Draft under legal review (draft-2026-11-04). The signed version will be a schedule to your pilot letter or subscription agreement.
1. Roles and instructions
You decide why and how your guests’, staff’s and owners’ personal data is processed. Weffex Solutions Private Limited processes it only on your documented instructions: the agreement, these terms, the platform settings you choose, and written requests. We tell you if an instruction appears unlawful. We do not sell the data, do not use it for our own marketing and do not use it to train AI models.
2. Whose data, and what
- Guests and companions: name, contact details, address, nationality, check-in ID details (encrypted), stay dates, requests, payment status, company GSTIN for B2B invoices, messages to assistants.
- Your staff: name, contact details, role, shifts, tasks, access logs.
- Unit owners (if used): name, contact details, bank account (encrypted), payout statements, PAN where tax law needs it.
- Vendors and enquirers: name, contact details, orders and enquiries.
3. Security
Encryption in transit; ID, KYC and bank fields encrypted field by field; each customer’s data isolated by row-level security per organisation, deny by default; staff access to personal data logged; two-step sign-in for admins; role-based access; automatic retention purges; confidentiality duties for our staff.
4. Sub-processors
Neon (database, Singapore), Cloudflare (hosting, storage, AI models, CDN), Resend (email), Meta (WhatsApp), Cashfree (payments, verification, SMS codes), Channex (channel manager), Google (Calendar/Meet, where used), Amazon (Alexa, only where installed), and flight/train status providers (only the flight or train number). We give 30 days’ notice of any new sub-processor, during which you may object.
5. Breaches
We notify you without undue delay, aiming for 24 hours after we become aware of a breach affecting your data, so you can inform the Data Protection Board and affected people in time, and we meet our own CERT-In duties.
6. Rights requests
We help you answer requests for access, correction, erasure, grievance redressal and nomination, and withdrawals of consent, through platform features or on request. Requests we receive directly are passed to you.
7. At the end
On request, within 30 days after termination, we give you an export (CSV or JSON), then delete your data from live systems except where Indian law requires retention (for example tax records), and confirm deletion in writing.
8. Audits
We keep a record of processing activities and share the information reasonably needed to show compliance once a year or after a breach, on 30 days’ notice.
Grievances: grievance@mysmartstudios.com.