Privacy Policy

Who we are

Tattwix is operated by Kabeer Joshi, an individual based in India (“Tattwix”, “we”, “us”). You can reach us about anything in this policy at privacy@tattwix.in.

When you check in, the hotel you choose collects your details for your stay and is responsible for its own guest register and legal reporting. Tattwix stores and shares those details on your instruction. Your reusable profile, companions and saved documents are held by Tattwix for you.

What we collect

• Account: your name, email address and sign-in details. Sign-in is handled by Clerk, including when you use Google.
• Guest profile: legal name, phone number, date of birth, nationality, home address and, if you add one, an emergency contact.
• Companions you add: legal name, date of birth, relationship to you and nationality.
• Identity documents: document type (Aadhaar, passport, driving licence or voter ID), the document number, the name on it, the issuing country, the expiry date if it has one, and photos of the front and back. For Aadhaar we keep only the last four digits of the number.
• Stays: the hotel, your arrival and departure, room, stay status, the charges the hotel records and any review you leave after a stay.
• Consent and access records: what you agreed to share, when, and each time hotel staff open your shared details.
• Hotel accounts: business and property details, property photos, staff names, emails and roles, and the actions staff take in Tattwix.
• Technical data: error reports from the website and the app, and website usage statistics (see “Cookies and analytics”).

Your profile and documents are optional until you choose to check in somewhere; a hotel may then need them to give you a room.

Why we use it

• To let you share your details with a hotel you choose, so it can confirm who is staying and keep its legally required guest record.
• To save you typing the same details at every hotel.
• To run hotel accounts: rooms, stays, bills and reports for the hotel's own staff.
• To keep the service secure, prevent misuse and fix errors.

We do not sell your data and we do not use your identity details for marketing.

Who can see it

• The hotel you check in to, and only staff whose role allows it at that property. They see what the check-in screen listed before you agreed, for a limited time (see “How long we keep it”). Every time they open it is recorded, and you can see this in Privacy.
• No other hotel sees your profile or documents.
• Tattwix administrators see hotel accounts, stay counts and access records, not your identity documents. Access to the underlying systems is limited to running and securing the service.
• Service providers that run parts of Tattwix for us: Clerk (sign-in, United States), Vercel (hosting; our API runs in Mumbai, India and the website is served from a global network), Supabase (database, Mumbai, India), Amazon Web Services (document photo storage, Mumbai, India), Sentry (error reports, United States) and Google Analytics (website usage).
• Authorities, when the law requires it. Hotels have their own legal duties, for example reporting foreign guests, and meet them from their own records.

How long we keep it

Document photos shared with a hotel

Until the hotel's access ends: 60 days after checkout; 60 days after the planned checkout if the hotel never checks you out; 60 days after you sent them if you never arrive; or straight away if you stop sharing after checkout. A daily job then deletes the hotel's copy.

Your stay record (the details you shared, including the document number)

Kept as the hotel's record of your stay for at least one year after the stay.

Consent and access records

At least one year.

Your profile, companions and saved documents

Until you delete them or your account.

Hotel account records

While the hotel uses Tattwix, and afterwards as long as the law requires.

Error reports

Up to 90 days.

Website usage statistics

Up to 14 months, kept by Google.

Your choices and rights

• See and correct your profile, companions and documents at any time in the app or on the website.
• Stop sharing with a hotel after checkout, from the stay or from Privacy; the hotel loses access straight away.
• Delete documents and companions, or delete your whole account. Deleting your account removes your profile, companions, documents and their photos. Stay records you already shared stay with the hotel for the period above, because the hotel must keep its guest record.
• Ask for a copy of your data, ask a question or make a complaint by writing to privacy@tattwix.in. We reply within 30 days and may ask you to confirm it is you.
• If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Aadhaar

Aadhaar is one of several accepted documents; you can use a passport, driving licence or voter ID instead. We store only the last four digits of an Aadhaar number, never show the full number, and do not verify Aadhaar with UIDAI. Photos of an Aadhaar card follow the same deletion rules as any other document photo.

Children and companions

Accounts are for adults. When you add companions, including children travelling with you, you confirm you have the authority to share their details, as their parent or guardian for a child.

How we protect it

• All traffic is encrypted (HTTPS). Document photos are stored privately, encrypted at rest, and opened only through short-lived links.
• Hotel staff see only the properties and actions their role allows, and every view of shared identity details is recorded.
• Error reports are stripped of identity details, form contents and sign-in tokens.

If a security incident affects your data, we will tell you by email without undue delay, along with what happened and what you can do.

Cookies and analytics

Sign-in uses cookies that are needed to keep you signed in. The website uses Google Analytics to count visits and how pages are used; it never receives your identity details, and check-in links are hidden from it. See how Google uses data from sites that use its services, or install Google's Analytics opt-out add-on. We do not show ads.

Where it is stored

Your profile, documents, photos and stays are stored in Mumbai, India. Sign-in (Clerk), error reports (Sentry), the website's global delivery network (Vercel) and Google Analytics may process data in other countries, including the United States.

Changes to this policy

When we change this policy we update the effective date above, and we tell signed-in users about changes that matter before they apply. See also our Terms of Use.

Grievance officer

Kabeer Joshi, Tattwix. Email privacy@tattwix.in. We respond to every grievance within 30 days.