a hotel loses its passphrase and its recovery key, we cannot recover its photographs. That is not a gap in the service — it is what "only you can read them" means.

Identity photographs carry a retention clock that starts when the guest checks out, set by the hotel and at least 90 days. When it expires the image is destroyed automatically, on the phone and in the hotel's cloud storage.

A record that a document was captured and then destroyed on schedule is kept. That tombstone holds no image and no identity number; it exists so a hotel that followed the rules can prove it, which is impossible if the whole row disappears.

Register entries — who stayed, when, in which room — are retained for as long as the law requires a hotel to hold them.

On servers in India. The platform is deployed in the Bangalore region, and guest data is not transferred outside the country by us. A hotel that connects its own cloud storage chooses where that provider keeps the files.

One hotel can never read another hotel's data. That is enforced by the database itself on every query, not only by application code — a bug in a screen cannot leak another hotel's guests.

Within a hotel: front-desk staff see what they need on the phone; the owner sees the register and reports in the console. Opening a guest's identity photograph requires a stated reason, and every such look is recorded with who, when and why.

Our own staff can reach the infrastructure to keep it running. They cannot read identity photographs, for the reason described above.

We do not sell personal data. We do not use guest data for advertising. We do not use it to train machine-learning models. The text recognition that reads an ID runs on the phone, not on a server, and the image is not sent anywhere to make it work.

Hosting and backups (our cloud provider, in India). Payment processing for subscriptions, where a gateway handles card details and we never see them. Cloud storage chosen and connected by each hotel. Where a hotel enables SMS or identity verification, the vendor for that service. Each receives only what it needs to do its job.

A guest may ask the hotel they stayed with for access to, or correction or erasure of, their data, and may nominate someone to act for them. The hotel is the right first contact; we assist it in answering.

A hotel may export or delete its account data at any time from the console, or by asking us.

If a breach affects personal data we hold, we notify the affected hotels and the Data Protection Board as the Act requires, with what we know and what we are doing about it.

Each hotel names a grievance contact for its guests when it signs up, and it is shown to guests at check-in. For anything about the platform itself, write to Brandesia LLP through our contact page.