Privacy Policy

HotelMantri (operated under Apitide Information Technologies) is a comprehensive cloud-native hospitality management platform. Our services include Property Management System (PMS) operations, Point of Sale (POS) dining operations, Channel Manager integration, Direct Booking Engine, GST invoicing, financial reporting, and automated guest messaging notifications.

This Privacy Policy applies to all interactions with the HotelMantri website (www.hotelmantri.com), the HotelMantri web software application, authorized mobile interfaces, APIs, and integrated communications channels such as WhatsApp and transactional email.

Depending on your interactions with HotelMantri, we process the following genuine categories of personal and operational information:

• Direct Input by Hotel Front Office Staff: During check-in, walk-in reservations, staff management, and daily ledger entry.
• Direct Guest Interactions: When guests complete pre-check-in forms, interact with direct booking links, make payments, or request digital invoices.
• Online Travel Agencies (OTAs): Synchronized automatically via our Channel Manager integration (Aiosell, Channex, Booking.com, MakeMyTrip, Agoda, Expedia) when a traveler books a room online.
• Automated Telemetry: Session cookies and security telemetry captured to maintain authentication and secure multi-tenant isolation.
• Messaging Webhooks: Webhook delivery receipts from the Meta WhatsApp Cloud API / Whinta platform confirming delivery of service slips.

• Front-Office Operations: Room allocation, check-ins, check-outs, folios, and housekeeping schedules.
• Statutory Invoicing: Generating GST tax invoices, calculating tax splits, and preparing daily reconciliation registers.
• Transactional Notifications: Sending automated booking confirmation cards, check-in instructions, digital invoice PDF links, and daily manager reports over WhatsApp.
• Platform Security: Enforcing PostgreSQL Row-Level Security, multi-tenant isolation, and defending against automated brute-force attacks.

HotelMantri processes guest information exclusively as a technology processor under contract with the respective hotel operator. Guest data is segregated inside each hotel's secure partition. HotelMantri never sells, trades, or discloses guest lists to advertising networks.

Guests seeking to view, correct, or delete reservation records should contact the hotel where they stayed, or email our compliance desk at privacy@hotelmantri.com.

HotelMantri integrates with Meta Platforms, Inc. technologies, including the WhatsApp Business Cloud API (operated with Business Solution Provider Whinta).

We do not sell, rent, or trade personal data to third parties.

Legal Disclosures: We disclose information only if strictly required by applicable law, court order, or authorized government regulator (such as tax authorities during GST audits or police guest-record inspections).

• End-to-End Encryption: Modern TLS 1.2/1.3 with HTTPS enforced across all endpoints. AES-256 encryption at rest for databases.
• PostgreSQL Row-Level Security: Strict multi-tenant isolation ensuring properties cannot access another property's records.
• Role-Based Access Control (RBAC): Granular permissions restricting staff access according to job responsibilities.
• Rate Limiting: Automated DDoS and brute-force defenses on authentication and payment endpoints.

Records are retained only for as long as necessary for operational, legal, and tax compliance:

• Active Accounts: Maintained for the duration of the hotel's active subscription.
• Statutory Invoices & Ledgers: Under Section 44AA of the Indian Income Tax Act and Section 36 of the CGST Act, financial records and tax invoices must be preserved for 6 to 8 years. Financial transactions cannot be erased prematurely.
• Non-Financial Contact PII: Purged or anonymized upon validated request.
• Server Access Logs: Rotated and deleted within 30 to 90 days.

Under applicable laws (including India's DPDP Act and international standards), users possess the right to access their information, correct inaccuracies, withdraw optional processing consent, and seek grievance redressal. Requests can be submitted to privacy@hotelmantri.com.

Anyone wishing to delete personal information or opt out of communications can access our dedicated data deletion instructions and interactive submission portal at:

Go to Data Deletion Portal →

Note: Financial records subject to statutory tax retention are restricted rather than erased. Non-financial PII is permanently purged or pseudonymized.

HotelMantri uses strictly essential authentication and session storage required for login tokens and CSRF defense. We do not use third-party behavioral advertising cookies.

HotelMantri operates internationally with physical representation in India and New Zealand. Cloud infrastructure operates in certified facilities adhering to ISO 27001 standards and standard contractual clauses.

HotelMantri is a B2B hotel management platform for commercial hoteliers. We do not knowingly collect personal information directly from minors under the age of 18.

We may update this policy periodically to reflect platform enhancements or regulatory changes. Subscribed administrators will be notified of material changes via email or in-app dashboard notices.