Privacy Policy — Invow Hotels

Last updated: 11 September 2026

This policy explains how the Invow Hotels mobile application handles information. The app is published by Invow Maldives LLP (Registration No. P01012026).

Who controls the data

Invow Hotels is business software used by hotel and guesthouse staff. It is not a consumer app.

• The hotel that licenses Invow Hotels is the controller of all guest information entered through the app. The hotel decides what is collected, why, and how long it is kept.
• Invow Maldives LLP is the processor. We host and transmit the data on the hotel's behalf and act on the hotel's instructions.

If you are a hotel guest and want to know what a property holds about you, contact that property directly. We cannot release another business's guest records to third parties.

Information the app handles

Staff account information

When a hotel creates your staff account, we process your name, email address, assigned role (front desk, housekeeping, airport, vendor, administrator), and the property you are assigned to. Passwords are stored only as salted hashes and are never readable by us.

Guest information entered by staff

Staff use the app to register and manage guests. Depending on the task, this can include:

• Full name, email address, and telephone number
• Nationality, country of residence, date of birth, and gender
• Identity document type and number (passport, national ID, or similar)
• Photographs of identity documents — passport, ID card, or visa, up to four images per guest
• Details of accompanying guests, including children
• Booking, stay, payment, and folio records

Much of this is collected because Maldivian tourism regulation requires properties to maintain a guest registry. The hotel, not Invow Maldives LLP, determines the lawful basis for collecting it.

Device information

• Push notification token — issued by Expo and sent to your hotel's Invow Hotels server so the app can receive operational alerts (arrivals, housekeeping tasks, service requests).
• Device model and operating system version — used only to deliver notifications correctly.
• Network connectivity status — used to decide whether to work offline.

Information stored on your device

• An offline copy of your hotel's booking, room, and guest records, held in an app-private database so staff can keep working without a connection. It is removed when you sign out or uninstall the app.
• Your authentication token, held in the device's secure keychain (iOS Keychain / Android Keystore).

Camera and photo library

The app requests camera and photo library access for one purpose: capturing images of guest identity documents during registration, and setting a property photo. Images are uploaded to your hotel's Invow Hotels server and are not stored in any shared or public location. The app does not scan, index, or read any other photo on your device.

Where information goes

All information is transmitted over encrypted HTTPS to invowhotels.com, the Invow Hotels platform operated by Invow Maldives LLP. Each hotel's data is isolated from every other hotel on the platform.

We use two third-party services:

Service	Purpose	What it receives
Expo push service	Delivering push notifications	Push token, notification content
Expo EAS Update	Delivering app updates	App version and update check only — no personal data

What we do not do

• We do not sell or rent personal information.
• We do not use advertising networks or advertising identifiers.
• We do not use analytics or tracking SDKs. The app contains none.
• We do not track you across other apps or websites.
• We do not access your location.
• We do not access your contacts, calendar, microphone, or health data.

How long information is kept

Guest records are retained by the hotel for as long as the hotel requires, including any period mandated by Maldivian tourism and tax regulation. Staff account records are kept while the account is active. When a hotel ends its subscription, its data is deleted or returned at the hotel's request.

Security

Data is encrypted in transit using TLS. Authentication tokens are held in platform secure storage. Access is restricted by role, and every record is scoped to a single property so no hotel can see another's data.

No system is perfectly secure. If a breach affects your information, we will notify the affected hotel without undue delay so it can inform the people concerned.

Children

The app is for hotel staff and is not directed at children. Staff may enter details of child guests as part of a booking, on the hotel's instruction and responsibility. We do not knowingly collect information directly from children.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or restrict the use of your personal information, and to object to its processing.

• Hotel staff — contact your hotel administrator, or us at the address below.
• Hotel guests — contact the property you stayed at. It holds your records and decides how they are used. We will support any property responding to such a request.

Account and data deletion

Hotel staff can request deletion of their account through their hotel administrator, or by emailing us directly. To request deletion of an entire hotel account and its data, email us from the address registered to that account.

Changes

We will update this page when the app's data practices change, and revise the date at the top. Material changes will be communicated to subscribing hotels directly.