Privacy Policy

Last updated: 4 October 2026

This policy explains what information HotelOps AI ("we", "us") collects when a hotel and its staff use the service, why we collect it, and what you can ask us to do with it. HotelOps AI is operated by [legal name of the operating company], [registered address].

Who is responsible for the data

A hotel's business data (its night-audit reports, figures, budgets and workbooks) belongs to the hotel. The hotel decides what goes into HotelOps AI, and we process it only to provide the service to that hotel. For the account details of the people who sign in, we are responsible for how they are handled.

What we collect

Account details: your name, work email address, the hotel you belong to and your role (admin or viewer). Passwords are stored only as a one-way scrypt hash. We cannot read them.
Hotel registration details: the hotel's name, brand and hotel code.
Hotel business data: the reports you upload or send to the hotel's inbox (for example the Opera Manager Flash, Trial Balance and Micros Cover Statement), the figures taken from them, figures typed in by hand, transaction-code mappings, and the reports and workbooks we produce.
Activity records: an audit log of sign-ins, uploads, typed figures, approvals and team changes, each with the user and the time.
Assistant conversations: the questions you ask the AI assistant and its answers, for as long as the conversation is open.

We don't ask for guest data. The night-audit reports HotelOps AI reads are summary reports. Please don't upload reports that list individual guests.

How we use it

To sign you in, keep your hotel's data separate from every other hotel's, and enforce who can see and change what.
To read the hotel's reports, check them, and produce its dashboard, daily report and workbooks.
To send emails the service needs: verifying your address, invitations, password resets and approval notices. We don't send marketing email.
To keep an audit trail, so a hotel can see who changed what, and to protect the service against misuse, for example by limiting repeated failed sign-ins.

We don't sell your data, use it for advertising, or combine one hotel's data with another's.

Who we share it with

We use a small number of service providers, only for the purposes above:

Railway hosts the application and stores its data. Vercel serves the website address and passes requests on to Railway.
Anthropic provides the AI model behind the assistant. When you ask the assistant a question, the question and the relevant figures from your hotel's reports are sent to Anthropic to produce the answer. Under Anthropic's commercial terms, data sent through its API is not used to train its models.
Resend delivers the service's emails and receives the recipient's address and the message.

These providers may process data outside India, including in the United States. We will also disclose information if the law requires it.

Cookies and browser storage

We use one essential cookie to keep you signed in. It expires after 8 hours. The site also remembers your light or dark theme choice in your browser. We don't use advertising or tracking cookies, or third-party analytics.

How long we keep it

A hotel's business data and audit log are kept while the hotel uses the service, so that month-to-date, year-to-date and last-year comparisons keep working.
If a hotel closes its account, we delete its workspace within [30] days unless the law requires us to keep something longer.
Links sent by email expire: verification links after 48 hours, invitations after 7 days and password-reset links after 2 hours.
The record of failed sign-in attempts, including the IP address, is held in memory for a few minutes only and is never saved.

Security

Each hotel's data is kept in its own separate workspace. Sign-in uses hashed passwords, secure cookies and rate limiting, and links sent by email are single-use. Hotel admins can switch off a colleague's access at any time, and that signs them out immediately. No system is perfectly secure. If we learn of a breach affecting your data, we will tell the affected hotel and, where required, the authorities.

Your rights

You can delete your own account at any time under My account, and a hotel admin can ask for the whole hotel to be deleted there too. You can also ask to see, correct or delete your personal data, or withdraw from the service. Under India's Digital Personal Data Protection Act, 2023, and other laws that apply to you, you may also have the right to nominate someone to act for you and to raise a grievance. Requests about a hotel's business data should come from that hotel's admin. Contact us at [contact email], and we will reply within [30] days.

Changes to this policy

If we change this policy, we will update the date above and, for significant changes, tell hotel admins by email before the change takes effect.

Contact

Questions or grievances: [contact email], [grievance officer name, if required].