Resortee Privacy Policy

Last updated 23 Sep 2026 · Effective 23 Sep 2026

Last updated: 23 September 2026. Effective: 23 September 2026.

This Privacy Policy explains how Resortee Pvt Ltd, a company registered at Lot 10386, Ahigas magu K. Hulhumale, 23000, Maldives (“Resortee”, “we”, “us”), handles personal data in connection with the Resortee hospitality management platform, including the Resortee web application, the Resortee Staff mobile applications (including property-branded editions such as Sun Siyam Staff) and guest-facing applications (together, the “Platform”).

Capitalised terms not defined here have the meaning given in the Resortee Terms of Service.

1. Who is responsible for your data

Resortee is business software used by hotels, resorts and hospitality groups (each a “Customer”). The role we play depends on whose data it is:

  • Guest data and staff user data entered into the Platform. The Customer (the property you are staying at or working for) is the data controller. Resortee is a data processor and processes that data only on the Customer’s instructions. If you are a guest, the property’s own privacy notice explains why it collects your data and your rights over it; please contact the property first.
  • Customer business contacts, billing and account administration, and the security and operation of the Platform itself. Resortee is the data controller for this data.

2. Data we process

2.1 Staff users (Authorised Users)

  • Account and identity: name, work email address, user ID, role, department, the properties you can access, and your sign-in credentials (passwords are stored only as a secure hash by our authentication provider).
  • Work activity: actions you take in the Platform, such as creating or updating bookings, guest requests, housekeeping statuses, checklists, minibar postings, notes and remarks, with the time and the user who performed them (audit history).
  • Device data (mobile apps): a device identifier and a push-notification token, used only to deliver notifications to the phones you are signed in on, and basic device information (platform and app version) needed to keep the app working.

2.2 Guests of a property

Depending on the modules the property uses, staff may view or record:

  • Identity and contact details: name, email address, phone number, nationality, date of birth and address.
  • Stay details: reservation and confirmation numbers, room, arrival and departure dates, meal plan, preferences, special occasions and dietary notes, largely retrieved from the property’s own property management system (for example Oracle Opera).
  • Identity documents: images of, and data read from, passports, identity cards, visas and similar documents captured at registration.
  • Signatures and forms: registration cards, consent and other forms, and signatures captured on a device.
  • Bookings, requests and purchases: spa, restaurant and activity bookings, guest requests, minibar consumption and records of payments. Card numbers are never entered into or stored by the Platform; card payments are processed by the property’s payment provider.
  • Photos: photos staff attach to requests, bookings or documents.

2.3 Customer business contacts

Names, work email addresses, phone numbers and billing details of the people who manage the Customer’s subscription.

3. The Resortee Staff mobile apps

The Resortee Staff apps are for employees of properties that use Resortee. There is no public sign-up: accounts are created by the property’s administrator.

  • Camera and photos: used only when you choose to take or attach a photo (for example a request photo, a booking image or a document scan). Photos are uploaded to the property’s secure storage on the Platform.
  • Notifications: used to alert you about requests, bookings and approvals assigned to you. You can switch notifications off in your phone’s settings.
  • Sign-in session: your session is kept in the app’s private storage on the device, and is cleared, together with the device’s notification registration, when you sign out.
  • What the apps do not do: they do not collect your location, contacts, calendar, microphone recordings or browsing history; they contain no advertising and no advertising identifier; and they include no third-party analytics or advertising SDKs.

4. How we use data

We process data to:

  • provide the Platform and the modules the Customer has enabled, including synchronising with the property’s management and payment systems;
  • authenticate users, enforce role-based access, and keep each property’s data separate;
  • send operational notifications and emails configured by the property;
  • provide support when the Customer asks us to;
  • secure the Platform, prevent abuse, and investigate incidents; and
  • comply with legal obligations.

We do not sell personal data, and we do not use it for advertising or profiling for our own purposes.

5. Artificial intelligence features

Where a property enables AI features (for example reading fields from identity documents, or an assistant that answers questions over the property’s own data), the relevant data is sent to an AI model provider solely to produce the result for that property. We do not use Customer Data, guest data or identity document data to train or improve any general-purpose model, ours or a third party’s, and we contract for zero-retention processing where a provider offers it. AI output can be wrong and is reviewed by staff before it is relied on.

6. Who we share data with

We share personal data only as needed to run the Platform:

  • The property (Customer) that controls the data, and the integrations it connects, such as its property management system, payment gateways and messaging providers.
  • Subprocessors that host and operate the Platform on our behalf: cloud hosting and databases, file storage, background job processing, push-notification delivery (Apple Push Notification service and Firebase Cloud Messaging via Expo), email and messaging delivery, document rendering, error monitoring and AI model inference. Each is bound by data protection obligations no less protective than ours. A current list is available on request.
  • Authorities, where the law requires it.
  • A successor, if our business is merged or sold, under the same protections.

7. International transfers

Our infrastructure and subprocessors may be located outside the country where the property operates. Where data protection law requires it, we protect transfers with appropriate safeguards such as standard contractual clauses.

8. Security

We protect data with encryption in transit and at rest, tenant isolation enforced at the database layer, role-based access control, sealed storage of credentials and secrets, audit logging of significant actions and restricted personnel access. No system is perfectly secure; we will notify the affected Customer without undue delay if a personal data breach affects its data.

9. Retention

We keep Customer Data for as long as the Customer’s subscription is active. The property sets and applies its own retention periods for guest data and identity documents. After a subscription ends, the Customer may export its data within the period stated in its agreement; we then delete or irreversibly anonymise it, except where the law requires us to keep it or where it sits in backups that are deleted on their normal cycle. Push-notification tokens are removed when you sign out of the app or when the token stops working.

10. Your rights and deleting your data

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability.

  • Guests: please contact the property you stayed with, as it controls your data. If you contact us, we will pass your request to the property and help it respond.
  • Staff users: ask your property’s administrator, who can correct or deactivate your account. You can also email [email protected] to request deletion of your account and associated personal data; we will act on it, together with the property where it is the controller, within 30 days, except for records the property or we must keep by law (for example financial and audit records).

You also have the right to complain to your local data protection authority.

11. Children

The staff apps and the Platform’s business interfaces are for adults at work and are not directed at children. Properties may record details of children who stay with them (for example as part of a family reservation) under the property’s own privacy notice and legal basis.

12. Changes to this policy

We may update this Privacy Policy. The current version is always published at this page with its effective date. Where a change materially affects how we process personal data, we will notify Customers in advance by email or within the Platform.

13. Contact

Privacy and data protection requests: [email protected]
Security disclosures: [email protected]
General enquiries: [email protected]

Resortee Pvt Ltd, Lot 10386, Ahigas magu K. Hulhumale, 23000, Maldives.

Provided by Resortee.