Privacy Policy

This Privacy Policy describes how VERIDIEN (SP08022026) ("Veridien", "we", "us", "our") handles personal data when you visit our website, create an account, or use the Veridien platform, its mobile and desktop applications, its public API and the related services we operate (together, the "Service").

Veridien is a property-management system for hotels. Most of the personal data that flows through the Service belongs to hotel guests and is entered by the hotels that use us. This policy therefore covers two situations: what we do with the data of the people who sign up and work in Veridien, and what we do with the guest data that hotels ask us to hold for them. Section 1 explains the difference, and it matters for which rights you have and who you should contact.

If you have any question about this policy, write to legal@veridien.app.

Summary of key points

• Hotels that use Veridien decide what guest data to enter and why. For that data we are a processor acting on the hotel's instructions, under our Data Processing Agreement.
• For the account data of the people who sign up (owners, managers, staff), and for visitors to our website, we are the controller.
• We collect what is needed to run a hotel on the platform: account details, property configuration, reservations, folios, guest records, messages and technical logs.
• We do not sell personal data and we do not run advertising or cross-site tracking.
• The Service runs on Railway in Singapore: the application, the background worker, the database, the cache and the file storage all live there. Email goes out through Resend, subscriptions are billed through Polar, online travel agencies connect through Channex, and AI features send text through Vercel's AI Gateway to the model provider behind each feature.
• We hold no privacy or security certification and are not in the process of obtaining one. Section 9 describes what we actually do.
• We do not use guest or staff data to train AI models, and our AI providers are not permitted to do so on our behalf.
• Retention is automatic and follows the schedule in section 8, which matches the Data Processing Agreement.
• You can ask for access, correction, deletion, portability or restriction at legal@veridien.app. People in the EEA, the UK, Switzerland and California have specific rights described in section 11.

1. Who is responsible for your data

Veridien as processor

When a hotel records a guest, a booking, a folio, a message or a housekeeping note in the Service, that hotel (our "Customer") determines the purpose of the processing and is the controller. We act on the Customer's documented instructions, which are set out in the Terms of Service and the Data Processing Agreement. The Customer is responsible for having a lawful basis for the guest data it enters and for answering guest requests about that data. If you are a hotel guest, please read section 11 for how to reach the right party.

Veridien as controller

We decide how and why we process the following data, so we are the controller for it:

• account and profile data of the people who sign up and work in Veridien,
• subscription and billing data,
• website visits, support conversations and marketing preferences,
• technical logs and security data that we generate while running the Service.

The Data Processing Agreement

The Data Processing Agreement forms part of the Terms of Service for every Customer. It sets out the processing instructions, sub-processors, security measures, international transfer mechanisms and the retention schedule. This policy refers to it rather than restating it.

2. What we collect

Information you give us

• Account details. Name, email address, phone number, job title, password (stored as a hash), theme preference, and the profile picture you choose to upload.
• Business details. Legal entity name, property names and addresses, tax identifiers, currency and time zone, and the settings you configure for each property.
• Billing details. Billing contact, billing address and subscription plan. Card numbers are entered directly with Polar and never reach our servers.
• Content. Room descriptions, photos, rate plans, policies, document templates, email templates, menus and other material you create in the Service, including any website or booking page you publish through it.
• Communications. What you send us by email or through in-app support, and the feedback you leave.

Guest data entered by hotels

Customers and their staff record guest data as part of running a property. Depending on what a hotel chooses to capture, this can include:

• name, nationality, date of birth, gender, contact details and postal address,
• identity document type and number, where local law requires a hotel to record it,
• reservation details such as dates, room, occupants, special requests, rate and channel of origin,
• folio charges, payments, invoices and refunds,
• messages exchanged with the hotel, reviews and loyalty membership,
• restaurant orders that are posted to a room or a guest profile,
• information a guest enters in the guest stay portal, such as arrival time or pre-check-in details.

Reservations made through an online travel agency reach us via Channex, which passes on whatever the agency includes in the booking.

Information collected automatically

• Usage data. Which pages and features are used, actions taken, timestamps, and errors that occur. We record this in our own application logs; we do not load third-party analytics scripts.
• Device and connection data. IP address, browser and operating system, screen size, approximate location derived from the IP address, and the identifiers of the mobile or desktop app in use.
• Security data. Sign-in attempts, session tokens, device and location of active sessions, and events that our abuse detection flags.
• Audit trail. Who changed what and when inside a property. Hotels rely on this to supervise their own staff.

Information from other services

• Polar tells us whether a subscription is active, the plan and the billing period, and sends us the outcome of payment attempts.
• Channex delivers new, modified and cancelled bookings from connected channels and reports on the rates and availability we push out.
• Resend reports whether an email was delivered, bounced or marked as spam.

