Privacy policy

Effective date: 9 October 2026
Last updated: 9 October 2026

This policy explains what personal data Infoveritas Technologies Pvt Ltd collects through EkamOS, why, who else handles it, how long it is kept, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”). It is written in plain language.

1. Who we are

EkamOS is an operations platform for hospitality businesses in India: hotels, cafés and restaurants, coworking spaces, PGs and co-living, and event venues. It is provided by Infoveritas Technologies Pvt Ltd (“we”, “us”), a company incorporated in India.

Our registered office address and corporate identity number are available on request at legal@ekamos.in.

Website: www.ekamos.in. The app: app.ekamos.in.

2. Our two roles

We handle personal data in two different capacities, and the rules differ for each.

• Where we decide why and how data is used, we are the Data Fiduciary under the DPDP Act. This covers visitors to this website, people who request a demo, and the owners and staff of businesses that use EkamOS (for their accounts, sign-in and billing).
• Where a business that uses EkamOS decides, that business is the Data Fiduciary and we are its Data Processor. This covers the data a hotel, café, PG, coworking space or venue enters about its own guests, occupants, tenants, members, visitors, employees and leads. We process that data only to provide EkamOS to the business and on its instructions.

If you stayed at, ate at, rented from or visited a business that uses EkamOS, that business is responsible for your data. Please contact it first. If you contact us instead, we will pass your request on to the business and help it respond.

3. What we collect when we are the Data Fiduciary

Demo requests

The form on our contact page asks for your name, email, phone number, business name, the kinds of business you run, the number of locations and any message you add. We use these details only to reply to you about EkamOS. Submitting the form does not create an account.

Visiting this website

This website does not use analytics, advertising trackers or cookies. Like most web servers, ours records technical details of each request (IP address, time, the page requested and the browser’s user-agent) to keep the service secure and working, for example to limit repeated form submissions from one network address.

Customer accounts

For owners and staff who use the app we hold: name, email, phone number, role and the locations they can access; sign-in records and two-factor settings; and, for the business, its billing details such as legal name, GSTIN and billing address. The app sets one cookie that is needed to keep you signed in. It cannot be read by page scripts and is not used for advertising or tracking.

Emails and support

When you write to us, we keep the conversation so that we can help you and refer back to it.

4. Why we use it

• To reply to demo requests and questions (you give us these details voluntarily for that purpose).
• To provide the service: create and secure accounts, sign users in, send service emails such as password resets and invoices, and give support.
• To bill for the service and keep the accounting records the law requires.
• To protect the service: detect abuse, investigate security incidents and keep logs.
• To meet legal obligations and respond to lawful requests from authorities.

The legal basis depends on the purpose. When you request a demo or write to us, we rely on your consent, which you give by sending us your details for that purpose and can withdraw at any time. To provide the service a business has signed up for, and for the records the law requires us to keep, we rely on the “legitimate uses” in section 7 of the DPDP Act, such as data a person has voluntarily provided for a specified purpose and compliance with the law.

We do not sell personal data, and we do not use it for advertising.

5. Data our customers store in EkamOS

Depending on the modules a business uses, it may store in EkamOS:

• guest and occupant details for reservations and the guest register, including nationality and passport details of foreign guests for Form C tracking;
• identity documents, such as scans of ID proofs, with Aadhaar numbers stored masked to the last four digits;
• tenant documents and police verification records for PGs and co-living;
• member and company documents for coworking spaces, and a visitor log;
• orders, invoices, payments and deposits;
• staff records, attendance and leave;
• leads, messages, feedback and records of marketing consent.

As the business’s Data Processor, we:

• process this data only to provide EkamOS to that business and as it instructs;
• keep each business’s data separate and limit access within a business by role and location;
• keep our staff’s access to customer data to what is needed to run and support the service, under a duty of confidentiality;
• give the business tools to answer its own data principals: an access log, consent records, access and erasure requests, and retention settings (see our Security and privacy page);
• tell the business without undue delay if we become aware of a personal data breach affecting its data, so it can meet its own duties to inform the Data Protection Board of India and the people affected;
• return or delete the data when the business stops using EkamOS, as described in section 8.

