Privacy policy

Last updated 1 October 2026

This explains what information Yatraax holds, why, who else sees it, and how to have it deleted. We do not sell personal information, and we do not show ads.

Who is responsible for what

• Resort owners and staff. For the details of the people who sign up and use the staff app, Yatraax decides how the information is used.
• Guests. For guests' information (names, phone numbers, ID photos, bookings), the resort decides what to collect and why. Yatraax stores and processes it on the resort's behalf and only to run the service for that resort. If you are a guest and want to see or remove your information, ask the resort first.

What we hold

• Account details: name, email address, phone number, and a hashed (scrambled) password. We never store your password in readable form.
• Property records: rooms, rates, packages, staff and their roles, tasks, and settings.
• Guest and booking records: names, phone numbers, email addresses, stay dates, notes, payments, extra charges and invoices.
• Online check-in: if the resort uses it, the guest's details, a photo of an ID document, and a signature on the house rules.
• Room-service orders and messages: what guests order, and messages guests send through the guest page or WhatsApp.
• Technical records: sign-in events and basic logs needed to keep the service secure and working.

Who else handles it

We use a small number of other services to run Yatraax:

• Our server. Yatraax runs on a server we operate. The database and uploaded files, including ID photos, are stored there.
• Email. Password-reset emails are sent through Resend. They receive the recipient's email address and the message.
• WhatsApp. If a resort connects its WhatsApp number, messages to and from guests pass through a messaging gateway we run and through WhatsApp itself, which has its own privacy policy.
• Reading menus and sales files. When a resort uses the feature that reads a menu or sales file from a photo, PDF or table, the content of that file is sent to Anthropic's Claude to be read. Nothing is sent unless someone uses that feature.
• Fonts and icons. Our website and app load fonts from Google Fonts and icons from unpkg. Those services see your IP address and browser details when a page loads.

We do not share information with advertisers, and we do not use it to train AI models. We may disclose information if the law requires us to.

Cookies and tracking

The Yatraax staff app stores a sign-in token in your browser so you stay signed in. We do not run advertising trackers on this website or in the app.

How long we keep it

We keep a property's records for as long as the property has an account. Guest ID photos are kept until the resort removes them or the account is deleted, because Yatraax does not delete them automatically. When a property account is deleted, its records are removed from our live systems, and copies in backups disappear as the backups age out. We may keep the minimum records the law requires.

Keeping it safe

Pages are served over HTTPS. Each property can only see its own records, and inside a property, each staff role can only reach what the owner allows. No system is perfectly secure, and if we learn that your information has been exposed in a way that could harm you, we will tell the resort and you.

Your choices

• You can ask to see, correct or delete the information we hold about you. We will answer within a reasonable time.
• A resort owner can ask us to delete the whole property account. There is no delete button in the app yet, so this is done on request.
• Guests can ask the resort to remove their ID photo and details.

Changes

If we change this policy in a way that matters, we will update the date above and tell property owners.