Version 2.2 · Last updated: 16 October 2026
OdaBookings is operated by Burhani Softech (GSTIN 26DEAPS5556G1Z9), trading as OdaBookings ("OdaBookings," "we," "us"). This policy explains what personal data we collect when you use odabookings.com, the subscriber dashboard, the admin console and the guest booking pages and widget, and how we handle it. It is written for the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Questions and requests: odabookingsindia@gmail.com or +91 99199 10253.
When you sign up or subscribe we collect your property's name, address and GST details, the names, e-mail addresses, phone numbers and roles of the staff you add, your billing details (processed by Razorpay — we never see or store card numbers), and the settings you save (plan, website content, templates, integrations). Sign-in records (time, IP address, device) are kept for security.
Credentials you connect so that the Service can act on your behalf — your Razorpay keys, your Meta WhatsApp Business access token and the password of the e-mail mailbox you connect — are encrypted at rest (AES-256-GCM) and are never shown back in a browser or shared with anyone, including our own support staff.
When a guest books, pays, checks in or messages a property through OdaBookings, the property is the data fiduciary and OdaBookings processes the data under the property's instructions (our Terms of Service, Section 3). That data includes: guest name, phone number and e-mail address; stay dates, guests and package; payment status and payment references (the money itself goes to the property's own Razorpay account); the government ID type and number given at check-in, stored encrypted and shown only to the property's authorised staff; WhatsApp and e-mail messages exchanged with the property; and the guest's marketing opt-in choice. We do not use guest data for our own marketing and we do not sell it.
Each provider processes data on our instructions under its own security and privacy commitments. We share data with public authorities only when the law requires it, as described in section 10.
Every property's data is isolated in the database with Row-Level Security, so one subscriber's bookings and financial records are never accessible to another. Passwords are hashed, sign-in codes expire, privileged actions need two-factor confirmation, connected credentials and ID numbers are encrypted at rest, and all traffic is encrypted in transit. Subscribers can also keep encrypted backups in storage they control.
Subscriber and guest data is kept while the subscription is active. After a plan ends it remains exportable for 90 days and is then deleted or anonymised, except records we must keep by law (tax invoices and accounts for eight years). Guest ID numbers are kept for the period guest-register rules require and then deleted. Security logs are kept for one year.
Subscribers and guests may ask for access to, correction of, or deletion of their personal data, withdraw a consent they gave, and nominate someone to exercise these rights on their behalf, by writing to odabookingsindia@gmail.com. Guest requests about a specific stay are routed to the property concerned, which decides as the data fiduciary; we help it respond. Grievances are acknowledged within 48 hours and resolved within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
Our websites use only the cookies needed to keep you signed in and to protect sign-in sessions. We do not run advertising or tracking cookies.
We disclose personal data to a government body, a regulator, a court or the police only when the law obliges us to. Burhani Softech, in India, is responsible for answering such requests.
We do not give any authority direct or general access to our systems or databases.
We may update this policy as the Service evolves. Material changes are announced to active subscribers by e-mail and in the dashboard; the version and date at the top always identify the current text.
