Privacy Policy
Draft. These terms have not been legally reviewed and aren't in force yet.
Who this covers
For guest data, the hotel or guest house is the data controller and Ayra Ventures Private Limited is its processor. Guests should contact the property first about their data.
For the accounts of people who use the service, Ayra Ventures Private Limited is the controller.
What is collected
Account data: name, email, password (stored hashed), staff PIN (stored hashed), the property's details, and records of sign-ins.
Guest data, entered or scanned by property staff: passport image and details, contact details, stay details and notes.
Activity records: who viewed, edited, exported or downloaded guest data, with time, IP address and browser.
Payment records: the property name, the email of the person who paid, the pack, amount, date and bank reference. Card details are entered on the bank's page, and we never see or store them.
Our own staff can see each property's details, its owners' and managers' contact details, its credits and its payments, so we can run the service and help you. They can't open guests, passports, scans or check-ins through the service, and everything they do there is recorded.
How guest data is protected
Passport images are kept in private storage and opened through links that expire after 5 minutes. Passport numbers and scan data are encrypted in the database. Each property's data is kept separate, and nobody outside a property can open it through the service.
Who else handles data
Google Cloud Vision reads the text on passport photos.
Cloudbeds, or another system a property chooses to connect, receives guest details when staff send them.
Bank of Maldives processes card payments.
Cloudflare Turnstile protects sign-in and sign-up forms.
[Confirm before launch: hosting and file storage provider, email provider, and error monitoring provider, with their locations.]
How long data is kept
Each property sets its own retention. By default, passport images, PDFs and raw scan data are deleted after 90 days and the guest's details are kept until the property deletes them. Database backups are kept for 14 days. Payment records are kept for our accounts even after a property is deleted, without any guest data.
Your rights
Depending on where you live, you may have the right to see, correct, export or delete your data, or to object to how it is used. Guests should ask the property, which can export or permanently delete their record. [Add the relevant supervisory authority.]
Contact
Ayra Ventures Private Limited, 4A, G. Handhuvary Gulshan 1, Lonuziyaaraiy Magu, Malé 20143, Republic of Maldives. Email support@passportscan.io.