Privacy notice
Carion Labs · last reviewed 29 September 2026 · questions to [email protected]
Carion is property-management software for hostels, hotels, guest houses and homestays. Two kinds of people give us data: hosts (the properties that use Carion and their staff) and guests (people who stay at those properties). This notice covers both. It is written for India’s Digital Personal Data Protection Act, 2023 and follows the same principles for everyone else.
Who is responsible for what
- For host account data (your name, email, business details, billing), Carion Labs is the data fiduciary.
- For guest data, the property you stay at is the data fiduciary: it decides what to collect and why, within the law. Carion Labs processes that data on the property’s instructions, as its data processor. Each property is separate — one property never sees another property’s guests.
What is collected, and why
- Guests: name, phone, email, nationality, address and a government ID, because Indian hospitality rules require a guest register and, for foreign nationals, a Form III (Form C) report to the Bureau of Immigration. For Aadhaar the number is hidden on the device that captures the card: we keep a masked copy (every digit but the last four blacked out), the details printed on it and, when its QR code reads, the outcome of UIDAI’s signature check — never the full number. For a passport, driving licence or voter ID the number and, at check-in, a scan are kept. Also your booking dates, room or bed, charges and payments, and anything you order or request through the guest portal.
- Hosts and staff: name, email, role, what you do in the app (an activity log per property), and billing details for the Carion subscription.
- Not collected: card numbers (card payments are handled entirely by an RBI-regulated payment gateway and never reach Carion), precise location, advertising identifiers.
Where it is kept and how it is protected
Host and guest records are kept in a managed database in Mumbai, India. What protects them:
- Encryption in transit (HTTPS everywhere) and at rest.
- Separation between properties. Every record belongs to one property, and every screen and action checks that the person asking belongs to it. One property never sees another property’s guests, staff or money.
- Roles inside a property. The owner decides who can see finances, guest history, settings and the team. Every teammate has their own login, so the activity log shows who did what.
- ID documents get extra care. Scans sit in private storage, are shown only to signed-in staff of that property through short-lived access, and are deleted automatically after the retention period. For Aadhaar only a masked copy is stored — never the full number.
- Sign-in safety. Passwords are stored only as one-way hashes, repeated wrong attempts are slowed down and staff PIN logins lock, a password reset signs every device out, and a change of sign-in email must be confirmed from the new address.
- Support access is by invitation. The Carion team sees a property’s data only when that property invites us onto its team, and it can remove us at any time.
- Backups. An encrypted backup is taken every night, kept for 35 days outside the primary database, and restored in a drill so we know it works.
- Incidents. If personal data is ever exposed, affected hosts are told within 24 hours and the authorities within the time the law sets.
Who else receives data
Only service providers needed to deliver a function, each for that function alone and bound by contract to protect the data. These are Carion’s sub-processors. Hosts are told before one is added or replaced, and the named list is part of the data-processing addendum and available to any host on request.
| Kind of provider | Purpose | What it receives | Where |
|---|---|---|---|
| Database and file storage provider | Primary database and private file storage | All host and guest records, ID scans | Mumbai, India |
| Application hosting provider | Runs the Carion application | Requests in transit, short-lived logs; no database of its own | Singapore |
| Email delivery provider | Transactional email | Recipient name and email, message content | United States / Japan |
| Payment gateway (RBI-regulated) | Online payments and subscription billing | Amount, reference, payer contact; card data is held by the gateway only | India |
| Product analytics | To see which screens hosts use and where they get stuck | Pseudonymous host id, role, organisation id, property id, screen names and named actions; masked screen recordings of host sessions; anonymous page steps for guests | United States |
| Channel manager | Keeps the property’s online travel agency listings in sync; Carion operates it on the property’s behalf | Availability and rates out; online travel agency bookings in | India / Germany, depending on the platform Carion runs the property on |
| AI model provider (Cari) | Cari assistant: answers questions and prepares drafts that a person confirms | The question asked (which may include guest details the host types) and the property data needed to answer it; never identity documents; not used for training, kept only for a limited time | United States |
| AI model provider (documents) | Reading ID documents for the guest register: passport text for Form III; Indian ID cards; name, date of birth and address from a masked Aadhaar copy when its QR code cannot be read | The document image at the moment of reading — for Aadhaar only a copy masked on the device (the full number never leaves it); not used for training | United States |
| Messaging app for staff alerts | Operational alerts to a chat the property links itself | Alert text (may include a guest name) | Outside India |
| Network security provider | Domain name service and the signup bot check | IP address and browser signals of the person signing up | Global |
| Backup storage provider | Encrypted nightly database backup (35 days) | Encrypted backup file; unreadable without Carion’s passphrase | United States |
Passport and ID images (Aadhaar only as a masked copy), Cari questions, email delivery and encrypted backups are handled outside India by the kinds of provider marked above; guest and booking records themselves stay in India.
Nothing is sold, shared with advertisers, or used to train AI models.
Cari, the AI assistant
Cari answers questions from a property’s own team about that property and prepares drafts for them. What someone asks Cari (which may include guest details they type) and the property data needed to answer it are processed by an AI model provider, under an agreement that it is not used to train AI models and is kept only for a limited time. Guest identity documents are never sent: Cari has no access to the ID scans, passport images or document numbers a property keeps. Cari only drafts. Nothing is booked, moved or changed until a person at the property confirms it, and Carion never sends a message Cari has drafted.
How long it is kept
- Guest ID scans (passport, driving licence, voter ID, and the masked Aadhaar copy) are deleted automatically after the property’s retention period (90 days after check-out unless the property sets otherwise). The full Aadhaar number is never stored. The register entry — name, document type and number (masked for Aadhaar) — is kept as the law requires.
- The guest register (name, address, ID type and number, arrival and departure) is kept for at least three years, because police and lodging rules require a register that can be produced on demand.
- Particulars of foreign guests reported on Form III (Form C) are kept for at least one year from the stay, as the Bureau of Immigration requires. That includes the details handed to the property’s browser extension for a filing. A foreign guest’s visa page may be read for text extraction only, like the passport page; the optional photograph taken for the portal is stored with the ID scans and deleted with them.
- Bookings, folios, invoices and payments are kept for at least seven years, as tax law requires of the property.
- The activity log (who changed what, when) is kept for at least one year. Encrypted database backups expire after 35 days.
- A guest’s credential wallet (saved identity details for faster check-in) is kept until the guest deletes it, and is released to a property only with the guest’s consent for that stay.
- Host accounts and their property data are deleted on request at the end of a contract.
Your rights
You can ask what we hold about you, have it corrected, have it erased where the law does not require us to keep it, and withdraw consent you gave (for example for your credential wallet). Guests should contact the property they stayed at first, since it is the fiduciary for their stay; either way, write to [email protected] and we will respond within 30 days. If you are not satisfied you may complain to the Data Protection Board of India.
Grievance officer
The Grievance Officer, Carion Labs — [email protected]. Complaints about how personal data is handled are acknowledged within 48 hours and resolved within 30 days.
If something goes wrong
If personal data is ever exposed, lost or accessed without authority, Carion tells the affected property without delay, reports to CERT-In and the Data Protection Board as the law requires, and helps the property tell the guests affected: what happened, when, what it means for them and what they can do.
Cookies
Carion sets one session cookie to keep you signed in (HTTP-only, secure, 7-day idle expiry) and remembers per-device preferences such as your active property. There is no advertising or cross-site tracking.
Changes
When what we collect, where it goes or how long we keep it changes, this page changes in the same release and the review date above moves.