StayZeloPrivacy Policy
- Effective date
- 2 November 2026
- Last updated
- 2 November 2026
This Privacy Policy explains how StayZelo (“StayZelo”, “we”, “us” or “our”) handles personal data in connection with the website at stayzelo.com, the StayZelo mobile application for guests, and the StayZelo Staff mobile application for property owners and staff (together, the “Service”). By using the Service, you acknowledge the practices described in this Policy.
1. Definitions
1.1In this Policy:
- “Property” means a hotel, resort or similar business that uses the Service;
- “Owner” means the person who holds the administrator account for a Property;
- “Staff” means a person whom an Owner has registered to use the Service for a Property; and
- “Guest” means a person who uses the Service during a stay at a Property.
2. Our role and the role of Properties
2.1Guest data. The Property decides which Guests use the Service and enters their details. The Property is responsible for that data, and we handle it on the Property’s behalf.
2.2Account and website data. We decide how Owner and Staff account data, billing records and website enquiries are handled for operating the Service, and we are responsible for that processing.
2.3A Property’s own privacy practices apply to the information it holds outside the Service.
3. Personal data we process
3.1We process the following categories of personal data:
| Who | Data |
|---|---|
| Guests, entered by the Property | Name and mobile number; room; check-in and check-out details; number of adults and children; notes added by the Property |
| Guests, entered by the Guest | Name at sign-in; requests, chat messages and replies; ratings and feedback |
| Guests and Staff | Call details: participants, department, time, duration and outcome |
| Owners | Name, mobile number, email, Property details, and billing and payment records |
| Staff, entered by the Owner or the Property | Name, mobile number, Property, department and role |
| Staff, from use of the application | Duty status and activity in the application |
| All application users | Device notification token, device and application information, crash reports and diagnostics |
| Website visitors | Correspondence you send us by WhatsApp, telephone or email, and technical request logs |
3.2How we use this data. We use this data to provide, secure, support and bill for the Service.
3.3Guest mobile numbers. Guests do not give us their mobile number. The Property enters it at check-in, and the sign-in code is sent to that number. A Guest signing in enters only their name and that code.
3.4Call audio. Call audio passes through our calling provider so that the call can take place. We do not record call audio.
3.5Sensitive information. We do not ask Guests for passport details, identity documents or payment card numbers. Anything typed into a message is stored as part of that message, so you should not send such information through the Service.
3.6No sale or advertising. We do not sell personal data, use messages for advertising, or share personal data with third parties for their own marketing.
3.7Cookies. The website does not set advertising, analytics or tracking cookies. If this changes, we will update this Policy before doing so.
4. Device permissions
4.1The applications request the following permissions, which you can manage in your device settings:
- Camera, only to scan QR codes. Images are not stored or sent to us by this feature;
- Microphone, only during voice calls; and
- Notifications and call display, to alert you to messages and show incoming calls, including on a locked screen.
5. Service providers and data transfers
5.1We use the following service providers to operate the Service:
| Provider | Role | Location |
|---|---|---|
| Amazon Web Services | Application backend, database, logs and website hosting | Primary region Mumbai, India; website delivered through a global network |
| Google Firebase | Chat database (Firestore), sign-in, notifications and crash reporting | Chat database in Mumbai, India; other services may operate globally |
| LiveKit Cloud | Voice call connection | May operate outside India |
| MSG91 | Delivery of sign-in codes | As operated by the provider |
5.2Personal data may therefore be processed outside India.
5.3We may disclose personal data where we are required to, or where needed to protect the security of the Service or the rights of any person.
5.4Business transfers. If the operation of the Service is merged, acquired, sold or otherwise transferred, including to a newly formed company, personal data may pass to the new operator, which will remain bound by this Policy until it is changed under section 10. We will notify Properties of the transfer.
5.5Third-party links. The website and applications may link to services we do not operate, such as WhatsApp. Those services have their own privacy policies, and we are not responsible for how they handle your data.
6. Retention
6.1We keep personal data for the following periods:
| Data | Period |
|---|---|
| Stay records, requests, chats, feedback and call details | While the Property’s account is active, unless deleted earlier under section 8. There is no fixed automatic deletion period. |
| Sign-in code records | Codes expire within minutes; records are removed automatically, generally within about 24 hours |
| Server logs | About 1 month |
| Data in a closed account | Erased within 30 days after an Owner’s deletion request, unless the Owner restores the account during that period |
| Backups | Erased data may remain in backups for up to about 35 days |
| Billing and payment records | As long as needed for financial records, including after account deletion |
7. Security
7.1We use reasonable safeguards to protect personal data. Data is encrypted in transit between the applications and our service providers and encrypted at rest in our hosted databases, and access is limited to authorised Property users and to personnel who need it to operate and support the Service.
7.2Messages and calls are not end-to-end encrypted. They can be processed by our systems and service providers in order to deliver the Service.
7.3No system is completely secure, and we cannot guarantee absolute security.
7.4If we become aware of a personal data breach, we will notify affected Properties and, where appropriate, affected individuals.
8. Access, correction and deletion
8.1You may ask us for a summary of your personal data, or ask us to correct or erase it, by contacting us as set out in section 11.
8.2Guest details are entered and held for the Property. Guests may ask the Property they stayed at, or us, and we will work with the Property on the request.
8.3Steps for deleting an account or requesting deletion of personal data are set out on our Delete Account page. We may keep billing records and data we need to resolve disputes.
9. Children
9.1The applications are intended for adults aged 18 or over. We do not knowingly collect personal data directly from children. A Property may record the number of children in a stay; that count does not identify a child.
10. Changes to this Policy
10.1We may update this Policy. The updated version will show a new “Last updated” date, and we will notify Properties of material changes.