Privacy Policy

This policy covers the UnifyStays public website, application, API, documentation and related support communications. For business-account, website and direct-contact data, we decide why and how the data is processed. When a customer sends traveler, guest or booking data through the API, the customer generally determines the purpose and we process that data to provide the service on the customer's instructions. The customer's own privacy notice also applies to that data.

Account and contact data may include your name, work email, organization, role and support communications. Technical and security data may include IP address, device and browser information, authentication events, timestamps, API usage, request identifiers, supplier activity, latency and error logs.

Customer content may include supplier-account configuration, encrypted supplier credentials, request parameters, booking records and traveler or guest details that a customer chooses to submit. Please send only data necessary for an authorized hotel workflow and never place live secrets in support messages.

We receive data directly from you or your organization, automatically when you use the service, from hotel suppliers when responding to authorized requests, and from service providers that help us operate and secure UnifyStays. We do not obtain data from data brokers for advertising profiles.

We use personal data to create and administer accounts; provide supplier connectivity and booking workflows; authenticate and secure access; diagnose requests and supplier failures; provide support; communicate service and legal updates; prevent fraud, misuse and security incidents; improve reliability and product usability; and comply with legal obligations. We do not sell personal data or use customer booking data for targeted advertising.

Supplier credentials are treated as server-side secrets, encrypted before database storage, scoped to the owning organization and environment, and used to make authorized supplier requests. They are not intended to appear in browser code, ordinary API responses or support logs. Customers remain responsible for ensuring that they are authorized to provide and use each credential.

We may disclose data to infrastructure, security, communications and support providers that process it for us under appropriate restrictions; to hotel suppliers and related providers when you direct an API workflow; to professional advisers; in connection with a corporate transaction subject to appropriate safeguards; or to authorities and other parties when required by law or necessary to protect rights, safety and security. We do not allow service providers to use customer data for their own advertising.

UnifyStays connects customers and hotel suppliers that may operate in different countries. Data may therefore be processed outside the state or country where it was collected. Where required, we use contractual, technical and organizational safeguards and comply with applicable transfer restrictions.

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including providing the service, maintaining security and audit records, resolving disputes and meeting legal obligations. Retention periods depend on the type of record, account configuration and contractual requirements. We delete or de-identify data when it is no longer required, unless law requires continued retention.

We use administrative, technical and organizational safeguards designed to protect personal data, including access controls, organization and environment separation, encryption of supplier credentials before storage, and logging practices intended to exclude secrets. No system is completely secure. Report a suspected vulnerability to security@unifystays.com without including live credentials or unrelated personal data.

The public website does not currently use advertising cookies or non-essential analytics cookies. The authenticated application may use cookies or similar storage that are necessary for sign-in, security and session continuity. See our Cookie Notice for details. If we introduce non-essential cookies, we will update the notice and request consent where required.

Depending on applicable law, you may request information about your personal data, correction, completion, deletion, withdrawal of consent or grievance redressal. You may also ask us to identify the business customer responsible for data it submitted. Send requests to legal@unifystays.com. We may need to verify your identity and authority before acting, and some data may be retained where law permits or requires it. Withdrawing consent does not affect processing already lawfully completed.

UnifyStays is a business service and is not directed to children. Customers must not submit children's personal data unless it is necessary for an authorized booking, they have provided all required notices and permissions, and the processing complies with applicable law.

We may update this policy as the service, providers or law change. We will post the revised policy here, change the last-updated date and provide additional notice when a change materially affects how we process personal data.

TELOXIC TECHNOLOGIES PRIVATE LIMITED

CIN: U62099GJ2026PTC180664

Registered office: 304 Block D, Nakshatra Buildcon, Near Karnavati 1, Narol, Daskroi, Ahmedabad 382405, Gujarat, India

Privacy requests and grievances: legal@unifystays.com