Privacy Policy

1. Who Operates This Website & Contact Information

This website (scalemyhotel.com) is operated by Scale My Hotel, founded and operated by Omkar Adate, having its principal operational office at Scale My Hotel, C-203, Violet I, Lodha Crown Taloja, Dombivli - 421204, Maharashtra, India. Under applicable data protection legislation, including the Indian Digital Personal Data Protection Act, 2023 (DPDP Act), Scale My Hotel acts as the Data Fiduciary for personal data collected through this website.

For any privacy inquiries, data subject access requests, or regulatory questions, our designated contact point is:

• Data Protection & Grievance Officer: Omkar Adate
• Email: hi@scalemyhotel.com (escalation: scalemyhotel@gmail.com)
• WhatsApp / Phone: +91 93214 24546
• Mailing Address: Scale My Hotel, C-203, Violet I, Lodha Crown Taloja, Dombivli - 421204, Maharashtra, India

2. Information We Collect

We collect only the business and technical information reasonably necessary to evaluate your accommodation property, provide diagnostic audits, execute agreed growth services, and deliver purchased toolkits:

• Contact Information: Your name, business email address, WhatsApp / mobile telephone number, job title/role, and preferred communication channel.
• Property & Operational Information: Hotel, resort, or villa name, property type/classification, geographic destination/city, room or unit inventory count, current OTA listings, estimated revenue ranges, and primary commercial growth challenges.
• Technical Attribution & Session Context: When submitting an inquiry, our system captures technical attribution parameters including a unique submission ID, form ID, originating page URL, document referrer, standard UTM parameters (source, medium, campaign, term, content), and client IP address (utilized strictly for rate limiting, DDoS prevention, and Turnstile security verification).
• Communications & Project History: Records of inquiries, audit submissions, email correspondence, notes taken during consultation sessions, and delivered project deliverables.
• Aggregated Technical & Analytics Data: Browser user agent, device category, screen resolution, operating system, and anonymized page navigation patterns.

Cardholder Credentials Excluded: Scale My Hotel does not collect, process, or store credit/debit card numbers, CVVs, net banking credentials, or government identity numbers (such as Aadhaar or PAN) through scalemyhotel.com. Digital product purchases are fulfilled through Payhip, where payment information is handled directly by licensed third-party processors (PayPal, Stripe) under their own PCI-DSS compliant infrastructure.

3. Purpose and Legal Grounds for Processing

We process your personal and commercial data in accordance with lawful processing grounds under Indian and international data protection laws:

• Contractual Necessity & Pre-Contractual Steps: To evaluate your property’s public online distribution, generate requested diagnostic audits, prepare customized commercial proposals, and execute contracted launch and revenue retainers.
• Legitimate Commercial Interests: To maintain website security, prevent spam and abuse, rate-limit form submissions via Cloudflare Turnstile, protect server infrastructure, and manage business-to-business client relationships.
• Explicit Consent: To send occasional hospitality research reports, market benchmarks, or product announcements only where you have explicitly opted in via an un-preselected checkbox. Consent may be revoked at any time.
• Legal & Regulatory Compliance: To maintain commercial accounting invoices, payment records, and business documentation as required under Indian commercial and tax laws.

4. Verified Third-Party Service Providers & Processors

Scale My Hotel operates using vetted, industry-leading cloud infrastructure and software providers. We disclose our actual operational tech stack:

• Cloudflare (Cloudflare Pages & Workers): Provides global edge website hosting, SSL/TLS encryption, serverless API route execution, Turnstile bot defense verification, and privacy-respecting server analytics.
• Google Sheets & Google Apps Script: Used for internal lead logging, audit dispatching, and operational team coordination. Server-to-server webhook requests are authenticated using HMAC-SHA256 signatures, and user inputs are strictly sanitized to prevent spreadsheet formula injection.
• Supabase (PostgreSQL): Provides managed cloud database storage with active Row Level Security (RLS) policies for encrypted backup logging of lead submissions and rate-limiting quotas.
• Google Workspace / Gmail: Used for direct client communication, audit delivery, and support correspondence via hi@scalemyhotel.com.
• WhatsApp (Meta Platforms): Enables direct one-to-one messaging when you choose to connect with our team via provided WhatsApp buttons or links.
• Google Analytics (GA4): Collects aggregated, non-personally identifiable site navigation metrics. We enforce IP anonymization and redact all URL query parameters containing PII, email addresses, or phone numbers before transmitting data to GA4.
• Payhip: Facilitates checkout, license tracking, and instant delivery for standalone downloadable digital products. Payhip processes orders under its own privacy and security protocols.
• Artificial Intelligence Providers (Anthropic, Google Gemini, Cloudflare AI): Power our free interactive computational tools (such as the AI Review Response Maker). User prompt inputs are transmitted via encrypted API calls transiently for immediate text generation. User submissions are not retained for training public AI foundation models.

