Privacy Policy

1. Introduction

Weffex Solutions Private Limited ("Company", "We", "Us", or "Our"), a company incorporated under the Companies Act, 2013 and operating the Smart Studios platform at www.mysmartstudios.com and portal.mysmartstudios.com ("Platform"), is committed to protecting the privacy and personal data of all users, guests, and visitors.

This Privacy Policy is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and all other applicable Indian laws.

By accessing or using our Platform or services, you consent to the collection, processing, storage, and use of your personal data as described in this Privacy Policy.

2. Who We Are

Legal Name: Weffex Solutions Private Limited
Brand Name: Smart Studios
Registered Address: Gaur City Center, Greater Noida West, Gautam Buddha Nagar, Uttar Pradesh – 201318
Corporate Office: LG-376, Lower Ground Floor, Gaur City Center, Sector 4, Greater Noida West, Uttar Pradesh – 201318
CIN: U47912UP2024PTC208435
GSTIN: 09AADCW9155C1Z5
Email: privacy@mysmartstudios.com
Phone: +91 92669 02860

3. Personal Data We Collect

We collect the following categories of personal data:

3.1 Information You Provide Directly

Identity Data: Full name, date of birth, gender, government-issued ID (Aadhaar, PAN, passport, driving licence)
Contact Data: Email address, mobile number, permanent and correspondence address
Booking Data: Check-in / check-out dates, room type, number of guests, special requests
Payment Data: Amount, payment status, payment method type (UPI, card, net banking) and Cashfree's transaction reference. Card numbers, CVVs and UPI PINs are entered on Cashfree's payment page and never reach us.
Account Data: Mobile number used to sign in, username, password (hashed), an optional 6-digit sign-in PIN (hashed) if you choose to set one, preferences, notification settings
Communication Data: Messages you send us by email, by WhatsApp chat, or through the Platform (support messages, tenant–owner messages), and what you ask our in-app assistants or in-room speakers (see Section 3.5)
Site Visit Data: Enquiries, chosen visit times, whether a visit took place, ratings and comments left after a visit, and a record of no-shows and late cancellations linked to a hashed copy of your mobile number
Owner, Tenant and Broker Data: Ownership documents, bank account details for payouts, RERA registration (brokers), rent receipts you log, and, for hosts who link one, a private calendar link that we store encrypted and use only to read when you are busy (never event titles or guests)
Guest Register Data: Names and ID details of guests you add to your booking, as required under the Hotels and Lodging Houses Act and local police regulations

3.2 Information Collected Automatically

Device & Technical Data: IP address, browser type and version, operating system, device identifiers
Usage Data: Pages visited, time spent, clicks, search queries, booking flow events
Location Data: Approximate location derived from IP address. Precise location only if you allow your browser to share it when you choose “My location” in the indoor route planner; it is used once to find your nearest starting point and is not stored
Cookies & Tracking: Session cookies, preference cookies, analytics cookies (see Section 10)
Log Data: Server access logs, error logs, API call logs retained for security and debugging

3.3 Information from Third Parties

Identity verification results from DigiLocker (Aadhaar) and PAN checks, carried out through Cashfree where you authorise them
Payment transaction confirmations and risk signals from Cashfree
Mobile number verification from Cashfree Payments India Pvt. Ltd. (Secure ID): when you sign up or recover your account with your mobile number, Cashfree sends you a one-time code by WhatsApp or SMS and confirms to us that you entered it correctly. On a successful check, Cashfree may also return the name registered to that number; we use it only to pre-fill the sign-up form, you can change it, and we keep no other details Cashfree returns. We do not see or store the code itself.
Busy times from a calendar a host chooses to link (owners and brokers only)

3.4 The Smart Studios App in ChatGPT

Smart Studios offers an app inside ChatGPT that helps you check availability and stay options and, if you choose, contact us. It is listed in ChatGPT as "Smart Studios" and can be added from its ChatGPT page (see also Book with ChatGPT). It is operated by Weffex Solutions Private Limited, the Data Fiduciary for what the app sends us; it is not made or endorsed by OpenAI. OpenAI is responsible for your ChatGPT account, conversations and memories under its own terms and privacy policy.

