Privacy Policy

Two organisations are involved, and it matters which is which.

The property you booked — the hotel or guest house whose name appears on your booking, your invoice and your check-in page — decides what to collect about you and why. Under India's Digital Personal Data Protection Act 2023 they are the Data Fiduciary. Your booking is with them.

Innloop, operated by Innloop Technologies (a proprietorship of Sanjayan Rajamma Sivanandan), provides the software that property uses. We hold and process the data on their instructions, as a Data Processor. We do not decide what a property collects, we do not use guest data for our own marketing, and we do not sell it to anyone.

If you are a guest with a question about your own information, the property is the right first contact — their phone number and email are printed on your invoice. If they need our help to answer you, they can reach us using the details at the bottom of this page.

Depending on how you booked and what the property asked for, we may hold:

• Your booking — name, dates, room, rate, the amount paid and outstanding, and the source of the booking.
• Contact details — mobile number, email address and postal address, used to confirm the booking and to send you your invoice.
• Photo ID — the ID type, its number, and a photograph of it, where the property has asked for one. Hotels in India are required to record a photo ID for every guest at check-in, and to keep the registers that law requires. For foreign nationals this also includes the Form C details the property must file.
• Payments — the amount, date and method (cash, UPI, card, bank transfer). We do not store card numbers. When online payment is available it is handled by a licensed payment gateway, and the card details go to them, never to us.

You are never obliged to send your ID through a link. The upload page exists to save you time at the desk. You can decline it and present your ID in person instead.

• ID photographs are kept only for as long as they are needed — for the stay itself, and afterwards for the registers a property must keep and any query a police or local authority may raise about a past guest. Once they are no longer required, they are deleted.
• Booking, invoice and payment records are kept for as long as tax and accounting law requires them to be kept, because they are financial records of the property's business.
• Where a property is legally required to retain a register for longer than the periods above, that legal requirement takes precedence.

We expect to state a fixed retention period here as the DPDP Rules' substantive obligations commence in May 2027. If you would like your ID photograph removed sooner, ask the property, or write to us at the address below.

Under the Digital Personal Data Protection Act 2023 you can ask to:

• see what personal data is held about you and how it has been used;
• have anything inaccurate corrected or completed;
• have your data erased, where no law requires it to be kept;
• nominate someone to exercise these rights on your behalf; and
• raise a grievance, and have it answered.

Ask the property first — they hold the relationship with you. If you cannot reach them, or they cannot resolve it, contact us at the address below and we will help. We aim to respond within fourteen days.

• All connections to Innloop use HTTPS. Data is encrypted in transit.
• Staff sign in with their own individual username and password. Passwords are stored hashed, never in plain text, so nobody — including us — can read them back.
• Each staff account can only see its own property. A guest link, such as an invoice or an ID upload, works only through a long unguessable token for that one booking, is not indexed by search engines, and gives no access to anything else.
• Data is held in a managed database in Singapore, with copies kept for recovery.

No system is perfect. If a breach affecting personal data occurs, we will inform the affected property and support them in notifying guests and the Data Protection Board as the law requires.

Your guests' data is yours. We hold it to run the software for you, and for no other purpose. Specifically:

• we do not use your guest data to market to your guests, or to anyone;
• we do not sell it, and we do not share it with other properties;
• only your own staff accounts can see your property's data;
• if you stop using Innloop, you can ask us for an export of your data, and for it to be deleted from our systems.

Information about your own business — your property's name, description, photographs, rates and availability — is different from guest data. We may use it to list and promote your property through Innloop's own booking channels, which is the point of publishing it. Guest personal data is never used this way.

Innloop sets a small number of cookies that are strictly necessary: one that keeps a staff member signed in to the PMS, and short-lived ones that keep a form working while it is being filled in. We do not use advertising cookies and we do not track guests across other websites.

Questions about this policy, or about your own data, go to:

Sanjayan RS
Innloop Technologies, a proprietorship of Sanjayan Rajamma Sivanandan (GSTIN 32AJXPS4853P2Z3)
BRRA113, Udaybhanu Lane, Kumarapuram, Thiruvananthapuram 695011, Kerala, India
info@innloop.in · 9422300047

If you are not satisfied with our response, you may raise the matter with the Data Protection Board of India.

India's DPDP Rules 2025 phase in over 2026 and 2027, with the substantive obligations commencing on 13 May 2027. We expect to update this page as those provisions come into force, and as Innloop itself changes. The date at the top always shows when it was last revised.