Log In1. Introduction
This Privacy Policy ("Policy") explains how Flickkit Infocorp Private Limited ("Flickkit", "Weazy", "we", "us" or "our") collects, uses, processes, stores, shares and protects personal data when individuals access or use our products and services.
Our products include the following Services:
These products, their websites, applications, APIs, integrations and support services are collectively referred to as the "Services". This Policy may apply to business customers, hotel guests, restaurant customers, employees, administrators, authorized users and other individuals whose personal data is processed through the Services.
We aim to handle personal data in accordance with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), and other applicable requirements, to the extent and from the dates the relevant provisions apply.
2. Our Role in Processing Personal Data
2.1 When Weazy acts as a Data Fiduciary
Weazy may act as a Data Fiduciary where it determines the purposes and means of processing personal data for its own business operations, including account administration, subscriptions, billing, support, platform security and its own permitted business communications.
2.2 When Weazy acts as a Data Processor
When a hotel, restaurant or other business uses Weazy to process information about its guests, customers or employees, Weazy may process that information on the business customer's behalf and in accordance with the applicable service agreement and documented instructions.
2.3 Business customer responsibilities
Business customers are responsible for determining their purposes for collecting guest or customer data, providing required notices, and obtaining consent or relying on another legally permitted basis where required. Each party remains responsible for the obligations applicable to its own processing activities. Actual roles depend on the circumstances and applicable law, not merely on the wording of this Policy.
3. Privacy Notices and Choices
Before personal data is collected, the business that determines why it is collected must provide the individual with a clear, itemised notice describing the personal data being collected and each purpose for which it will be processed. Where consent is the required basis, the business must obtain valid consent before processing and provide a simple way to withdraw it.
For hotel and restaurant guest data, the hotel or restaurant is generally responsible for presenting the guest-facing notice and determining the lawful basis for collection. Weazy customers must configure and use the notice, consent, withdrawal and grievance options available in their deployment. If a required notice or consent workflow is not available in a deployment, the business must provide it through another suitable method before collecting the data.
Notices should identify the business collecting the data, the data categories, each purpose, how to withdraw consent, how to exercise applicable rights, and how to raise a grievance or complain to the Data Protection Board of India where applicable. Acceptance of this Policy alone is not a substitute for a purpose-specific notice or consent where required by law.
4. Personal Data We Collect
3.1 Account and business information
We may process names, email addresses, phone numbers, business names and addresses, login and authentication information, staff roles and permissions, subscription details, billing records, support requests and related communications.
3.2 Weazy PMS
Depending on the configuration, Weazy PMS may process guest names and contact details, booking and reservation information, check-in and check-out dates, room allocation, occupancy, guest preferences and requests, booking status, cancellations, folio entries, invoices, payment records and other hotel operational records.
3.3 Weazy Channel Manager
Weazy Channel Manager may process room inventory, availability, rates, packages, rate plans, reservation details received from connected booking channels, booking references, guest contact details included in reservations, booking changes and cancellations, and technical logs used for channel synchronization.
3.4 Weazy Self Check-In
Where enabled, Self Check-In may process guest details, booking references, check-in information, identity document types and details, uploaded identity document images or files, verification status, guest declarations and check-in records.
3.5 Weazy POS
Weazy POS may process order details, items purchased, invoice records, transaction information, payment status, customer names and contact details where entered, loyalty or feedback records where enabled, and staff account or activity information needed to operate the POS.
3.6 Weazy Self Ordering
Weazy Self Ordering may process menu views, selected items, modifiers, table numbers, cart contents, order references, order status, order notes and transaction details. Customer names, phone numbers or email addresses may be processed where the customer provides them or they are necessary for a requested feature, such as order updates or receipts.
Where a customer places an order using QR-based ordering without providing identifying details, the system may process order and technical information necessary to provide the service. Businesses should not require unnecessary personal data for an order where it is not needed for the stated purpose or required by law.
3.7 Technical and usage information
We may process IP addresses, device and browser information, login timestamps, session information, application and API logs, diagnostic reports, security events and technical usage information necessary to operate, secure and maintain the Services.
3.8 Third-party integrations
Where a business connects an OTA, booking engine, payment provider, messaging service or other integration, we may receive or exchange information necessary for the requested functionality, subject to applicable permissions, agreements and legal requirements.
