Privacy Policy
How Theoretic Hotels collects, uses and protects personal data under the Digital Personal Data Protection Act, 2023. Version 2026-10-24, effective 24 October 2026.
1. Who we are and our role
Theoretic Hotels is owned and operated by Theoretic Softnet Pvt Ltd, 4th Floor, A-07, D Block, Sector 10, Noida, Uttar Pradesh 201301, India (“we”, “us”). This policy covers hotel owners, managers, staff and other people who use the Theoretic Hotels CRM. Guests who use the Mauji Bear website are covered by the Mauji Bear privacy notice.
For your own account (name, login, activity), we decide how the data is used, so we are the “Data Fiduciary”. For guest data that a hotel enters into the CRM (guest profiles, bookings, ID details, invoices), the hotel decides why and how it is used, so the hotel is the Data Fiduciary and we process that data on the hotel's instructions as its “Data Processor”. A guest who wants to exercise rights over a hotel's records should contact that hotel; we will help the hotel respond.
2. What we collect
- Account data: name, email, phone number, job title, role, hotel, and your password (stored only as a one-way hash).
- Guest data entered by hotels: name, contact details, address, company and GST number, ID proof details where the hotel is required by law to record them, stay preferences and special requests.
- Transaction data: bookings, folio charges, payments, restaurant bills and GST invoices.
- Usage and technical data: IP address, browser and device type, sign-in times and an activity log of actions taken in the CRM, used for security and support.
- Communications: emails and WhatsApp messages sent through the platform, and your messages to us.
- Consent records: what you agreed to, which version, when, and from which device, so we can prove it if asked.
3. Why we use it
- To provide the platform: bookings, billing, restaurant POS, housekeeping, inventory, reports and the CRM.
- To send service messages such as booking confirmations, receipts, invoices, security alerts and password resets. These are not marketing and continue while you have an account.
- To send product updates and offers only if you chose to receive them.
- To keep the platform secure and prevent fraud and misuse.
- To meet legal duties, including GST record-keeping.
4. Consent and your choices
We ask you to accept the Terms of Use and this Privacy Policy with a clear tick before you use the CRM, and again whenever these documents change in a way that matters. Marketing emails and sharing your details with partners are separate, optional choices that are off by default. Nothing is pre-ticked.
You can withdraw any consent at any time, as easily as you gave it, from Privacy & data in the menu. Withdrawing stops the related use from then on. It does not affect what was done before, and some processing may continue where the law requires it (for example, keeping invoices).
5. Who we share data with
We do not sell personal data. We share it only with:
- Your hotel's authorised staff, according to the access that hotel gives them.
- Service providers that help us run the platform: Supabase (database hosting), Hostinger (application hosting), Razorpay (subscription payments), Cloudflare (bot protection on sign-in), and Meta WhatsApp Cloud API and your own email provider, but only if your hotel switches those features on.
- Channel and listing partners such as OTAs and the Mauji Bear website, only for features your hotel enables.
- Authorities when the law requires it.
6. Where data is stored
Our database is hosted by Supabase in the Tokyo (Japan) region, and files and the application run on Hostinger's servers. This means personal data is transferred outside India. The DPDP Act allows such transfers except to countries the Government of India restricts; we use providers with industry-standard security and will stop transfers to any country that is restricted.
7. How we protect data
We use encryption in transit (HTTPS), hashed passwords, role-based access control so people see only what their role allows, protections against common web attacks, rate limiting and temporary lock-out on sign-in, encrypted storage of the email (SMTP) password you configure, and an activity log of important actions.
If a personal data breach occurs, we will inform the Data Protection Board of India and the affected people as the law requires, and tell hotels whose guest data is affected so they can meet their own duties.
8. How long we keep data
- Invoices, bookings and payments: 7 years, because Indian GST law requires it. After an erasure request they are kept without the person's personal details.
- Accounts: while the account is active.
- Activity logs: about 1 year.
- Consent records: kept as proof, without contact or device details once an account is erased.
- Deleted accounts: personal data is erased after the 30-day period described below.
9. Your rights
- Access: see and download your data from Privacy & data.
- Correction and updating: change your details in the CRM, or contact us.
- Erasure: ask us to delete your account and personal data (see section 10).
- Withdraw consent: switch marketing and sharing off at any time; unsubscribe from any marketing email with one click.
- Grievance redressal: complain to our Grievance Officer (section 14). We acknowledge within 24 hours and resolve within 15 days.
- Nominate a person to exercise your rights if you die or become unable to.
Where the law allows us to keep some data (such as invoices), we will tell you what we kept and why.
10. Deleting your account
Use Privacy & data → Delete my account and confirm with your password. Because a hotel account belongs to a business, a request from a hotel user is reviewed by the platform owner first; once approved there is a 30-day period in which you can cancel. After that your name, contact details, password and the personal details held in guest records are erased.
Kept without personal details: bookings, invoices and payments that the law requires us and the hotel to retain. If your hotel closes its account, we give it 30 days to export its data, then erase it, except for records the law requires us to keep.
11. Children
The CRM is for adults working in hotels. Hotels may record a child's name or age as part of a booking; they must do so only through the child's parent or lawful guardian and must obtain verifiable consent where the law requires it. We do not knowingly allow tracking or targeted advertising directed at children.
12. Cookies and similar technology
We use only essential cookies and browser storage: one to keep you signed in securely, and local settings such as your chosen theme. We do not use advertising cookies or third-party tracking pixels.
13. Changes to this policy
When we change this policy in a way that matters, we update the version and date above and ask you to accept the new version the next time you sign in. Earlier versions and your acceptances are kept on record.
14. Grievance Officer and complaints
Grievance Officer, Theoretic Softnet Pvt Ltd, 4th Floor, A-07, D Block, Sector 10, Noida, Uttar Pradesh 201301, India
Email: contact@theoreticsoftnet.com · Phone: +91 92679 70157
You can also write to us from the Privacy & data page. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
15. Contact
For privacy questions or to exercise your rights, email contact@theoreticsoftnet.com or call/WhatsApp +91 92679 70157. This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023.