Privacy Policy

1. Who we are

Orajic AI Solutions & Automations ("Orajic", "we", "us") builds and operates the Orajic Hotel Management System ("HMS"), software that hotels in India use to manage check-ins, bookings, billing and guest records, and Orajic WhatsApp AI, an assistant that answers a business's customers on WhatsApp (see section 10). We are based in Solapur, Maharashtra, India.

This policy explains what personal data flows through our products and this website, why, how long we keep it, who it's shared with, and your rights under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

2. What personal data we collect

Guest data (collected by hotels through HMS):

• Name, phone number, WhatsApp number, address, nationality, date of birth, gender
• Government ID type and ID / Aadhaar number, stored in full for mandatory guest-registration compliance
• Photographs of the guest's ID card (front and back), a face photo, and a signature
• Booking and stay details (room, dates, charges, companions travelling with the guest)

Hotel account data (owner and staff):

• Names, email addresses, phone numbers, role, and login credentials (passwords are stored only as secure one-way hashes — never in plain text)
• Activity and audit logs of actions taken in the app

Payment data: Hotel subscription billing and any guest advance payments are handled by our payment processor, Razorpay. Card / UPI / bank details are entered on Razorpay's secure systems — Orajic does not see or store full card numbers. We store only a payment reference, status, and the subscription identifiers needed to run billing.

Technical data: IP address, browser/device information, and error/diagnostic logs generated while using HMS.

Website contact form: the name, email or phone number, interest and message you type. We use them only to reply to you about Orajic — they are stored in our database and emailed to our team. We never sell them or add you to a mailing list; email [email protected] to have them deleted.

3. Why we collect it (purpose)

• Legal compliance — Indian law requires hotels to record guest identity (including Aadhaar/ID) and to report guest details to police (e.g. Form C for foreign nationals and state guest-registration rules). HMS exists to help hotels meet these obligations.
• Running the hotel — creating bookings, managing check-in/check-out, rooms, billing and invoices.
• Billing — operating your monthly subscription and processing payments via Razorpay.
• Support, security and improvement — assisting hotels, preventing fraud and abuse, keeping the service reliable and secure.

We do not sell personal data, and we do not use guest ID data for advertising.

4. How long we keep it, and where

Where: Guest and account records are stored in our MongoDB database, and ID images, photos and signatures are stored in private, access-controlled object storage. Both run on our servers located in India. Images are never public — they're served only through short-lived, signed links to authorised users.

How long: We keep guest records for as long as the hotel's account is active and it needs them to meet operational, tax and legal-retention duties (guest-registration records often must be retained under law). For completed stays, the guest's registration details, ID images, photo and signature are deleted automatically about 365 days after check-out, unless the guest has stayed at that hotel again since. When a hotel closes its account, we delete or return its data within 90 days, unless a longer period is required by law.

5. Who we share it with

We share personal data only with service providers that help us run HMS, and only as needed:

Provider	What they process	Why
Google (Gemini Vision API)	The ID/Aadhaar card image at check-in	To read the text off the card automatically (OCR) so staff don't retype it. The image is transmitted to Google for this extraction.
Razorpay	Payment and subscription details	To process subscription auto-pay and any guest advance payments
Resend	Email address + message content	To send transactional emails (welcome, account, receipts)
Sentry	Diagnostic/error data	To detect and fix crashes and errors
Cloudflare	Network/traffic metadata	Content delivery, DNS and basic protection
Meta (Facebook/Instagram)	Website browsing activity via the Meta Pixel — pages viewed, general device/browser info	To measure how our marketing website is doing and show relevant Orajic ads on Facebook and Instagram. Runs only on orajic.com (the marketing website), never inside the hotel app, and never on guest ID data.
Google (Analytics)	Website browsing activity via Google Analytics — pages viewed, general device/browser info, approximate location	To see how many people visit our marketing website, which pages they read, and where they come from. Runs only on orajic.com, never inside the hotel app, and never on guest ID data.

We also disclose data to the hotel that collected it, and to law-enforcement or government authorities where required by law (e.g. police guest-registration / Form C, or a lawful request). We do not currently share guest data with online travel agencies; if we add OTA channel-manager sync in future, we'll update this policy before that goes live.

Because OCR uses Google's API, the ID image is processed on Google's international infrastructure. All other guest data is stored in India.

