Privacy Policy

1. Who we are and our role

The Vestly is a hotel management and guest-service platform operated by Cubbing Solutions Private Limited, D12, 203, Purvawindermere, Bhavaniamman Koil Street, Pallikaranai, Chennai, Tamil Nadu 600100, India. This policy explains what we collect, why, how long we keep it, and the choices you have.

• For hotel owners and staffwho sign up and use the admin console, we decide how your account data is used. Under India’s Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for it.
• For guests, the hotel you deal with decides what it records about you and why. The hotel is the Data Fiduciary, and we process guest data on its behalf as its Data Processor.

2. Data we process

• Sign-up and workspace— your email address, the hotel’s name and country, its time zone and approximate size, the mobile number you choose to give us so we can help you set up (optional), and a record of when you accepted our Terms and this policy.
• Hotel staff accounts — name, email, phone (optional), role, and activity in the admin console, including an audit trail of changes.
• Plan and payments— your plan, room count, the orders and payments made through Razorpay, the GST tax invoices we issue, and the billing details you give us for them (business name, billing address, GSTIN). Card, UPI and bank details are entered on Razorpay’s checkout and never reach us.
• Guest and stay records — entered by hotel staff or by guests: name, phone number, address, booking and stay dates, and room assignments. Where the hotel uses identity checks, also the ID details and document images that lodging regulations require.
• Orders and billing — service requests, food orders, folio charges, payments the hotel records, invoices and GST details.
• WhatsApp messages— when a guest messages a hotel’s WhatsApp number, we receive and store the message, media, sender number and profile name, so hotel staff can read and reply.
• Booking emails — emails a hotel forwards to its booking-import address, for example confirmations from online travel agencies.
• Technical data — logs, IP address, device and browser information, and analytics events, used to keep the Service secure and improve it.

3. Why we process it

We process this data to:

• provide the Service: stays, orders, billing and messaging;
• create and secure accounts: sign-in codes, bot protection, audit trails;
• run your plan: payments, and trial and renewal reminders;
• send service emails, such as a welcome email and setup tips for new workspaces;
• meet our legal obligations for tax and lodging records;
• improve the product, using usage analytics.

We do not sell personal data, and we do not use guest data for advertising.

4. Where data is stored and how it is protected

The Service’s database and files are hosted by Supabase in Seoul, South Korea, and the application runs on Vercel in the same region. Data is therefore processed outside India, and also by the providers listed below. Each hotel’s data is kept separate from every other hotel’s and protected with row-level security. Staff can only see properties they are assigned to. Data is encrypted in transit, and messaging-channel access tokens are stored encrypted.

5. Processors we use

We share data with these providers only so they can run parts of the Service for us:

A hotel that turns on GST e-invoicing sends its invoices to the e-invoice provider it chooses.

6. How long we keep data

• Workspace and account data, bookings, stays, bills, messages and booking emails are kept while the workspace exists. A trial or paid plan ending does not delete anything: the workspace moves to the free plan with its data intact.
• Identity documentsfollow each hotel’s retention settings. By default, original images are deleted 24 hours after upload, redacted copies after 30 days, and document details after 90 days. A hotel can change these, within limits: up to 7 days for originals, and up to 10 years for redacted copies and details. Consent and verification records are kept as an audit record for as long as the workspace exists.
• Sign-in codes expire after 15 minutes. Guest ID-capture links expire within 7 days.
• When a workspace is deletedat the owner’s request, we delete its data within 30 days, except records the law requires us or the hotel to keep, such as tax records. Those are kept only for the period required.
• Analytics data is kept by PostHog, Google Analytics and Microsoft Clarity under their retention settings.

7. Your rights

You can ask to access, correct or erase your personal data, to withdraw consent where we rely on it, and to nominate someone to act for you. You can also raise a complaint (see Contact us below).

• Workspace owners can request a full data export or the deletion of the workspace from Settings → Property → Your data in the app, or by email.
• Guests should contact the hotel first, because the hotel controls your records. You can also write to us, and we will help or pass your request to the hotel. To request deletion of guest data, including WhatsApp message history, email logesh@cubbingsolutions.com with the phone number or booking reference involved.

We act on verified requests within 30 days, except for records that must be kept by law (for example tax and lodging registers).

8. Cookies

The admin console uses strictly necessary cookies for the sign-in session, the selected workspace and property, and trusted devices. It also uses PostHog, Google Analytics and Microsoft Clarity cookies to understand product usage and how visitors found us. Guest pages use only what is needed to keep a guest’s session working (for example the guest portal and ID-capture sessions). Payment, bot-protection and WhatsApp-connection pages load Razorpay, Cloudflare Turnstile and Meta scripts, which may set their own cookies.

On our website and the sign-up pages, analytics cookies (Google Analytics, Microsoft Clarity, PostHog) are set only after you choose “Accept analytics” in the cookie notice; you can change that choice at any time from “Cookie settings”, and choosing “Decline” also turns them off in the admin console. We always keep one first-party cookie recording the campaign link you arrived from (for example utm_source or an ad click id) for up to 90 days, so we know which campaign brought a signup. It holds no contact details and is not shared.

9. Contact us

For questions, complaints or requests about personal data, or about the Service, contact us:

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Changes

We post updates to this policy on this page with a new effective date. When a change is material, we tell workspace owners and ask them to accept it in the app. See also our Terms of Service and contact details.