Privacy Policy

1. Overview

The Vestly is a hotel operations and guest-service platform operated by Cubbing Solutions Private Limited ("we", "us"). Hotels use it to run front-desk, billing, point-of-sale and guest-request operations; guests use it to request services through in-room QR pages or by messaging the hotel on WhatsApp. This policy covers this website (thevestly.com) and the application at app.thevestly.com (together, the "Service"). It explains what we collect, why, and the choices you have.

For guest data, the hotel you interact with is the data controller and we act as its processor.

2. Data we process

• Website visitors: pages viewed, buttons clicked, approximate location, device and browser information, collected through Google Analytics and Microsoft Clarity cookies. Clarity also records how pages are scrolled and clicked (heatmaps and session recordings). If you contact us by email or WhatsApp, we receive what you send and your contact details.
• Hotel staff accounts: name, email, role, and activity within the admin console.
• Guest and stay records: entered by hotel staff or by guests themselves, including name, phone number, ID details required by lodging regulations, booking and stay dates, and room assignments.
• Orders and billing: service requests, food orders, folio charges, payments recorded by the hotel, invoices and GST details.
• WhatsApp messages: when a guest messages a hotel's WhatsApp number, we receive and store the message content, sender number and profile name via the WhatsApp Business Platform (Meta), so hotel staff can read and respond.
• Technical data: logs, device and browser information, and analytics events used to keep the Service secure and improve it.

3. Why we process it

To provide the Service to hotels (operating stays, orders, billing and messaging); to secure it (authentication, audit, abuse prevention); to meet legal obligations that apply to lodging and tax records; to respond when you contact us; and to understand how visitors use this website and the product, using aggregated analytics.

4. Tenant isolation and security

Each hotel's data is segregated per tenant and protected with row-level security; staff can only access data for properties they are assigned to. Data is encrypted in transit, and access tokens for messaging channels are stored encrypted. We retain data for as long as the hotel's account requires, and legal and tax records for the periods required by law.

5. Subprocessors and third parties

We use a small set of providers to run the Service:

• Supabase: database and authentication hosting
• Vercel: website and application hosting
• Meta (WhatsApp Business Platform): message delivery for WhatsApp channels
• Google Analytics: website analytics
• Microsoft Clarity: heatmaps and session recordings of this website and the admin console, with on-screen text masked in the admin console
• PostHog: product analytics
• Sentry: error monitoring
• Razorpay: subscription payment processing. Card and bank details are entered with Razorpay and are not stored by us.

We do not sell personal data. Data is shared with these providers only to operate the Service.

6. Your rights and data deletion

Guests: to access, correct or delete data a hotel holds about you, contact the hotel directly, since they control your records. You can also reach us and we will assist or forward your request to the hotel.

To request deletion of your data (including WhatsApp message history), email logesh@cubbingsolutions.com with the phone number or booking reference involved. We action verified requests within 30 days, except records hotels must keep by law (for example, tax and lodging registers).

7. Cookies

This website uses Google Analytics and Microsoft Clarity cookies to measure visits and which sections and buttons are used. They are set only after you choose "Accept analytics" in the cookie notice, and you can change that choice at any time from "Cookie settings" at the bottom of the home page. We always keep one first-party cookie recording the campaign link you arrived from (for example utm_source or an ad click id) for up to 90 days, so we know which campaign brought a signup; it holds no contact details and is not shared. You can block or delete these cookies in your browser settings, or install the Google Analytics opt-out add-on. The admin console uses strictly necessary cookies for sign-in sessions and workspace selection, plus analytics cookies to understand product usage. Guest QR pages use only what is needed to keep your session working.

8. Changes and contact

We will post updates to this policy on this page with a new effective date. For questions about this policy, contact:

See also our Terms of Service.