Searches: to check availability the app receives only the details needed to search — dates, number of guests, type of stay and preferred area. It does not receive your name or contact details for a search, and search details are not stored against you.
Enquiries and callbacks: only if you ask to send an enquiry or request a callback, and confirm it in the conversation, we receive your name, phone number and/or email address, your stated requirement, and any approximate dates, number of guests, type of stay, preferred area or preferred callback time you gave.
How requests reach us: ChatGPT decides when to use the app and writes each request for you. As ChatGPT explains when you connect an app, it may draw on relevant parts of your chats or saved memories to fill in a request (for example your dates or the kind of stay you mentioned earlier). We receive only the fields of each request listed above, never the chat itself.
What we do not receive: we do not receive or store your ChatGPT conversation or memories, we receive no payment details through ChatGPT, and we do not use ChatGPT data to identify you or to build a profile of you.
Booking: the app gives you a link to our website with your dates filled in. The link carries a tag showing it came from the ChatGPT app, so we can count bookings from it. You confirm and pay on our website, where the rest of this policy applies.
Technical logs: our servers record each request to the app (time, outcome and network details such as the IP address of the connecting service) for security and troubleshooting, without the content of your request. These logs are kept for up to 12 months.
Purpose: solely to respond to your enquiry or call you back about accommodation you asked about.
Who receives it: the Smart Studios team only. It is stored in our database (see Section 6.1) and is not sold or shared with third parties for marketing.
Usage measurement: we count how the app is used (for example, the number of searches or enquiries) in aggregate only, without names, contact details or the content of your requests.
Retention: your name, phone number, email and message are removed automatically 180 days after we last contacted you about the enquiry (or after you sent it, if we never did), and the remaining record is deleted 12 months after submission. If you go on to book, your booking records are kept as described in Section 7.
Disconnecting: you can disconnect the app at any time in your ChatGPT settings. Disconnecting stops new requests; to delete an enquiry you already sent, use the rights below.
Your rights: you can ask us at any time to access, correct or delete an enquiry by writing to privacy@mysmartstudios.com or contacting the Grievance Officer (Section 12).

3.5 In-App Assistants and In-Room Alexa Speakers

Chat assistants: each portal has a chat assistant (for example Studio Buddy for guests). What you type is processed by an AI model run on Cloudflare Workers AI to answer you or prepare an action. The assistant can only see and do what you could already see and do in that portal, and anything that changes something is shown to you first and only happens when you confirm.
What we record: for every conversation we record which tools were used and the processing cost. While an administrator has review logging switched on, we also record the full text of your messages and the assistant’s replies against your account, to check quality and fix mistakes. These records are deleted when the review ends, and you can ask us to delete yours at any time (Section 9).
In-room Alexa speakers: some studios have an Amazon Echo speaker registered to Smart Studios. It only acts for us after someone says “Alexa, open Smart Studios”. Amazon converts speech to text and sends us the text of the request, together with an identifier for that speaker. We link the speaker to its room and act for the guest whose booking for that room is checked in; staff use it with a one-time code. Amazon’s handling of voice recordings is governed by Amazon’s own privacy notice.
Purpose: to answer your questions and place the orders and requests you confirm. Not used for marketing.

3.6 Artificial Intelligence and Training Data

We do not train AI models on your personal data. Your bookings, documents, messages, assistant conversations and voice requests are not used by us to train or fine-tune any AI model, and we do not sell or license them to anyone who does.
Our AI provider does not train on it either. The models behind our in-app assistants run on Cloudflare Workers AI. Under Cloudflare’s terms, the content we send (your messages and the assistant’s replies) is not used to train any model or to improve Cloudflare’s or anyone else’s services.
Review logs are for fixing mistakes, not training. When review logging is on (Section 3.5), people on our team read conversations to correct the assistant’s instructions and rules. The text is not fed into a model as training data.
Search over our catalogue: to let the assistants find menu items and products, we turn our own vendor and pantry catalogue into a search index. That index holds item names, descriptions and prices only, with no personal data.
In-room Alexa speakers: Amazon may keep voice recordings and use them to improve Alexa, according to the settings on the Smart Studios Amazon account and Amazon’s own privacy notice. We receive only the text of the request.
The Smart Studios app in ChatGPT: whether OpenAI uses your ChatGPT conversations for training is decided by your own ChatGPT data controls and OpenAI’s policies. We receive only what Section 3.4 describes and do not use it for training.
Our public website content: public pages such as listings, guides and blog posts may be read by search engines and AI services, and our robots.txt allows this, including for AI training. Sign-in areas such as the guest, owner and staff portals are excluded and are never public, so your personal data is not part of that content.
If this changes: we will not use your personal data to train AI models without first asking for your specific consent, recorded separately as described in Section 9.1.