The business is responsible for giving notice to, and getting consent from, the people whose data it enters, and for deciding how long to keep it. Business customers can request our data processing agreement at legal@ekamos.in.

6. Who else handles personal data (sub-processors)

We use the following services to run EkamOS. Each receives only the data it needs for its task.

Always in use

• Amazon Web Services: hosting of the app, the database and encrypted backups, and delivery of the app’s emails (Amazon SES). Region: Asia Pacific (Singapore).
• Zoho Mail (Zoho Corporation): our own team mailboxes, such as hello@ekamos.in, so it holds emails you send us. India data centre.

Only when switched on for a business

• Razorpay: online payment of invoices. Card, UPI and bank details are entered in Razorpay’s checkout and are not stored by EkamOS.
• WhatsApp Business Platform (Meta): messages and automations, sent through the business’s own WhatsApp Business account under its own agreement with Meta.

Integrations shown in the app as “Beta” or “Not live yet” do not send data to anyone. Before we add or replace a sub-processor, we will update this list and tell business customers by email at least 30 days in advance.

We may also disclose personal data where the law requires it, for example to a court, a regulator or the police acting under a lawful order.

7. Where data is stored

EkamOS runs on Amazon Web Services in Singapore, so personal data is stored and processed outside India. The DPDP Act allows this unless the Government of India restricts transfers to a country by notification. If that changes, we will change where the data is held.

8. How long we keep it

• Demo requests: for 24 months, unless you become a customer or ask us to delete them sooner. If you become a customer, your details become part of your customer account.
• Customer accounts: while the business uses EkamOS, then as described below.
• Our billing and tax records: as long as tax law requires, which for GST and income-tax records can be up to eight years.
• Data customers store: as long as the business keeps it. Retention settings in the app let the owner set how long to keep ID scans, guest details and access logs, with a floor of one year. The app does not delete invoices, and holds back guest-register entries for at least a year after the stay.
• When a business leaves: it has 30 days to export its data. After that we delete it from our live systems within 90 days. Copies in our encrypted backups are not edited; they expire on their normal cycle: daily and pre-update backups after 30 days, and monthly backups after 12 months.

9. How we protect it

Private files are never served from a public address, Aadhaar numbers are masked, staff can use two-factor sign-in, access to guest data is logged, connection secrets are encrypted in the database, and backups are encrypted with a key that is not kept on the server. Our Security and privacy page lists what is in place and what is not built yet. EkamOS has not been independently audited or certified.

10. Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data we process about you and the processing we carry out;
• have inaccurate or incomplete data corrected or completed, and have data erased when it is no longer needed for the purpose it was given for, unless the law requires us to keep it;
• withdraw consent you have given, as easily as you gave it (this does not affect processing that already happened);
• have a grievance about our handling of your data addressed;
• nominate another person to exercise these rights if you die or become unable to.

To use these rights for data where we are the Data Fiduciary, write to the Grievance Officer below. We may need to confirm your identity first. We will respond within 30 days. For data a business stores about you in EkamOS, contact that business; see section 2.

If you are not satisfied with our response, you can complain to the Data Protection Board of India.

11. Children

EkamOS is a tool for businesses and is not meant to be used by children. Businesses may record children, for example as accompanying guests or as residents of a student hostel. Where the DPDP Act requires verifiable consent from a parent or guardian, the business is responsible for obtaining it.

12. Grievance Officer

Grievance Officer, Infoveritas Technologies Pvt Ltd: grievance@ekamos.in

Write to the Grievance Officer with any complaint about how we handle personal data, or to use your rights. We will acknowledge your message within 7 days and aim to resolve it within 30 days. If you are not satisfied with the outcome, you can complain to the Data Protection Board of India.

13. Changes to this policy

We will post any change on this page and update the “Last updated” date. If a change materially affects how we handle customer data, we will tell customers by email before it takes effect.