5. Data Retention Policies

We store personal and business data only for as long as necessary to fulfill the commercial purpose for which it was collected:

• Audit Inquiries & Unconverted Leads: Retained for 24 months from the date of submission to assist in follow-up evaluations and comparative trend analysis, after which records are deleted or permanently anonymized.
• Active & Past Client Commercial Records: Retained for the duration of the commercial engagement plus three (3) to six (6) years to comply with Indian statutory accounting, contract limitation periods, and tax documentation requirements.
• Aggregated Web Analytics Data: GA4 user-level data retention is configured for 14 months.
• Security Logs & Turnstile Nonces: Maintained for up to 30 calendar days for security auditing, fraud detection, and replay prevention.

6. Technical & Operational Information Security

Scale My Hotel enforces technical, organizational, and operational safeguards to protect your data against unauthorized access, loss, or alteration:

• All browser sessions are encrypted using modern TLS/HTTPS encryption with HTTP Strict Transport Security (HSTS) enforced at the Cloudflare edge.
• Server-to-server webhook payloads between our website and internal logging endpoints are signed with HMAC-SHA256 signatures with timestamp freshness and anti-replay nonce tracking.
• Spreadsheet writes sanitize leading characters (=, +, -, @) to prevent CSV/formula injection vulnerabilities.
• Database storage on Supabase utilizes Row Level Security (RLS) to restrict data access to authorized server execution contexts.
• No secret API keys, database administrative credentials, or webhook secrets are ever exposed in client-side browser code.
• Internal administrative access is guarded by multi-factor authentication (MFA) and least-privilege role boundaries.

7. Cross-Border Data Transfers

Scale My Hotel operates from Maharashtra, India, and provides digital marketing and distribution services to hospitality operators in India, the UAE, the United States, and Southeast Asia. Our third-party cloud infrastructure providers (Cloudflare, Google, Supabase) maintain secure, enterprise data centers located in India, the United States, and the European Union.

Where data is processed across borders, our service providers utilize recognized contractual safeguards, including Standard Contractual Clauses (SCCs), robust encryption in transit and at rest, and strict SOC 2 / ISO 27001 data center certifications.

8. Data Subject Rights & Grievance Redressal

Under applicable data protection laws—including the Indian Digital Personal Data Protection Act, 2023 (DPDP Act), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and applicable US state privacy legislation—you have specific enforceable rights regarding your personal information:

• Right to Access: You may request a summary of personal data processed by us and the processing activities undertaken.
• Right to Correction & Erasure: You may request the correction of inaccurate or outdated data, or the permanent deletion of personal data no longer necessary for the purpose it was collected.
• Right of Grievance Redressal: You have the right to register a grievance with our designated Grievance Officer regarding the processing of your personal data.
• Right to Withdraw Consent: Where processing is based on consent (such as receiving marketing insights), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Notice to US Residents: Scale My Hotel does not sell personal data, nor do we share personal data for cross-context behavioral advertising. We do not discriminate against individuals for exercising their privacy rights.

How to Exercise Your Rights: To submit a data request or grievance, email hi@scalemyhotel.com with the subject line "Data Privacy Request". We acknowledge all verified requests within seven (7) business days and process verified requests within thirty (30) calendar days free of charge.

9. Children's Privacy

Our website, diagnostic tools, and commercial hospitality services are intended exclusively for commercial business operators, hotel owners, and adults aged 18 and older. We do not knowingly solicit or collect personal data from individuals under 18 years of age. If we discover that an individual under 18 has submitted information, we will promptly delete the data from our active records.

10. Policy Updates & Notifications

We may update this Privacy Policy periodically to reflect service evolutions, technical changes, or regulatory updates. Any material revisions will be reflected by updating the "Last Hardened & Updated" date at the top of this document. Continued use of scalemyhotel.com following such updates indicates acknowledgment of the revised policy.