5. Identity Documents and Aadhaar
Weazy Self Check-In can support identity-document workflows where enabled by the hotel or other business customer. The business customer must collect an identity document only for a specific, lawful and necessary purpose, provide the required notice, restrict access and set an appropriate retention period.
- Aadhaar is optional in Weazy workflows and must be off by default. A hotel or other business must not make Aadhaar the only accepted identification method unless a specific law authorises or requires that approach.
- Offer an alternative legally acceptable identity document or verification method.
- Where Aadhaar is used and a full Aadhaar number is not legally necessary, use masked Aadhaar or another permitted method. Do not collect or retain a full Aadhaar number merely for convenience.
- Do not upload identity documents to public URLs. Restrict access to authorised personnel and protect documents using appropriate security controls.
- Use identity documents only for the disclosed purpose, and delete them when that purpose and any lawful retention requirement have ended.
Each business customer is responsible for confirming that its proposed Aadhaar collection, authentication, verification, storage and disclosure are permitted by applicable Aadhaar legislation and UIDAI requirements. Encryption alone does not make an otherwise unlawful Aadhaar practice lawful.
6. Purposes and Lawful Basis of Processing
Depending on the product and activity, personal data may be processed to:
- Create and manage accounts and provide the Services.
- Manage hotel bookings, reservations, room allocation, guest check-in and billing.
- Manage restaurant orders, POS transactions, invoices and related operations.
- Synchronize room inventory, rates and reservations across connected channels.
- Facilitate identity document uploads and check-in workflows where enabled and lawful.
- Display digital menus, receive self-service orders, send order status updates and fulfil customer requests.
- Provide customer support and troubleshoot technical issues.
- Authenticate users, prevent fraud and protect platform security.
- Manage subscriptions, payments and contractual obligations.
- Send service communications and, where permitted, marketing communications.
- Comply with applicable legal requirements and respond to lawful requests.
- Generate statistics and improve the Services using aggregated or appropriately anonymized information.
We process personal data on a basis permitted under applicable law, including consent or a legally permitted use, as appropriate. Where consent is required, we will provide a suitable notice and mechanism. General acceptance of this Policy does not replace a separate consent mechanism where one is legally required.
7. Service Communications
Weazy and its business customers use SMS, email and WhatsApp service providers to deliver communications requested or required for the Services. Depending on the workflow, these communications include booking confirmations, reservation changes, check-in instructions, invoices, receipts, order confirmations, order status updates, account alerts, security notices and support responses.
For delivery, the relevant provider may process phone numbers, email addresses, message content and delivery metadata. Flickkit requires service providers acting on its behalf to be subject to appropriate contractual confidentiality, security and data-processing obligations.
Marketing messages are handled separately under Section 18. Business customers must ensure that they have the required notice, consent or other lawful basis before sending messages to their guests or customers.
9. Security and Encryption
Flickkit is responsible for implementing and maintaining reasonable technical and organisational safeguards for personal data under its control and for processing performed on its behalf. These safeguards include:
- Secure transmission of data using HTTPS/TLS for supported online services.
- Authentication and role-based access restrictions so that access is limited to authorised accounts and staff according to their responsibilities.
- Security logging and monitoring to support detection, investigation and remediation of unauthorised access.
- Backup and recovery procedures for supported hosted services.
- Encryption, masking, obfuscation or tokenisation for personal data according to the data type, product architecture and risk.
- Confidentiality and security requirements for personnel and service providers who can access personal data.
Security controls differ by product and deployment. In particular, business customers must not assume that local/offline POS databases, exported files, backups or every stored identity document are encrypted at rest unless that control has been confirmed for their specific deployment. Flickkit will document the security features available for each deployment and will not represent an unimplemented control as enabled.
Business customers must use strong credentials, assign individual accounts where supported, restrict staff permissions, protect devices and exports, avoid public storage links for identity documents, and promptly remove access when a user no longer needs it.
10. Personal Data and Cybersecurity Incidents
Flickkit maintains an incident-response process for receiving, assessing, containing, investigating and remediating suspected personal data or cybersecurity incidents involving the Services. Business customers must notify Flickkit without undue delay after discovering an incident involving data processed through Weazy, preserve relevant evidence and cooperate with containment and investigation.
