Privacy Policy

This policy explains what personal data HeyKoala collects when you use the Kamra website and our services, why we collect it, and the choices and rights you have. It also explains an important distinction: the guest and staff data inside a hotel's Kamra system belongs to and is controlled by that hotel, and we do not use it for our own purposes.

1. Our role, and the hotel's role

We handle personal data in two different capacities:

• As a controller. For our own website visitors, enquiries and the accounts of the businesses that buy our services, we decide how and why data is used. This policy governs that data.
• As a service provider to hotels. The guest, booking and staff records inside a hotel's Kamra system belong to and are controlled by that hotel. Our role is to provide the Kamra Cloud infrastructure it runs on and, where you use Kamra Cloud, to operate that hosting. We do not access, view, use or retain those guest records for our own purposes. How that data is used is governed by the hotel's own privacy notice, not by this policy. Under India's Digital Personal Data Protection Act the hotel is the Data Fiduciary and we act as its Data Processor.
• Kamra Verify. When a hotel chooses to read a guest's ID document, or check a GSTIN or bank account, through Kamra Verify, we pass that request to our verification partner (Cashfree Payments) on the hotel's instruction and return the result to the hotel. The desk must confirm the guest was told first. We do not store ID images; an Aadhaar number is returned masked to its last 4 digits.

On Kamra Cloud, a hotel's data sits on infrastructure we operate for it, but it stays the hotel's data. Our staff access guest records only if a hotel specifically asks us to help with something that requires it, and only to the extent needed to do so. If you self-host Kamra, we are not involved with your data at all.

2. What we collect

When you visit the website or contact us: your name, email, phone number, country, and the details you choose to share about your property when you submit an enquiry, along with basic technical data such as your IP address, browser and pages viewed.

When you become a customer: the contact and billing details needed to provide and invoice a service, and records of our support correspondence with you.

When we provide Kamra Cloud to a hotel: the hotel's own guest, booking and staff records live inside its Kamra system. We provide the infrastructure it runs on and, if the hotel asks, help load data the hotel gives us. We do not access or use those guest records for our own purposes; we only access them if the hotel asks us to help with something that requires it.

3. How we use it

• to respond to your enquiries and provide the services you ask for;
• to operate, secure, maintain and improve the website and services;
• to invoice, take payment and keep tax and accounting records;
• to send service and security notices, and, where you agree, occasional product updates you can opt out of at any time; and
• to meet our legal obligations and protect our rights.

We do not sell your personal data.

4. Legal bases

India (DPDP Act 2023). We process your personal data on the basis of your consent, given when you contact us, sign up or buy a service, or for a legitimate use the Act allows: where you have voluntarily given us data for a purpose (for example, an enquiry you send), or to meet a legal obligation such as tax records. You can withdraw consent at any time, as easily as you gave it; that does not affect what was done before.

Elsewhere (for example the EU or UK GDPR). We rely on performing our contract with you, our legitimate interests in running and improving our business, your consent where we ask for it, and compliance with legal obligations.

5. Who we share data with

We share personal data only with service providers who help us run our business, under agreements that limit them to that purpose. These include hosting and infrastructure providers, payment processors, email and messaging providers (including the Meta / WhatsApp Cloud API where used), and analytics tools. We may also disclose data where required by law, or to protect our rights, or as part of a business transfer. We do not otherwise share your data.

Today these are: Cloudflare (website delivery and DNS), Hostinger (servers for Kamra Cloud and our services), Cashfree Payments (subscriptions, payment links and Kamra Verify checks), Resend or Brevo (email delivery), Meta (WhatsApp messages, where a hotel turns them on), PostHog (website analytics, where enabled), and the AI provider behind Kamra AI credits. We ask each to protect data at least as well as we do.

6. International transfers

We and our providers may process data in countries other than yours. Where we transfer personal data across borders, we use appropriate safeguards, such as standard contractual clauses, so that it stays protected.

7. Retention

We keep personal data only as long as we need it for the purposes above, or as long as the law requires (for example, tax records). When we host a hotel's Kamra system, guest-data retention follows the hotel's settings and our agreement with it; after a hosted service ends we make data available for export for a reasonable period and then delete it.

8. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, masking of identity numbers, encrypted offsite backups for Kamra Connect, and logs of access to hosted systems kept for at least one year. No system is perfectly secure. If a personal data breach affects you, we will tell you without delay, and report it to the Data Protection Board of India as the law requires; where the data belongs to a hotel, we tell that hotel at once so it can do the same.

9. Your rights

You can ask to see a summary of the personal data we hold about you and whom we shared it with, to correct, complete or update it, to have it erased, and to withdraw consent. Under the DPDP Act you may also nominate someone to exercise these rights for you if you die or become unable to. Where other laws apply you may also have rights to portability, objection and restriction.

Write to our Grievance Officer, Mohammed Azzan, at [email protected]. We reply within 90 days at the latest, usually far sooner. If you are not satisfied, you can complain to the Data Protection Board of India (or your local authority).

If your request concerns data held inside a hotel's Kamra system (for example your stay or ID), please contact that hotel: it is the Data Fiduciary, and Kamra gives it the tools to export or erase your data. We will help it respond.

10. Cookies and analytics

The website uses a small number of cookies and privacy-conscious analytics to understand how the site is used and to keep it working. A first-party kamra_vid cookie powers the site visit counter in the footer. You can control cookies through your browser settings. We do not use advertising trackers.

11. Children

Our website and services are meant for businesses and are not directed at children. We do not knowingly collect personal data from children through the website.

12. Changes

We may update this policy from time to time. When we do, we will change the "last updated" date above, and for significant changes we will give notice through the website or by email.

13. Contact

Grievance Officer: Mohammed Azzan, [email protected].

For any privacy question or request, contact HeyKoala (Koala AI Solutions Private Limited) at [email protected], or by post at 588, 3rd Stage, 4th Block, 10th Main Road, Near CBI, Basaveshwaranagar, Bangalore North, Karnataka 560079, India.