InnCentral is a hotel management platform operated by SDLC Corp ("InnCentral", "we", "us"). This policy explains what personal data we handle when you visit our website, create a workspace, or use the InnCentral application, why we handle it, who we share it with, and the choices you have.
1. Who is responsible for which data
InnCentral serves hotels and other accommodation businesses ("workspaces"). Two different roles apply:
- Your account and workspace owner details. For the people who sign up and run a workspace (owners, managers, staff), we decide why and how that data is handled, so we are the data controller.
- Guest, booking and business records. Everything a hotel enters about its guests, reservations, bills and operations belongs to that hotel. The hotel decides why it is collected, so the hotel is the controller and InnCentral acts as its processor (service provider), handling the data only to provide the service and on the hotel's instructions. If you are a hotel guest and want to see or remove your data, please contact the hotel first.
2. What we collect
When you sign up or sign in
- Hotel or business name, the workspace address you choose, country and currency.
- Your name and work email address, and a password (stored only in hashed form). If you sign in with Google, we receive your name and email from Google.
- A one-time verification code we email you before your workspace is created.
What your workspace holds (entered by you and your team, or by guests using your booking page)
- Properties, floors, rooms, rates, packages and settings.
- Guest records: names and contact details, preferences and special requests, and, if your property uses them, identity details (ID type and number, nationality, date of birth) and uploaded copies of ID documents.
- Reservations, bills, payments and notes, including the payment method used and, where a card was used, the last four digits only. We do not store full card numbers.
- Staff accounts, roles, housekeeping and maintenance tasks, and the activity they generate.
Payments
- If a workspace owner connects Stripe or Razorpay, we store that workspace's gateway keys in its settings, visible to workspace owners only. Card details entered during a payment go to the payment provider; they are not stored by InnCentral.
Technical and security data
- Sign-in time, IP address and browser details for each login session, so owners can review who has accessed the workspace and so we can detect abuse.
- Basic request data (such as the IP address) used to limit repeated sign-up attempts.
- Error diagnostics, if error monitoring is enabled on the deployment you use.
When you contact us
- The details you share in support messages, demo requests and enquiries, including through sdlccorp.com.
3. How we use it
- To create your workspace, authenticate you and keep it running (including reservations, billing records, housekeeping and reports).
- To send you service messages, such as verification codes, password resets and important changes. If a hotel turns on guest notifications, we send booking confirmations and reminders by email or messaging on that hotel's behalf.
- To secure the service: preventing fraud and abuse, enforcing rate limits and investigating incidents.
- To provide support and to improve the product, using aggregated or de-identified information wherever possible.
- To meet legal obligations and to establish or defend legal claims.
We do not sell personal data, and we do not use guest data held in a workspace for advertising.
4. Who we share it with
We share personal data only as needed to run the service:
- Service providers we use to operate InnCentral, such as cloud hosting and email delivery, and error monitoring where enabled. They may process data only for us and under appropriate confidentiality and security terms.
- Services a workspace chooses to connect. Examples are payment providers (Stripe, Razorpay), online travel agencies and channel managers (such as Booking.com and Channex), messaging (email, WhatsApp or SMS through Twilio), and Google sign-in. When a hotel connects one, the relevant bookings, availability, guest or payment details are exchanged with that provider. Their handling is also governed by their own terms and privacy policies.
- People in the same workspace. Colleagues see what their role allows. Workspaces are separated from each other: one hotel cannot see another hotel's data.
- Authorities and advisers where the law requires it, to protect rights and safety, or in a merger or sale of the business, with notice where required.
5. The AI assistant
The built-in assistant answers questions about a workspace's operations. By default it runs on a language model hosted by us, so your prompts and the workspace data it reads are not sent to third-party AI companies. Answers can be wrong, so please check anything important. Enterprise deployments can point the assistant at a different model endpoint of their own choosing.
6. Cookies and tracking
- Our website and application use only the cookies and local storage needed to work: a sign-in session, security (CSRF) tokens, and a short-lived sign-up state while you verify your email. An offline page may be cached in your browser so the app can show a message when your connection drops.
- We do not run advertising or analytics trackers on the InnCentral website.
- Some application pages (sign-in, workspace and booking pages) load web fonts from Google Fonts, which can see your IP address.
7. How we protect it
- Data is encrypted in transit (HTTPS). Passwords are hashed, never stored in plain text.
- Each workspace is isolated by tenant-level access rules, with role-based permissions (owner, manager, front desk, housekeeping, maintenance and custom roles) and optional per-property access.
- Sign-in and sign-up attempts are rate limited, and sign-in sessions are logged.
- Enterprise customers can run InnCentral in their own environment.
No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify you and the relevant authorities as the law requires.
8. How long we keep it, and deletion
We keep account and workspace data while your workspace is active. Within a workspace, owners can edit or remove records. You can ask us to close your workspace and delete its data by writing to support@sdlccorp.com from the owner's email address; we will act on verified requests promptly and within the time required by law. Some information may be kept for longer where we must (for example billing, tax or legal records) or in routine backups until they expire.
9. Your rights
Depending on where you live (for example under the GDPR or UK GDPR, or in California and other US states), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain uses, to withdraw consent, and to complain to your data protection authority. To use these rights for your account, email support@sdlccorp.com. For guest records held by a hotel, please contact that hotel; if you write to us we will pass your request to them. We will not treat you differently for exercising your rights.
10. International processing
InnCentral and its providers operate in several countries, so personal data may be processed outside the country where you live. Where the law requires, we use appropriate safeguards for those transfers.
11. Children
InnCentral is a business tool and is not directed at children. We do not knowingly collect personal data from children for our own purposes. Hotels may record details of minors travelling with a guest as part of a booking; they are responsible for doing so lawfully.
12. Changes to this policy
We may update this policy as the product and the law change. When we make a material change we will update the date above and, for registered workspaces, tell the owner by email or in the application.
13. Contact us
Questions or requests about privacy: support@sdlccorp.com, or use the form at sdlccorp.com/contact-us. InnCentral is a product of SDLC Corp.