4. Legal Basis for Processing

We process your personal data on the following lawful bases under the DPDP Act, 2023 and applicable law:

Consent: For marketing communications, optional features, and non-essential cookies
Performance of Contract: To fulfil your booking, manage your stay, and provide services you request
Legal Obligation: To comply with hotel registration, police intimation, GST, anti-money laundering (AML), and other legal requirements
Legitimate Interests: For fraud prevention, platform security, service improvement, and analytics

5. How We Use Your Personal Data

We use your personal data to:

Create and manage your account and profile
Process and confirm bookings; issue invoices, receipts, and GST bills
Run online check-in and the QR code that checks you in and out at the property
Send booking confirmations, visit invitations and reminders, receipts and account emails by email
Verify your mobile number by a one-time code sent through Cashfree by WhatsApp or SMS
Arrange site visits and online meetings, and show hosts’ visit record to visitors choosing a time
Give indoor walking directions, and answer requests made to our assistants and in-room speakers
Process payments, refunds, and dispute resolution through Cashfree
Fulfil statutory obligations: police intimation (Form C), guest register maintenance, GST filing
Respond to support requests, complaints, and queries
Personalise your experience — saved preferences, loyalty tier, recommended rooms
Send promotional offers and marketing communications (only with your explicit consent; unsubscribe at any time)
Conduct fraud detection, risk assessment, and platform security monitoring
Perform analytics and improve our services
Comply with court orders, legal process, and law enforcement requests

6. Data Sharing and Disclosure

We do not sell your personal data. We share it only as described below:

6.1 Service Providers (Data Processors)

Cashfree Payments India Pvt. Ltd.: Payment processing (PCI DSS Level 1 certified); mobile number verification codes for sign-up and account recovery, sent by WhatsApp or SMS (Secure ID); Aadhaar (DigiLocker), PAN and bank account verification where you authorise it
Neon Inc.: Primary database hosting (PostgreSQL) — data stored on servers in Singapore (ap-southeast-1)
Cloudflare Inc.: Application hosting and edge compute (Cloudflare Workers), document and file storage (R2), the AI models behind our in-app assistants (Workers AI), CDN, DDoS protection and DNS — runs across Cloudflare's global edge network
Resend: Delivery of transactional email (confirmations, receipts, visit invitations and reminders, account emails)
Google LLC: Website analytics (Google Analytics 4, loaded through Google Tag Manager); Google Calendar and Google Meet for site visits and online meetings, where the visitor’s name and email are added to the invitation
Amazon: Alexa voice service for in-room speakers, where installed (see Section 3.5)
AeroDataBox and RailRadar: Flight and train status for pickups booked with a flight or train number. Only that number is sent

6.2 Legal and Regulatory Disclosure

Police and government authorities as required under the Hotels and Lodging Houses Act, CrPC, and local regulations (Form C intimation)
GST authorities for invoice and tax compliance
Courts, tribunals, and law enforcement agencies pursuant to valid legal process
Financial intelligence units for AML compliance

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

7. Data Retention

Account data: Retained for the lifetime of your account, plus 7 years after account deletion (for statutory and audit purposes)
Booking and transaction records: 8 years (as required by the Income Tax Act and GST laws)
Guest register / police intimation records: As mandated by local hotel regulations (typically 12 months)
Marketing consent records: Until withdrawn, plus 3 years after withdrawal
Server logs: 90 days for standard logs; 1 year for security incident logs
Assistant conversation text (only recorded while review logging is on, Section 3.5): until the review ends, then deleted; you can ask for yours to be deleted earlier
Enquiry and callback requests (from the website or the Smart Studios app in ChatGPT): contact details and message removed 180 days after the last contact (or after submission if we never made contact); the record is deleted 12 months after submission
Payment data: As required by Cashfree and PCI DSS (card data is never stored by us beyond transaction completion)

8. Data Security

We implement industry-standard technical and organisational measures to protect your personal data:

TLS encryption for all data in transit
AES-256 encryption for sensitive data at rest
Bcrypt hashing for passwords and sign-in PINs; neither is ever stored in plain text. Five wrong PINs lock PIN sign-in for 30 minutes
Role-based access control (RBAC) — staff access only what is necessary for their function
Rate limits and lockouts on sign-in, verification codes and staff speaker codes
PCI DSS compliant payment processing (card data never touches our servers)
Private file storage — documents are never served from a public address and only reach your own signed-in account or authorised staff
Incident response plan aligned with CERT-In guidelines

In the event of a personal data breach that is likely to result in a risk to your rights or freedoms, we will notify you and the relevant authorities within the timelines prescribed under the DPDP Act, 2023 and CERT-In Cyber Security Incident Reporting Guidelines.

9. Your Rights

Under the Digital Personal Data Protection Act, 2023 and applicable law, you have the right to:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate or incomplete personal data
Erasure: Request deletion of your personal data (subject to legal retention obligations)
Withdrawal of Consent: Withdraw consent for optional processing at any time without affecting prior processing
Grievance Redressal: Lodge a complaint with our Grievance Officer (see Section 12)
Nomination: Nominate another individual to exercise your data rights in the event of death or incapacity

To exercise any of these rights, write to: privacy@mysmartstudios.com. We will respond within 30 days of a verified request.

