Privacy policy

Last updated: 10 October 2026

Jannal is a property management system (PMS) for homes, resorts and small hotels in India. It is a product of AAROORA Technologies, the trade name of Ganeshkumar N (sole proprietor), First Floor, 1/716H, Melakkal Main Road East Street, above Federal Bank, Thuvariman, Madurai, Tamil Nadu 625019, India (“AAROORA Technologies”, “we”, “us”). This policy explains what personal data we handle in the Jannal web app (app.jannal.com), the Jannal mobile apps, the guest pages for each booking (stay.jannal.com) and this website (jannal.com), why, who we share it with and how long we keep it. It is written to meet India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000. A shorter, plain-language version is in our DPDP notice.

1. Two roles: whose data, and who decides

Jannal handles two kinds of personal data, in two different roles:

• Our customers — property owners and their staff. We decide why and how this data is used, so for it we are the data fiduciary under the DPDP Act.
• Guests of the properties that use Jannal. The property decides what to collect from its guests and why (for example, to check them in and to meet its legal duties). The property is the data fiduciary for its guests; we process guest data on the property's behalf and on its instructions, as its data processor. Guests should contact the property first about their data; we will help the property respond.

2. Property owners and staff

What we collect

• Account: mobile number (used to sign in by OTP), name, and optionally email and a profile photo; your role at each property.
• Business details: property name, address and location, GSTIN and tax settings, UPI ID, rooms, rates, photos and other setup you enter.
• Billing: your plan, trial and subscription status, and payment references from Razorpay (not card or bank details).
• Usage and device data: an audit trail of changes made in the app (who did what and when), push notification tokens for your devices, and technical logs (IP address, browser or app version, errors) kept by our hosting providers.
• Messages: what you send us on WhatsApp or email.

Why we use it

• To create and secure your account, and send you sign-in codes by SMS.
• To provide Jannal: bookings, check-in, folios and invoices, channel manager, guest pages.
• To run your trial and subscription, and to send service notices (for example, billing reminders and alerts about the service).
• To support you, fix problems, keep the service secure and prevent misuse.
• To answer your messages and, where you agree, tell you about Jannal.
• To meet legal duties, such as tax and accounting records.

We rely on your consent, given when you sign up and accept our terms, and on the legitimate uses the DPDP Act allows (for example, data you give us voluntarily for a purpose, and compliance with law). We don't sell personal data and we don't use it for advertising.

3. Guests (processed for the property)

What the property may record in Jannal

• Booking details: name, mobile number, email, address, nationality, dates, rooms, number of guests, notes and special requests; for OTA bookings, the details the OTA (Booking.com, MakeMyTrip, Airbnb, Agoda) passes on through our channel manager.
• Identity document: the ID type (for example Aadhaar, passport, driving licence) and only the last four characters of the ID number. Jannal never stores the full ID number.
• ID photos (front/back of an ID, or passport and visa pages), if the guest or staff upload them. These are kept in private storage and opened only through short-lived signed links by the property's staff.
• Form C details for foreign nationals, which Indian law (the Foreigners' registration rules) requires accommodation providers to report: passport number, expiry and place of issue, visa type, number and expiry, date of birth, arrived from, port of arrival, next destination and purpose of visit. The property files Form C with the authorities; Jannal holds the details so the property can do so.
• Stay records: folio (bill) lines, payments recorded, tax invoices, orders and service requests made from the guest page.
• Guest page session: when a guest signs in to the guest page with a phone OTP (or the booking surname), a session key, stored only in hashed form, valid until the link expires.

How guest data flows

• Each booking has a guest page link (stay.jannal.com/s/…) that stops working the day after check-out. The property shares it with the guest, usually on WhatsApp from a staff member's own phone. Jannal does not send WhatsApp messages automatically.
• Guests can check in online, order and make requests there. What they enter goes to that property only and is seen by its staff.
• Only signed-in staff of that property can see its guests. Guests never get direct access to the database; every guest action goes through a check that links the page to that booking only.

4. Who we share data with

We use the service providers below (“sub-processors”) to run Jannal. Each gets only what it needs for its job and is bound by contract to protect it.

When a property connects an OTA, booking and guest details pass between the OTA, our channel-manager provider and Jannal so the booking appears in Jannal; the OTA's own privacy policy applies to what the guest gave the OTA. We may also disclose data when the law requires it (for example, to a court or a government authority with a valid request), or to protect the safety of people or the service. If AAROORA Technologies' business is transferred, data would move to the new owner under this policy.

5. Where data is stored

Our main database and files are hosted by Supabase in Southeast Asia. Some providers above may process data outside India. We transfer data abroad only as the DPDP Act permits and not to any country the Government of India restricts.

6. How long we keep data

• Your account: while it exists. You can delete your account yourself in the app's account settings. Your sign-in, profile and memberships are removed; bookings and invoices you made stay with the business, without your name attached as their author.
• A business whose only owner deletes their account is closed: everyone else loses access straight away and its records, invoices included, are kept for 8 years from the day it closes (tax records must be kept for 72 months after the annual return is due), then deleted automatically with its files.
• A lapsed subscription does not delete anything: 7 days after an unpaid trial or period ends the property becomes read-only, and its data is kept so you can resume.
• Guest records are kept as long as the property keeps them. Tax invoices and folios must be kept for the period GST law requires.
• ID photos are kept until the property deletes them. The property's staff who manage bookings can delete a guest's ID photos at any time, and owners can delete in one go all photos from stays that ended more than a chosen number of days ago. There is no automatic deletion today; we encourage properties to delete ID photos once they no longer need them.
• Guest page links and sessions stop working the day after check-out.
• Backups and logs are kept for 30 days and then overwritten.

7. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting provider. Access is controlled per property and per role in the database itself (row-level security), ID photos sit in a private bucket reachable only through short-lived signed links, sign-in is by OTP with rate limits, and changes are recorded in an audit trail. No system is perfectly secure; if a personal data breach happens we will inform the Data Protection Board of India and affected people as the DPDP Act requires, and the properties concerned for their guests' data.

8. Your rights

Under the DPDP Act you have the right to:

• get a summary of your personal data we process and who we have shared it with;
• have inaccurate or incomplete data corrected or completed, and have it updated;
• have your data erased when it is no longer needed, unless the law requires us to keep it;
• withdraw consent at any time (this does not affect what was done before you withdrew);
• nominate another person to exercise your rights if you die or become unable to;
• have your grievances addressed by our Grievance Officer, and then by the Data Protection Board of India.

Owners and staff can see and correct most of their data in the app, and delete their account there. For anything else, email us (below). Guests should contact the property they stayed with; if you write to us we will pass your request to the property and help it respond. See the DPDP notice for how and how fast we respond.

9. Children

Jannal accounts are for businesses and their staff, who must be 18 or older. Properties may record children who stay as guests as part of a booking made by an adult; the property is responsible for any consent required from a parent or guardian.

10. Cookies and analytics

This website does not use advertising or tracking cookies. If analytics is switched on, we use Plausible, which counts visits without cookies or personal profiles. The Jannal app and guest pages use storage in your browser or phone only to keep you signed in and remember your settings (for example, the guest page remembers its session and cart).

11. Changes

We will post any changes here with a new date, and tell account holders in the app or by SMS or email before a significant change takes effect.

Contact

AAROORA Technologies (Ganeshkumar N, sole proprietor), First Floor, 1/716H, Melakkal Main Road East Street, above Federal Bank, Thuvariman, Madurai, Tamil Nadu 625019, India. Email hello@aaroora.com. Grievance Officer: Ganeshkumar N, hello@aaroora.com.