Where Flickkit acts as a processor, it will notify the affected business customer without undue delay after becoming aware of a personal data breach affecting that customer’s data, provide information reasonably available to support the customer’s legal obligations, and cooperate with investigation, mitigation and remediation.
Where Flickkit is the Data Fiduciary, it will notify affected individuals and the competent authority without delay and provide the detailed report within 72 hours where and when that timeline applies under the DPDP Rules, subject to any extension lawfully granted by the Board. Flickkit will also assess whether an incident must be reported to CERT-In or another authority. Cyber incidents covered by the CERT-In Directions will be reported within the prescribed six-hour period, and required ICT logs will be maintained in India for at least 180 days.
11. Retention and Deletion
Flickkit applies the following default retention schedule to data it controls. A different period applies where the business customer’s documented instructions, a product configuration, a legal obligation, a dispute hold or a regulatory requirement requires a different period. Data must not be retained indefinitely merely because storage is available.
- Account and subscription records: During the account relationship and for up to 3 years after account closure, unless a longer period is required for tax, accounting, dispute resolution or another legal obligation.
- Support tickets and service communications: For up to 3 years after the ticket or matter is closed, unless needed for a live dispute, security investigation or legal obligation.
- Security and access logs: For at least 1 year where required by the DPDP Rules once the relevant provision is in force. ICT logs covered by the CERT-In Directions are retained securely in India for at least 180 days. Where both apply, the longer applicable period is followed.
- Guest reservations, guest profiles, check-in data, POS transactions, invoices and self-ordering records processed for a business customer: Retained according to that customer’s documented instructions and configuration, subject to applicable hospitality, tax, accounting and other legal retention requirements. The customer must set a retention period for each category and avoid retaining data longer than necessary.
- Identity documents: Aadhaar collection is off by default and full Aadhaar numbers must not be retained unless specifically permitted by law. Other identity documents must be deleted when the disclosed check-in or verification purpose has ended and no legal retention requirement applies.
- Customer data after service termination: Following a customer’s valid instruction or contract termination, Flickkit will make customer data available for export where agreed and delete or return it within 90 days, except for data that must be retained by law, is subject to a legal hold, or remains in protected backups during the backup cycle.
- Backups: Protected backups are rotated and overwritten within 90 days, unless a longer period is required for security, disaster recovery or law. Restored backups are subject to the applicable deletion instructions.
Where the DPDP Rules require a minimum one-year retention of personal data and associated processing logs for security purposes, Flickkit will retain them for that period unless another law requires otherwise. Retention schedules will be reviewed when applicable law or product functionality changes.
12. Your Rights and Choices
Subject to applicable law and the commencement of relevant provisions, individuals may have rights to:
- Request information about personal data being processed.
- Request correction or updating of inaccurate or incomplete personal data.
- Request erasure of personal data where applicable, subject to lawful retention requirements.
- Withdraw consent where processing is based on consent.
- Raise a grievance regarding personal data processing.
- Nominate another individual to exercise applicable rights in the event of death or incapacity, in accordance with applicable law.
Requests may be submitted using the contact details in this Policy. We may request reasonable information to verify the identity and authority of a requester. Where a request concerns records controlled by a hotel or restaurant, Weazy may direct the individual to the relevant business or assist that business, depending on the parties' respective roles and legal obligations.
13. Privacy Grievance Redressal
Designated privacy grievance contact: Privacy Grievance Officer, Flickkit Infocorp Private Limited.
Email: hello@weazy.in. Use the subject line “Privacy Request” or “Data Protection Grievance”. Include the relevant Weazy product, your relationship to the business customer, and enough information to identify the request. Do not email identity documents or sensitive information unless we specifically provide a secure method.
We will acknowledge privacy grievances and respond without undue delay, and in any event within 90 days of receipt, or within a shorter period where applicable law requires. If we need further information to verify identity or understand the request, we will contact the requester. If the grievance concerns data controlled by a hotel or restaurant, we may refer the request to that business or coordinate with it, consistent with the parties’ legal roles.