9.1 Consent Management

Where we rely on your consent (Section 4), we record it separately for each specific purpose rather than as one blanket agreement — currently: KYC verification, bank account verification, marketplace vendor onboarding, guest check-in, and marketing communications. Each consent record captures what you agreed to, when, and its current status.

View your consents: Go to Privacy & Security in the Smart Studios guest portal to see every purpose you've consented to and when.
Withdraw consent: From the same screen, you can withdraw consent for any purpose at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer provide the specific service tied to that purpose (e.g. withdrawing marketplace vendor consent will pause your vendor account).
Access & export your data: The same Privacy & Security screen (Download as JSON) lets you download a copy of the personal data we hold about you (Section 9, Right to Access).

10. Cookies and Tracking

We use the following categories of cookies and similar browser storage:

Strictly Necessary: Sign-in session and security (cannot be disabled)
Functional: Settings remembered in your browser, such as a form you were part-way through
Analytics (only with your consent): Google Analytics 4, loaded through Google Tag Manager — to understand how visitors use the Platform. It does not load until you choose “Allow analytics” in the cookie banner

We do not use advertising or marketing pixels (such as Meta Pixel or Google Ads conversion tags). You can block or delete analytics cookies in your browser settings, or with Google’s Analytics opt-out browser add-on; this does not affect how the Platform works.

Your choice is stored in a cookie named ss_consent for 180 days and applies across mysmartstudios.com and its portals. You can at any time; choosing “Essential only” stops analytics from that point on.

11. International Data Transfers

Your personal data is not stored exclusively within India. Our primary database (Neon Postgres) is hosted in Singapore (ap-southeast-1), and our application layer runs on Cloudflare Workers, which executes at Cloudflare's global edge network of data centres. Email is delivered by Resend, analytics and calendar invitations by Google, and in-room voice requests by Amazon, each of which may process data outside India. This means your data genuinely leaves India in the ordinary course of processing your requests. Payment transaction data is the one exception — it is processed and stored exclusively within India by Cashfree Payments India Pvt. Ltd., as mandated by the Reserve Bank of India's data localisation requirements; full card numbers and CVVs are never stored by us at all.

For every transfer of personal data outside India, we put the following safeguards in place, consistent with the DPDP Act, 2023 (which permits transfers to countries not restricted by the Central Government) and recognised international-transfer practice:

Processing under each provider’s data processing terms, which bind Neon, Cloudflare, Google, Resend and Amazon to confidentiality, security and breach notification
AES-256 encryption of sensitive fields at rest (see Section 8) and TLS 1.3 encryption in transit, regardless of which region the data is physically stored in
Data minimisation — only the fields necessary for each function are transferred; RBI-regulated payment data is carved out and never leaves India
The right to request details of where a specific category of your data is stored, via our Grievance Officer (Section 12) or the "Your Consents" and data-export tools described in Section 9

We will update this section if we adopt processors in additional jurisdictions, or if the Central Government notifies country-specific restrictions under the DPDP Act, 2023 that apply to us.

12. Grievance Officer

In accordance with the Information Technology Act, 2000, IT Rules, 2011, and the DPDP Act, 2023, we have appointed a Grievance Officer to address any concerns regarding your personal data:

Name: Deepak Kumar, Director, Weffex Solutions Private Limited
Address: Gaur City Center, Greater Noida West, Gautam Buddha Nagar, Uttar Pradesh – 201318
Email: grievance@mysmartstudios.com
Phone: +91 92669 02860
Response Time: Complaints will be acknowledged within 48 hours and resolved within 30 days

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of Indiaonce it is constituted and operational under the DPDP Act, 2023.

13. Children's Privacy

Our Platform is not directed to children under 18 years of age. We do not knowingly collect personal data from minors. If we discover that a minor has provided us personal data without verifiable parental consent, we will delete such data promptly. Parents or guardians who believe their child has submitted personal data to us should contact us at privacy@mysmartstudios.com.

14. Third-Party Links

Our Platform may contain links to third-party websites (maps, payment gateways, etc.). We are not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policy of every site you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be notified to you by email or a prominent notice on the Platform at least 15 days before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.

16. Contact Us

For all privacy-related inquiries, please contact:

Email: privacy@mysmartstudios.com
Post: Weffex Solutions Private Limited, Gaur City Center, Greater Noida West, Gautam Buddha Nagar, Uttar Pradesh – 201318
Phone: +91 92669 02860 (Mon–Sat, 10 AM – 6 PM IST)