Privacy policy
What personal information we collect, why we use it, who we share it with and the choices you have.
Last updated
Draft for review. Have your legal adviser review this page before relying on it.
This policy explains how [company legal name], of [registered address] ("we", "us"), handles personal information in connection with RoomAnchor.
Two different roles
- Our customers and website visitors. When you visit our website, ask for a demo, sign up or pay for a plan, we decide how your information is used. We are the controller.
- Guests and staff of our customers. When a hotel uses RoomAnchor to manage bookings, guests and staff, the hotel's organisation decides how that information is used. The organisation is the controller and we process the information on its behalf. If you are a guest, please contact the property you booked with first. We will help them answer your request.
Information we collect as controller
| What | Examples | Why |
|---|---|---|
| Contact and enquiry details | Name, email, phone, company, property type, number of rooms, city, message | To reply to enquiries, arrange demos and send updates you asked for |
| Account details | Name, email, password (stored as a one-way hash), language, two-factor settings | To create and secure your account |
| Billing details | Plan, invoices, payment status | To bill you and keep financial records. Card details are handled by our payment processor and are not stored by us |
| Usage and security records | Sign-ins, IP address, browser, actions taken in the workspace | To keep the service secure, investigate problems and keep an audit trail |
| Website analytics | Pages visited and how you arrived, such as campaign tags | To understand which pages are useful |
Information we process for our customers
Depending on the modules a hotel uses, this can include guest names, contact details, identification numbers recorded at check-in, stay history, preferences, folio charges and payments, loyalty points, marketing consent, and staff profiles, rosters and timesheets. We use it only to provide the service to that hotel, as described in our data processing agreement.
Identification numbers are encrypted and shown masked to staff who are allowed to see them.
How we protect information
- Data is stored in our hosted database with access limited to authorised staff.
- Connections use HTTPS, sessions are encrypted and security headers are sent on every response.
- Payment gateway and SMS credentials are encrypted at rest and are not shown again after saving.
- Two-factor authentication is available to every user and can be required by an organisation.
- Changes are recorded in an activity log with the user, time, IP address and browser.
- Database backups are taken on a schedule, monitored and cleaned up after their retention period.
- When our support staff sign in to an organisation to help, the session is shown with a banner and written to the audit log.
Who we share information with
We do not sell personal information. We share it only with:
- Payment processors such as Stripe, SSLCommerz and bKash, to take subscription payments or, on a hotel's instruction, guest payments;
- SMS providers such as SSL Wireless and BulkSMS BD, when a hotel sends text messages;
- Email delivery and hosting providers that run the infrastructure for us;
- Channel providers that a hotel connects to, once the channel manager launches, for availability, rates and bookings;
- Authorities, when the law requires it.
Each of these receives only what it needs for its task.
How long we keep information
- Enquiries and demo requests: up to 24 months after our last contact, unless you become a customer.
- Account and billing records: for as long as the account exists, and billing records for as long as tax law requires.
- Customer data: as set out in our terms of service and data processing agreement.
- Backups: overwritten on their normal cycle.
Your choices and rights
Subject to the applicable law of Bangladesh and any other law that applies to you, you can ask to see, correct or delete personal information we hold about you, or object to its use. You can unsubscribe from our emails at any time using the link in each message. Contact us using the details below and we will reply within 30 days.
International transfers
Some service providers may process information outside Bangladesh. When that happens we take reasonable steps to make sure the information stays protected.
Children
RoomAnchor is a business service and is not aimed at children. Hotels may record children as part of a booking; that information is handled for the hotel as described above.
Changes
We will post any changes to this policy on this page and, for material changes, tell customers by email or in the workspace.
Contact
[company legal name], [registered address]. Privacy questions can be sent to the support email shown on our website.