Privacy Policy
Avera Hotel CRM

1. Overview

This Privacy Policy describes what data is processed by the "Avera Hotel CRM" mobile application (the "App") and its backend service, for what purpose, and under what conditions. The App is a front-desk and back-office tool for hotel staff: it is used to manage properties, room types, rooms and beds, reservations and guest check-in, front-desk shifts and cash accounts, payments, and rates.

The data controller for the development and provision of the App is Avera ("we", "us", "the Operator"). By installing and using the App, you agree to the terms of this Policy.

2. Roles of the parties

The App is a multi-tenant B2B system: each customer hotel operates in an isolated database under its own account. The following division of roles applies to the data of that hotel's employees and guests:

• The customer hotel (the property using the App) acts as the data controller for its employees' and guests' data — it determines what data is entered and is responsible for the lawfulness of its collection.
• Avera acts as the data processor — providing the software and infrastructure used to store and process this data on the customer hotel's behalf.

3. Who can use the app

The App is intended for employees of the customer hotel (roles: administrator, front-desk manager, receptionist, and other assigned staff). There is no public self-registration in the App — employee accounts are created by the customer hotel's administrator, who also assigns each staff member to one or more properties and sets their access permissions.

4. What data is processed

4.1. Employee account data

First and last name, email address (login), phone number, password (stored as a hash), assigned role and permissions, assigned properties, SMS sign-in verification code, and phone-verification status.

4.2. Guest data entered by the customer hotel

The App allows staff to record data about hotel guests: full name, phone number, email address, home address, date of birth, nationality, notes, and reservation history. Where required for check-in, staff may also record passport data and, for foreign guests, visa data (including photos/scans of the passport and visa). These document photos are processed with automatic text recognition (OCR) — performed on our own server, not by a third-party cloud AI service — to read the passport/visa machine-readable zone and pre-fill the guest's name, document number, date of birth, nationality and expiry date for staff to review before saving. This data belongs to the customer hotel and is entered by its staff; guests themselves are not users of the App and do not log in to it.

4.3. Business and financial records

Data about properties, room types, rooms and beds, reservations and their guests, room rates, payments and cash-account/shift ledgers. Payments are recorded as internal front-desk bookkeeping (amount, currency, status, shift) — the App and its backend do not process or store bank card numbers; cash and card payments are handled physically by hotel staff and only the resulting totals are recorded.

4.4. Technical and diagnostic data

When the App communicates with the server, standard technical information is automatically recorded: IP address, request date and time, device model, operating system version, and App version. This data is used to keep the service running securely and reliably.

5. Purposes of processing

• authenticating and identifying staff;
• providing the customer hotel with property-management functionality: rooms, reservations, guest check-in, rates, payments, and shift/cash-account tracking;
• speeding up guest check-in via passport/visa document scanning (OCR);
• sending SMS notifications (sign-in verification codes);
• ensuring security, preventing abuse, and diagnosing errors.

We do not use data for advertising, do not track users across other companies' apps and websites, and do not sell data to third parties.

6. Legal basis and guest consent

Consent from the guest to process their personal data, including passport and visa data, is obtained by the customer hotel offline, at check-in — outside the App, in accordance with the hotel's own guest-registration procedures and applicable local regulations. Processing of employee data is based on the employment relationship between the employee and the customer hotel.

7. App permissions

The App does not request access to precise location, contacts, or the microphone.

8. Data storage and isolation

Each customer hotel's data is stored in a separate, isolated database on the infrastructure used by the App. Uploaded passport/visa document photos are stored on our server's own storage, not with a third-party cloud storage provider. A scanned document photo that is not attached to a saved guest record is automatically deleted from server storage within 24 hours.

9. Sharing data with third parties

We do not sell or share personal or business data with third parties for advertising purposes. Limited disclosure is made only to the following service providers, which are necessary for the App to function:

Disclosure may also occur where required by applicable law or requested by authorized government authorities.

10. Security

We apply the following safeguards: employee passwords are stored as a hash and never in plain text; API access is protected by a time-limited, individually revocable authorization token, which is invalidated on sign-out; access to data is restricted by role and permission within each customer hotel, and staff only see the properties they are assigned to; the connection between the mobile app and the server is encrypted (HTTPS); uploaded document images are checked against oversized/corrupt files before processing. No method of transmitting data over networks can be guaranteed to be completely secure, so we also recommend that users protect their credentials and devices.

11. Data retention

Customer hotel data is retained for the duration of the agreement to use the App. Upon a deletion request, data is deleted or anonymized within 30 days, except where longer retention of contractual, accounting, or financial records is required by applicable law. Unattached passport/visa scan photos are auto-deleted after 24 hours as described in section 8.

12. Your rights and account deletion

Employee accounts are created and deleted by the customer hotel's administrator. Any user may independently submit a request to delete their data:

• through the form at /avera-hotel-crm/remove-account;
• by email, using the address listed in the "Contact" section below.

If you are a guest of a hotel using the App and would like information about your data or to have it deleted, please contact that hotel directly as the data controller — Avera, as processor, will assist it in fulfilling such a request.

13. App Store and Google Play disclosures

We confirm: the App does not track users across other companies' apps and websites, does not use data for targeted advertising, and does not share data with data brokers. An account and data deletion request can be submitted at /avera-hotel-crm/remove-account.

14. Children's privacy, changes, contact

The App is intended for business use by employees of customer hotels and is not directed at individuals under 18 years of age. We do not knowingly collect data from children through the App itself (a guest's date of birth may of course reflect a minor traveling with a guardian, entered by hotel staff as part of standard guest registration).

We may update this Policy from time to time. The current version is always available at this page's address, and the "last updated" date is shown at the top.

For questions about data processing and this Policy, contact:

• Operator: Avera
• Email: avera.tajikistan@gmail.com
• Jurisdiction: Republic of Tajikistan