Privacy notice
Last updated: 5 October 2026
Who we are
Daakhil (daakhil.com) is based at G3 Wazirabad, Delhi 110084. Phone +91 97171 30893. Email [email protected].
Who is responsible for your data
The hotel you check in to is the data fiduciary for its guest register under the Digital Personal Data Protection Act, 2023. Daakhil processes data on the hotel's behalf. We follow the hotel's instructions and help the hotel meet its duties.
What we collect
- Guest details: names, ID details, addresses and document images.
- Your phone number, used to send you a login code on WhatsApp.
- Stay details: check-in time, number of guests, room, status, and whether Form C is due or filed.
- Hotel staff details: name, phone number and role.
Phone numbers, staff names and roles, and the stay details listed above (times, guest counts, rooms, status, Form C dates) are stored in readable form. Only guest details and documents are encrypted.
How guest data is protected
Guest details and ID documents are encrypted before they are stored. Your phone encrypts them before upload, using a key that belongs to the hotel's property. The keys that open them are kept separately from the data, so a copy of our database or its backups can't be read. Alongside the encrypted records we store non-identifying metadata: timestamps, guest counts, room, status and Form C due or filed state.
Hotel staff who sign in to the property's desk can read its guest records. When someone opens the private link in a WhatsApp alert, our server decrypts that one check-in to show it. Daakhil staff could technically access guest data. We only do so to operate the service or when the law requires it.
Aadhaar is masked automatically before it's stored. Only the last 4 digits stay visible. We do not store the original image or the full Aadhaar number.
Saved travellers live only on your device. We do not hold a copy.
Service providers
AZAPI (Azapi.ai) reads and masks Aadhaar images on our behalf. When you upload an Aadhaar card, the image is sent to AZAPI over an encrypted connection for this purpose only. AZAPI returns the masked image and the details printed on the card (name, gender, date of birth, address), which fill in your form. Daakhil does not store the original image. AZAPI may keep the masked copies briefly on its own cloud storage (Amazon S3) to deliver them to us.
AZAPI also reads the Aadhaar number; we keep only the last 4 digits. The original photo passes through Daakhil's server in memory and is not stored.
If you choose to hide the number on your phone instead, or upload another kind of ID, the image is masked on your phone and is not sent to AZAPI.
LogRocket records how pages are used (clicks, page loads, errors and timing) so we can fix problems and improve the product. On the guest and hotel apps, all text, typed input and images are hidden before anything leaves your browser, and the contents of requests and responses are never recorded. ID images, guest details and WhatsApp link pages are not sent to LogRocket. Signed-in hotel staff are identified only by an internal account number and role.
WhatsApp messages
We use your phone number to send login codes on WhatsApp. Reception numbers receive alerts about new check-ins. The alert text carries no guest details: only the guest count, a check-in code and a private link. WhatsApp, a third-party service, carries the codes and alerts.
The private link opens the check-in without signing in, for the period the property chooses (72 hours by default). Anyone with the link can open it, so hotel staff should not forward it. Documents downloaded from the link are watermarked with the property name and date. Every view and download is logged, and an admin can turn a link off at any time. The link itself is not stored in our database: it is rebuilt with a key kept apart from the data when the alert is sent.
How long we keep it
Records are deleted after the property's retention period. The default is 1 year after check-out. The hotel can change it. Audit logs are kept for at least 180 days and up to 400 days.
What we do not do
We do not sell personal data. We do not use it for advertising.
Where data is stored
Data is hosted in India.
Your rights
You can ask to access, correct or erase your data. You make these requests to the hotel, because the hotel is the data fiduciary. Daakhil helps the hotel respond. If you are not satisfied, use our grievance process.
Contact
Grievance Officer, Daakhil, [email protected], +91 97171 30893.