6. Your rights under the DPDP Act

As a Data Principal (the person the data is about) you may:

• Access a summary of your personal data and how it's processed
• Correct, complete or update inaccurate data
• Erase data that's no longer needed (subject to legal-retention rules)
• Nominate someone to exercise your rights if you're unable to
• Withdraw consent where processing is based on consent
• Raise a grievance and get a response

Guests should first contact the hotel that recorded their data (the Data Fiduciary). For data Orajic controls, or if a hotel is unresponsive, contact our Grievance Officer:

7. Data breach notification

If a personal-data breach occurs, we will act promptly to contain and investigate it, and we will notify the Data Protection Board of India and affected users/hotels without undue delay, in the manner and timelines required by the DPDP Act. Hotels are responsible for onward notification to their guests where applicable, and we will support them with the information they need.

8. Security

We protect data with encryption in transit (HTTPS/TLS), strict per-hotel data isolation, role-based access, hashed passwords, and private storage with signed, expiring links for images. No system is perfectly secure, but we work to keep risk low.

9. Cookies & website analytics

Only with your agreement. When you first visit orajic.com you are asked whether we may use these cookies. Nothing below loads until you tap Accept; Only necessary loads none of it, and the website works fully either way. You can change your choice at any time from Cookie settings (also at the bottom of every page). Cloudflare, which runs our network, may count visits without cookies.

If you accept, orajic.com (this marketing website, separate from our apps) uses the Meta Pixel and Google Analytics to understand which pages people visit, measure how the website is doing, and show relevant Orajic ads to past visitors on Facebook and Instagram. This collects browsing activity on this website and general device/browser information — it does not touch guest ID data, hotel account data, or anything inside HMS itself, which stays ad-free as stated in section 3.

You can opt out of Meta's ad personalisation for your own account at facebook.com/adpreferences, opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on, or block tracking scripts using your browser's privacy settings or an ad blocker.

10. Orajic WhatsApp AI

What is processed:

• Customers of the business: WhatsApp number, the name shown on WhatsApp, the messages they send and the replies they get, and any order or booking they make in the chat.
• The owner's private contacts (family and friends he marks private): the assistant never answers them and their messages are not stored. When the business number is linked to the WhatsApp Business app, WhatsApp shares the owner's saved contacts (name and number); we keep them only so he can pick who is private.
• The business owner and staff: name, phone number, role, the sign-in session on their phone, phone-alert settings, and a history of actions taken.
• The owner's setup chat in the Orajic app: what he types, the words from his voice notes, and the prices read from photos or files he sends. Voice recordings, photos and files are read and then deleted — they are never stored.

Why: to answer the business's customers the way the owner approved, take orders and bookings only if he allowed it, alert the owner, bill the business, and give support. The owner approves what his assistant will say before it answers anyone, and his "never do" rules are enforced by our servers.

Consent in the setup chat: before the setup chat starts, the owner is shown a short notice in English, Hindi or Marathi and must tap "I agree". We keep the date and version of that agreement.

AI services: to write replies, read voice notes and read price lists, messages are sent to AI providers we select, such as Google (Gemini) and OpenRouter and the model providers it connects to. These may process data outside India. We send only what is needed for that one reply.

Who else sees it: Meta, which runs WhatsApp, carries every message. Orajic support can read an owner's setup chat when helping him; every time they open it, this is shown to the owner on his setup screen and written to the business's own history. Our support console cannot read customers' conversations.

How long: the setup chat is deleted automatically 90 days after the owner approves it (an unfinished one after 180 days without activity), and he can delete it himself at any time in the app (what he approved stays live, because it is what his assistant says). Customer chats are kept while the business uses the service. When a business stops using Orajic, it can ask us to delete its data and we do so within 90 days, unless the law requires us to keep something longer.

Customers' choices: a customer can send STOP to stop receiving messages from a business, and START to resume. For access, correction or deletion, customers should first contact the business they messaged; if it does not respond, contact our Grievance Officer (section 6).

11. Children

HMS is used by hotels to serve adult guests. We do not knowingly collect data directly from children; where a minor travels with a guest, they are recorded by the hotel as an accompanying guest under the responsible adult. Orajic WhatsApp AI is meant for adults contacting businesses; businesses using it must not use it to collect children's data without verifiable parental consent.

12. Changes and contact

We may update this policy; material changes will be posted here with a new "last updated" date. Questions or requests: [email protected].