Privacy policy

This privacy policy describes how Innfuze (Private) Limited(“Innfuze”, “we”, “us”) processes personal data when you use the Innfuze hospitality operating system, marketing website, and related services (collectively, the “Service”). This policy applies to SaaS customers and their staff — not to guest-facing property websites operated by individual hotels.

Who is the controller?

For account and billing data, Innfuze is the data controller. For guest and staff records your property enters into the Service, your property is the controller and Innfuze acts as a processor on your instructions.

Data we process

Account & billing

• Owner and admin contact details (name, email, phone)
• Property name, subdomain, and configuration
• Payment metadata from Genie IPG (we do not store full card numbers)
• Support correspondence and audit logs

Property operations (as processor)

• Guest profiles, reservations, and folio data you enter
• Staff records, attendance, and payroll inputs
• Inventory, POS, and procurement records
• Email and inbox messages routed through the Service
• Fuze AI queries and responses, subject to role permissions

How we use data

We use personal data to:

• Provide, secure, and improve the Service
• Process subscriptions and send transactional notices
• Respond to support requests
• Comply with law and enforce our terms

We do not sell personal data. We do not use guest PII to train public AI models. Fuze queries are processed to answer your question within your account boundary.

Cookies & analytics

The marketing site sets a theme preference on html and may set geo cookies for localization. The admin application uses session cookies for authentication. We use privacy-respecting analytics only where enabled — details will be listed here before launch.

Sub-processors

The Service runs on Google Cloud / Firebase, Vercel, Resend (email), and payment partners (Genie IPG). A current sub-processor list is available on request at privacy@innfuze.com.

International transfers

Data may be processed in regions where our infrastructure providers operate. We rely on appropriate safeguards where required by applicable law.

Retention

We retain account data while your subscription is active and for a reasonable period afterward for legal and backup purposes. You may export operational data from the admin; deletion requests for closed accounts should be sent to privacy@innfuze.com.

Your rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data. Property guests should contact the hotel directly; account holders may contact us at privacy@innfuze.com.

Data processing agreement

SaaS customers who need a formal DPA for guest data processed on their behalf may request our standard Data Processing Agreement at privacy@innfuze.com. Enterprise plans include DPA execution as part of onboarding.

Changes

We will post material changes on this page and, where appropriate, notify account owners by email. Continued use after the effective date constitutes acceptance of the updated policy.

Questions? Contact us or email privacy@innfuze.com.