3. How we use personal data

We use the data above to:

• create and secure your account, sign you in and keep your sessions safe,
• run the property-management features a hotel has enabled: front desk, reservations, housekeeping, folios and billing, the channel manager, Outlets, the guest portal, the loyalty programme and the shared inbox,
• send transactional email such as booking confirmations, invoices, sign-in codes and reminders, on behalf of the hotel or on our own behalf,
• bill subscriptions and add-ons, issue invoices and handle failed payments,
• provide support and respond to your requests,
• power the AI features described in section 5,
• monitor performance, diagnose problems and improve the Service,
• detect fraud, abuse and unauthorized access and enforce our Terms of Service,
• meet legal obligations such as tax record-keeping and lawful requests from authorities,
• send product news and offers where you have agreed to receive them.

We may produce aggregated statistics from usage data (for example, how many properties use a feature) that do not identify any person or property. Those statistics are not personal data and may be kept indefinitely.

4. Legal bases in the EEA, the UK and Switzerland

Where data protection law requires a legal basis, we rely on the following:

• Contract. Most processing of account, billing and usage data is necessary to provide the Service you signed up for.
• Legitimate interests. We rely on our legitimate interests to keep the Service secure, prevent abuse, understand how features are used and improve them, and to communicate with existing customers about closely related products. We balance these interests against your rights before relying on them.
• Consent. We ask for consent before sending marketing email and before any optional processing that the law says requires it. You can withdraw consent at any time.
• Legal obligation. Some records must be kept to satisfy tax, accounting and other laws.

For guest data we process as a processor, the Customer determines the legal basis.

5. AI features

Veridien includes an assistant for staff called Vesper and a number of smaller text helpers (for example, a draft of a guest reply or a room description). When you use one of these features, the text you type, together with the context the feature needs (such as the reservation you are looking at or the guest thread you are replying to), is sent through Vercel's AI Gateway to the model provider behind that feature. Which provider that is depends on the model the feature uses; OpenAI is among them, and voice features use OpenAI. Vercel sees the request in order to route it.

The following rules apply to every AI feature:

• Data is sent only when a person triggers the feature; nothing runs in the background against your whole database.
• We do not use guest or staff data to train models, and we do not allow our providers to use what we send them to train their models on our behalf.
• Transcripts of assistant conversations are kept for 90 days, as set out in section 8, and then deleted.
• Vesper drafts and suggests; a member of staff decides. We do not use AI to make decisions about a person that have legal or similarly significant effects without human review.

A hotel can choose not to use the AI features at all. When they are unused, no data is sent to an AI provider.

6. Who we share data with

We share personal data with the service providers below, which act on our instructions and may not use the data for their own purposes. They are also listed as sub-processors in the Data Processing Agreement.

We will update this list and the DPA before adding a provider that processes personal data.

We also disclose personal data in the following situations:

• To online travel agencies. When the channel manager is connected, availability, rates and booking details flow between the hotel and each connected agency through Channex. Each agency handles the data it receives under its own privacy policy.
• To other people at your hotel. Staff with the right permissions see the guest and reservation data of the property they belong to. The hotel controls those permissions.
• To guests. The guest portal, confirmations and invoices show a guest their own booking and billing information.
• When the law requires it. We disclose data to comply with a legal obligation, a court order or an enforceable request from a public authority. We will tell the affected Customer before responding unless we are legally barred from doing so.
• To protect people and the Service. We may disclose data to investigate fraud or abuse, to enforce our Terms of Service or to protect the safety of a person.
• In a change of ownership. If Veridien is sold or merges with another company, personal data may pass to the new owner. We will notify you before your data becomes subject to a different privacy policy.

We do not sell personal data, and we do not share it with advertisers or data brokers.

7. International transfers

The Service is hosted in Singapore, and some of the providers listed above process data in other countries, including the United States. Each provider handles the data we send it under its own data processing terms; where a provider offers the European Commission's Standard Contractual Clauses for data from the EEA, the UK or Switzerland, those terms include them. Data is encrypted in transit on every hop. If your hotel needs specific transfer safeguards documented for its own compliance, write to us and we will tell you exactly what is in place with each provider.

8. How long we keep data

Retention is enforced automatically by the Service. The periods below are the same as those in the Data Processing Agreement.

When an account is closed, the Customer has 30 days to export its data. After that we delete the account and its data, except for records we are legally required to keep for the period shown above. Data past its retention period is permanently deleted or irreversibly anonymized.

Hotels remain responsible for deciding how long they need guest data under the laws that apply to them, and can delete or anonymize guest records at any time from within the Service.