Where the applicable law provides a right to complain to the Data Protection Board of India after using the grievance mechanism, individuals may exercise that right in accordance with the law and the Board’s published process.
14. Account Deletion and Data Removal
Users may request deletion of their Weazy account through available account settings or by contacting hello@weazy.in.
After receiving a request, we will verify it where reasonably necessary, assess applicable legal and contractual retention requirements, and delete or anonymize personal data eligible for deletion. We may retain data that must or may lawfully be retained, subject to appropriate safeguards.
Requests will be handled within the period required by applicable law or, where no specific period applies, within a reasonable period. Account deletion may affect access to the Services and associated records. Where Weazy processes guest or customer data on behalf of a business, the relevant business may need to authorize or direct deletion under the applicable agreement and law. Data in backups may be removed in accordance with the applicable backup lifecycle.
15. Children’s Personal Data
Hotels and restaurants may process information about children, including when a child is included in a family reservation. The business customer that determines the purpose of collecting a child’s personal data must provide the required notice and obtain verifiable consent from the child’s parent or lawful guardian before processing where required by applicable law, unless a statutory exemption applies.
Business customers must not use Weazy to carry out prohibited tracking or behavioural monitoring of children or targeted advertising directed at children, except where a lawful exemption applies. They must record the applicable parental/guardian consent and retain evidence of it as required.
Before using Weazy for a workflow involving children, business customers must configure a parental/guardian consent process or use another compliant process. Flickkit will provide product controls for this only where those controls are available in the relevant deployment; customers must not assume a consent screen exists unless they have verified it.
16. Business Customer Data Processing Agreement
Where Flickkit processes personal data on behalf of a hotel, restaurant or other business customer, the parties must have a written agreement that describes the processing instructions, data categories and purposes, confidentiality, security safeguards, incident notification and cooperation, assistance with data-principal requests, retention and deletion/return of data, and the use of approved sub-processors.
Business customers must not upload or process personal data through Weazy until the applicable service terms and any required Data Processing Agreement (DPA) have been accepted. Flickkit will maintain a record of its sub-processors and will provide information about them through the applicable contract or service documentation.
17. Third-Party Websites and Integrations
The Services may contain links to or integrations with OTAs, booking platforms, payment providers, communication tools and other third-party services. Those third parties may process personal data under their own privacy policies, terms and legal obligations. We encourage users and business customers to review those policies before enabling integrations or providing information directly to those services.
Our responsibilities for third-party processing depend on our actual role, the relevant agreement and applicable law.
18. International Data Transfers
Personal data may be processed or stored in India or another jurisdiction depending on the infrastructure, hosting providers and integrations used. Transfers outside India will be subject to applicable Indian law, including restrictions or requirements imposed by the Central Government and other applicable legal obligations.
Business customers should consider any contractual, regulatory or sector-specific restrictions before enabling integrations involving overseas processing.
20. Marketing Communications
Flickkit sends marketing communications about Weazy to business contacts only where permitted by applicable law and where any required consent has been obtained. Recipients can opt out using the unsubscribe method provided in the message or by emailing hello@weazy.in with the subject “Marketing Opt-Out”. We will stop marketing messages within a reasonable operational period after processing the request.
Hotels and restaurants are independently responsible for the lawful basis, notices, consent and opt-out handling for marketing campaigns they send to their own guests or customers using Weazy. Service messages required to complete a booking, check-in, order, payment, security alert or support request are separate from marketing messages and may continue where permitted by law.
21. Automated Processing and Analytics
We may use automated tools to monitor performance, diagnose errors, detect suspicious activity and improve reliability. Where analytics or automated processing involves identifiable personal data, applicable privacy requirements continue to apply. We will not use identifiable guest or customer data for unrelated purposes merely because it is available through the platform.
22. Changes to This Policy
We may update this Policy to reflect changes in our products, processing activities, security practices or applicable law. The revised Policy will be published with an updated "Last Updated" date. Where required by law, we will provide additional notice or obtain consent before implementing changes that affect personal data processing. We encourage users and business customers to review this Policy periodically.
23. Contact Us
Legal Entity: Flickkit Infocorp Private Limited
Product: Weazy
Privacy grievance contact: Privacy Grievance Officer
Email: hello@weazy.in
Website: https://weazy.in