Privacy Policy
Last updated September 23, 2026
This policy explains what Kanha (“we”) collects when you use the Service, what we do with it, and the choices you have. It covers two kinds of people: the members of a workspace (hotel and rental staff), and the guests whose stays those workspaces manage.
What we collect
- Workspace members: name, email address (admins), role, sign-in activity, and the actions you take, which are kept in your workspace’s audit log.
- Guests: the details a property records for a stay — name, email, phone, postal address, party size, stay dates, notes, messages sent through the guest link, and, where a property uses it, identity verification results and signed policies.
- Payments: card payments are handled by Stripe. We never see or store full card numbers; we keep the payment reference, amount, and the last four digits and brand of a card saved on file.
- Technical: the address and browser making each request, kept in short-lived server logs for security and troubleshooting.
How we use it
To run the Service for the workspace: managing reservations, folios, housekeeping, messaging and reports; sending the emails a property asks us to send (booking confirmations, receipts, check-in links); keeping accounts secure; and meeting legal obligations such as guest registers where they apply. We do not sell personal data and do not use guest data for advertising.
How it is protected
Guest names, contact details and addresses are encrypted at rest with a key held outside the database. Access is scoped to the workspace that recorded the data; every request is checked against it. Staff sign in with codes or passwords plus a second factor for admins, and sessions expire. Money-moving actions require re-authentication.
Who else sees it
We use these providers to run the Service, each under its own data protection terms and only for the purpose named:
- Vercel — hosting and request logs.
- Supabase — the database and sign-in for admin accounts.
- Stripe — card payments, payouts and, where used, identity checks.
- Channex — connections to online travel agencies, when a property turns them on.
- Seam — smart-lock door codes, when a property connects locks.
- The email provider a property configures (its own mailbox or our sending service) — for the emails it sends to guests.
Beyond these, we disclose personal data only when the law requires it or to protect the Service and its users.
How long we keep it
Stay records are kept for as long as the workspace exists, because they are the property’s books. Identity verification results are deleted on a short schedule after the stay. Server logs are kept for a few weeks. When a workspace is closed its data is deleted after a grace period during which the owner can export it.
Your choices
Guests can ask the property that holds their record to see, correct or delete it; the property can do so from the guest’s profile. Workspace members can update their own details from the team page. Where a right under data protection law applies to you, contact us through the Get help page or the contact address on the home page and we will help the responsible property respond.
Changes
We will post any change to this policy here and, for material changes, tell workspace owners in the product first.