9. How we protect data

• All traffic between you and the Service, and between the Service and its providers, is encrypted in transit with TLS.
• The database, the background workers and the application communicate over a private network in Railway's Singapore region. Only the web application accepts connections from the public internet.
• The database, its backups and the object storage are managed services of Railway in Singapore. Encryption of that storage at rest is provided by Railway's platform, not by a layer of our own; Railway's security documentation describes it.
• Every hotel's data is isolated at the database level with row-level security, so a query for one property cannot read another property's rows.
• Access inside a property is governed by roles and permissions that the hotel controls. Every change is written to the audit trail.
• Two-factor authentication is available for every account. You can see your active sessions, including device and location, in your account settings and end any of them.
• Our own access to production systems is limited to the people who operate the Service and is logged.
• The database is backed up by Railway's managed Postgres and kept for a short rolling period so that we can restore the Service after a failure.

We hold no security or privacy certification (such as SOC 2 or ISO 27001), have not been independently audited, and are not currently in a certification process. What is written above is what we do, and we would rather say that plainly than imply an assurance we do not have.

No system is completely secure. If we learn of a breach affecting personal data, we will notify affected Customers without undue delay and, where the GDPR applies, within 72 hours of confirming it, with the information they need to meet their own obligations.

To report a security issue, write to legal@veridien.app. We ask for reasonable time to investigate and fix a problem before it is disclosed publicly.

10. Cookies and similar technologies

We use a small number of cookies and browser storage entries, all of which are needed for the Service to work:

• Session cookie. Keeps you signed in and protects requests against forgery.
• Preference storage. Remembers your theme so pages render correctly before the server has answered.
• Guest portal token. Lets a guest open their stay page without an account, for the duration of that visit.

We do not set advertising cookies, we do not use tracking pixels, and we do not share cookie data with ad networks. Because every cookie we set is essential, there is no cookie banner and nothing to opt out of. You can delete cookies in your browser at any time; doing so signs you out.

11. Your rights

Everyone

Whatever country you live in, you can ask us to tell you what personal data we hold about you as a controller, correct it, delete it, or send you a copy. You can also update most account details yourself in the Service.

EEA, UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the following rights over the data we control:

• to access the data and receive a copy of it,
• to have inaccurate data corrected and incomplete data completed,
• to have data erased where there is no longer a good reason to keep it,
• to restrict processing while a dispute about the data is resolved,
• to receive data you gave us in a structured, machine-readable format and to have it moved to another provider where technically feasible,
• to object to processing based on legitimate interests, and to object to direct marketing at any time,
• to withdraw consent, without affecting processing that happened before the withdrawal,
• to lodge a complaint with the supervisory authority in your country.

California

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you the right to know what personal information we collect and how we use and disclose it, to request deletion, to request correction, to opt out of the sale or sharing of personal information, and not to be treated differently for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. Where we process guest data for a hotel, we act as a service provider and use the data only for that hotel's purposes. You may appoint an authorized agent to make a request for you; we will ask for evidence of the authorization.

Guests of a hotel that uses Veridien

If you stayed at, or booked with, a hotel that uses Veridien and want to exercise a right over the data that hotel holds about you, contact the hotel. The hotel is the controller and is the party that can act on your request. If you write to us instead, we will pass your request to the hotel and help it respond, as the Data Processing Agreement requires. We will not delete or change a hotel's records on our own initiative.

How to make a request

Send your request to legal@veridien.app. We will confirm receipt, may ask you to verify your identity (usually by replying from the email address on the account), and will respond within 30 days. Where a request is complex we may extend that period and will tell you why. There is no charge unless a request is clearly excessive.

12. Children

The Service is a business tool for hotel operators and their staff. You must be at least 18 to create an account. We do not knowingly collect data from anyone under 16 as a controller. Guest records may include minors travelling with adults; those records are entered by the hotel, which is responsible for them. If you believe a child has given us personal data directly, tell us at legal@veridien.app and we will delete it.

13. Marketing communications

We send product news and offers only to people who have agreed to receive them. Every marketing email includes an unsubscribe link, and you can also opt out by writing to legal@veridien.app. Opting out does not stop transactional messages such as invoices, sign-in codes and security alerts, which are part of running your account.

14. Changes to this policy

We update this policy when our practices or the law change. For a material change we will email the address on your account and post a notice in the Service at least 30 days before the change takes effect, unless the change is needed sooner for legal or security reasons. The date at the top of this page shows when it was last revised. Continued use of the Service after a change takes effect means the updated policy applies.

15. Contact

VERIDIEN (SP08022026)

All privacy, data protection and rights requests: legal@veridien.app

We answer privacy enquiries within 30 days.