Privacy Policy

1. Who we are

TummyStay (“TummyStay”, “we”, “us”) makes software for hotels, resorts and restaurants: a property management system (PMS), restaurant point of sale (POS), a captain (waiter) app, a channel manager connected to online travel agencies, finance, payroll and attendance tools, the booking website at booking.tummystay.com, the TummyStay desktop app and the owner’s merchant app (together, the “Services”).

This policy is written to meet the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023.

2. Our role: hotel data vs our data

There are two kinds of personal data in TummyStay, and we treat them differently.

• Data a hotel or restaurant keeps in TummyStay — its guests, bookings, bills, staff and attendance. The hotel decides what to collect and why; it is the data fiduciary (controller). TummyStay stores and processes that data only on the hotel’s instructions, to run the Services for it. Guests who want to see, correct or delete what a hotel holds about them should contact that hotel first; we help the hotel answer.
• Data about our own customers and website visitors — the owners and staff who sign up, the people who ask for a demo, and guests who book through our booking website. For this data TummyStay is the data fiduciary.

3. What we collect

From our customers (hotel and restaurant owners and their staff)

• Name, mobile number, email, business name and address, GSTIN, PAN and bank details given for billing.
• Login details: username, password (stored only as a one-way hash), approval PIN (hashed), the hotels a user may open, and the user’s role.
• Records of what each user did in the software — for example who edited a bill, who approved a discount, who changed a rate — so that the business can trust its own figures.

Data a hotel or restaurant enters about its guests and staff

• Guest name, mobile, email, address, nationality, booking and stay details, bills and payments.
• Identity documents a hotel records at check-in as Indian law requires (for example an Aadhaar or passport image, and Form C details for foreign guests). Hotels can choose to read the Aadhaar QR code to fill the form; the number is shown masked where the law asks for it.
• Staff details for payroll and HR letters, and attendance records. Where a hotel uses face attendance, a photo and a face template are stored to recognise the employee at the kiosk; they are used only for attendance.

From guests who book on booking.tummystay.com

• Name, mobile, email, stay dates, number of guests, special requests and payment status. Card and UPI details are entered on the payment gateway’s page; we never see or store full card numbers.

From devices and apps

• Technical data such as IP address, browser and device type, app version and error logs, used to keep the Services working and secure.
• If you turn on phone notifications in the merchant app, the push address your browser gives us. The notification itself carries no bill or guest details; the app fetches them after you open it.
• The camera is used only when you start a feature that needs it (face attendance, scanning a captain’s QR code or a guest ID).

4. How we use it

• To provide the Services: bookings, billing, KOTs, printing, reports, payroll, the booking website and the apps.
• To send what a hotel asks us to send for it — booking confirmations, bills, receipts, WhatsApp or email messages to its guests, and approval requests to its owner’s phone.
• To bill our customers, send invoices and renewal reminders, and give support.
• To keep accounts safe: sign-in checks, limiting repeated wrong passwords or PINs, and investigating misuse.
• To improve the software, using usage patterns and error reports. We do not sell personal data and we do not use a hotel’s guest data for our own marketing.
• To meet legal duties, such as tax records and lawful requests from authorities.

5. Who we share it with

We share personal data only as far as needed for the purpose, and with service providers bound to protect it:

6. Cookies and devices

We use cookies and similar storage that the Services need to work: keeping you signed in, remembering the hotel you chose, and remembering screen settings such as light or dark mode. We do not use advertising cookies. If you block cookies, signing in will not work.

7. How long we keep it

• A hotel’s data is kept while its subscription is active. When a customer leaves, it can ask for an export of its data; after that we delete it or anonymise it, except what we must keep by law.
• Billing and tax records are kept for the period Indian tax law requires (generally eight years).
• Activity and security logs are kept for as long as they are useful for security and audit, and then deleted.
• Booking-website records are kept as long as the hotel and tax law need them.

8. How we protect it

• All traffic to our websites and apps uses HTTPS.
• Passwords and approval PINs are stored only as one-way hashes. Secrets such as payment-gateway keys are stored encrypted.
• Each hotel sees only its own data; users see only the hotels and screens their role allows; important changes are recorded with who made them.
• Repeated wrong passwords and PINs are slowed down or locked out.
• Backups are taken regularly.

No system is completely secure. If a breach affects personal data, we will inform the affected customers and the authorities as the law requires.

9. Your rights

Subject to the law, you can ask us to:

• tell you what personal data we hold about you and how it is used;
• correct or complete data that is wrong;
• erase data we no longer need or have no right to keep;
• withdraw a consent you gave (this does not affect what was done before);
• nominate another person to act for you in case of death or incapacity;
• hear and resolve a complaint (see the grievance officer below).

If your data was entered by a hotel or restaurant (for example as its guest or employee), please contact that business; we will help it respond.

10. Children

The Services are for businesses and are not meant for children. Hotels may record children travelling with a guest as part of a booking; that is handled under the hotel’s responsibility and the guest’s consent.

11. Where data is stored

Data is stored on servers run by our hosting providers. Some providers (for example email, messaging or network services) may process data outside India. Where that happens we use providers who protect it to standards at least as strong as this policy and as Indian law requires.

12. Changes to this policy

We may update this policy as the Services or the law change. The date at the top shows the latest version. If a change is significant, we will tell our customers by email or inside the software before it takes effect.

13. Contact & grievance officer

For any question about privacy, a request about your data, or a complaint, write to our grievance officer:

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India once it is in operation.