StaySphere is hotel management software used in India and the United Arab Emirates. This policy explains what personal data is involved when hotels use StaySphere, who is responsible for it, and how it is protected. It is written to follow:
- India's Digital Personal Data Protection Act, 2023 (the "DPDP Act");
- the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL").
Country-specific points are in section 12.
1. Who we are
StaySphere ("we", "us") makes hotel management software. Our website is stayspheres.in.
2. Our role: hotel data vs. our own data
There are two kinds of personal data, and responsibility is different for each:
- Data hotels enter about their guests and staff (bookings, stays, bills, ID details). The hotel decides why and how this data is collected, so the hotel is responsible for it: the Data Fiduciary under the DPDP Act, or the Controller under the UAE PDPL. Guests should contact the hotel first about their data.
- Offline (installed) StaySphere: the data is stored only on the hotel's own computer. We do not receive or see it.
- Online (hosted) StaySphere: the data is stored on our servers, and we process it only on the hotel's behalf and on its instructions, as its Data Processor. Our Data Processing Agreement sets out these duties.
- Our own data about the hotels we serve (business contacts, accounts, licences, billing) and about visitors to our website. For this data, StaySphere is responsible (the Data Fiduciary or Controller).
3. What we collect
About hotels and their contacts (our customers)
- Owner and contact details: name, email, phone number.
- Business details: property name, address, GSTIN, and licence or subscription details.
- Payment and invoice records for our fees.
- Messages and support requests, including what you tell us during remote support sessions.
About staff who use StaySphere
- Name, email, phone number, role and branch.
- A record of actions taken in the software (the audit log), such as logins, check-ins and payments, with the time and user.
About hotel guests (entered by the hotel)
- Name, mobile number, email, address, city, state and nationality.
- Identity document type and number, and images of the ID document or the guest's photo if the hotel uploads or captures them.
- Stay details: dates, rooms, people staying, purpose of visit, services used, bills and payments.
- Company name and GSTIN for business guests.
About website visitors
- If you send us a demo, trial or contact request: the name, email, phone number, property name and message you enter.
- Standard server records: IP address, browser type, the page requested and the time. These are kept for security and troubleshooting.
Our website does not use advertising or analytics trackers.
4. How we use it
- To provide StaySphere: running the software, hosting online accounts, licensing and updates.
- To support you: answering questions, fixing problems and setting up your property.
- To bill for our services and keep the records tax law requires.
- To keep StaySphere secure: preventing misuse, investigating problems and keeping audit records.
- To tell you about important changes, such as updates, renewals or security notices.
- To reply to demo, trial or contact requests you send us.
We use guest data only to provide the service to the hotel that entered it. We do not sell personal data, and we do not use guest data for advertising.
5. Who we share it with
- Hosting provider: online accounts run on Amazon Web Services (AWS) servers. See section 6 for locations.
- Services a hotel chooses to connect. These are used only if the hotel switches them on, and the data goes to the hotel's own accounts with those services:
- Google Drive, for Cloud Backup to the hotel's own Google account.
- The hotel's own email server, for notification emails.
- Channel managers such as eZee or STAAH, for online travel agency bookings.
- WhatsApp, when staff choose to share a bill or message.
- Authorities: when the law requires it, for example a valid order from a court, police or tax authority.
- Professional advisers (such as accountants or lawyers), under duties of confidentiality.
- A buyer or successor of our business, who must keep to this policy.
6. Where data is stored
- Offline StaySphere: on the hotel's own computer, plus any backups the hotel makes.
- Online StaySphere: on AWS servers in India (Mumbai), with backups also kept in India.
- UAE hotels using online StaySphere: by default, data is stored in India, which is a transfer of personal data outside the UAE. We make this transfer under the safeguards in our Data Processing Agreement, as the UAE PDPL allows. Where a hotel needs its data kept in the UAE, we can host its account in an AWS region in the UAE on request.
7. How long we keep it
- Customer account data: while you use StaySphere, and afterwards only as long as needed for tax, accounting or legal reasons.
- Hotel data in online accounts: the hotel decides how long to keep its guest records.
- When an online account ends, the hotel can export its data for 30 days. After that we delete it from our servers.
- Copies in our backups are deleted within a further 35 days.
- Server records and website messages: no longer than needed for the purposes above.
8. How we protect it
- Online StaySphere is reached only over an encrypted connection (HTTPS).
- Passwords are stored in a scrambled form (hashed) that cannot be read back, and a default password must be changed at first login.
- Repeated failed logins are slowed down.
- Each staff member has their own login and role, so they see only what their role allows.
- Important actions are recorded in an audit log.
- Online accounts are backed up regularly.
- Only the people who need it for support or maintenance can access our servers.
No system is completely secure. If a personal data breach affects online accounts, we will inform the affected hotels without delay. We will help them meet their duties to inform the authorities and affected people: the Data Protection Board of India under the DPDP Act, or the UAE Data Office under the UAE PDPL.
For offline StaySphere, the hotel is responsible for the security of its own computer and network, including user passwords, antivirus and backups.
9. Your rights
Depending on where you are, you can:
- ask for a summary or copy of the personal data held about you and how it is used;
- ask for it to be corrected, completed or updated;
- ask for it to be erased when it is no longer needed, unless the law requires it to be kept;
- withdraw consent where processing is based on consent;
- raise a complaint with our Grievance Officer, and then with the authority in your country.
Some rights apply only in one country; see section 12.
Hotel guests: please contact the hotel where you stayed, since it controls your data. If you contact us, we will pass your request to that hotel and help it respond.
10. Children
StaySphere is a business tool for hotels and is not meant to be used by children. Hotels may record details of children staying with a parent or guardian, as part of their legal registration duties. The hotel is responsible for doing this lawfully.
11. Cookies and browser storage
StaySphere does not use advertising or tracking cookies. The software stores a small amount of information in your browser to keep you signed in and remember screen preferences, such as your selected branch or bill template. Signing out removes the sign-in information.
12. India and UAE specifics
Hotels and guests in India
- The DPDP Act applies. You may also nominate someone to exercise your rights in case of death or incapacity.
- If we do not resolve a complaint, you can approach the Data Protection Board of India.
- Hotels remain responsible for their legal duties, such as guest registers and reporting foreign guests to the authorities (Form C).
Hotels and guests in the UAE
- The UAE PDPL applies to hotels in the mainland UAE.
- In addition to the rights in section 9, you may:
- ask for your data in a structured, machine-readable form, to move it to another provider;
- object to or restrict certain processing.
- If we do not resolve a complaint, you can complain to the UAE Data Office.
- Hotels in a free zone with its own data law (such as DIFC in Dubai or ADGM in Abu Dhabi) follow that free zone's rules instead. We will work with them to meet those rules.
- Hotels remain responsible for their legal duties, such as registering guests with the relevant tourism or police authority.
13. Grievance Officer and contact
For privacy questions, requests or complaints, contact us:
StaySphere support
sales@stayspheres.in
+971 52 793 6638 (phone / WhatsApp)
We will acknowledge your request and respond within the time the applicable law requires.
14. Changes to this policy
We may update this policy when our service or the law changes. We will change the date at the top. For important changes, we will also tell our customers directly.