Privacy
Last updated 22 August 2026
Inviterly is software that hotels and guesthouses in Seychelles use to check guests in, talk to them and bill them. Most of the personal information in it is there because a property put it there, or because a guest gave it to their property through us.
Who decides what happens to your data
If you are a guest, your hotel is in charge of your information. They decide what to ask for, how long to keep it and who at the property may see it. We hold and process it on their instructions — we do not sell it, we do not use it to advertise to you, and we do not use it to train AI models.
If you are a member of hotel staff, your Inviterly account — your name, work email and what you did in the system — is ours to look after directly.
So a guest asking to see or delete their information should ask their property first. We will help them do it, and we will act on a request sent straight to us, but the property is the one who decides.
What we hold about guests
- Your booking — name, dates, room, rate, who sold the stay, and contact details, arriving from the property's booking system or typed in at the desk.
- What you give at check-in — address, nationality, date of birth, travel details, signatures on house rules, and the answers to whatever else your property asks.
- Identity documents — a photograph of a passport or ID, and in some properties a selfie. This is the most sensitive thing we hold and it is described on its own below.
- Messages — what you send the property and what it sends you, over WhatsApp, email or the in-app chat.
- Your bill — room, extras, breakfast and excursion orders, the tourism levy, and payments recorded against it.
- Technical records — the times your guest link was opened and the addresses it was opened from, kept so we can spot someone attacking it.
Guests do not get an account or a password. Your stay has a private link, and that link is the key to it. It stops working seven days after you check out, and a property can revoke it sooner — which is why the link is worth treating like a room key and not forwarding.
Passport scans and selfies
Document images go into private encrypted storage, never a public address. Nobody browses to them: each viewing produces a fresh link that stops working after ten minutes, and every one of those viewings is written to an audit record showing who looked and when.
By default the image files are destroyed 30 days after checkout. Your property can shorten that, and can be required to keep the details it read from the document — name, document number, nationality, dates — for longer, because Seychelles law requires accommodation providers to keep a register of their guests. Deleting the picture and keeping the register entry is the normal outcome.
Where AI is used, and where it is not
Some properties switch on automatic passport reading, which uses Anthropic's Claude to read a document instead of the built-in recogniser. When it is on, only the machine-readable strip is sent — the two lines of characters along the bottom of the page. The photograph, the signature and every other part of the document stay here. The check digits built into that strip are verified afterwards exactly as before, so a misreading fails rather than passing quietly.
Properties may also use AI to draft replies to guests and to translate messages. In every case the text is sent to be processed and returned. It is not used to train anybody's model.
Payments
Card payments are handled by Stripe. Card numbers are entered into Stripe's own fields and never reach Inviterly — we are told that a payment succeeded, for how much, and the last four digits, and that is all we store. Where a property takes payment at the desk instead, we record only that it happened.
Messaging
WhatsApp messages travel through Meta's WhatsApp Business Platform and are subject to WhatsApp's own terms and privacy policy as well as this one. Email is sent and received through Resend. Both carry the message content and your contact details, because that is what delivering a message means.
Who else sees it
We use a small number of companies to run the service. Each sees only what its job needs:
- Cloudflare R2 — stores document images and photographs.
- Railway — runs the application and its database.
- Vercel — serves the web apps.
- Stripe — takes card payments.
- Meta — delivers WhatsApp messages.
- Resend — delivers email.
- Anthropic — reads passport strips and drafts text, where a property has enabled it.
- Your property's booking system — for example Cloudbeds, which stays in sync with Inviterly.
These providers operate outside Seychelles, so running the service involves sending data abroad. We do not sell personal information to anyone, and we do not share it with advertisers. We will disclose it if the law requires us to.
One property can never see another's guests. Separation between properties is enforced by the software on every single request, not by staff remembering to be careful.
How long it is kept
- Passport and ID images — 30 days after checkout by default, and a property may set it shorter.
- Guest links — dead seven days after checkout.
- Booking, register and billing records — for as long as your property needs them, including any period the law obliges them to keep.
- Messages — kept with the stay unless the property removes them.
- Audit records of who viewed a document — kept, because their whole purpose is to survive the thing they describe.
Keeping it safe
Everything travels encrypted, and document storage is encrypted at rest and closed to the public internet. Staff accounts have roles, so housekeeping does not see a folio and a receptionist does not see everything an owner sees. Passwords, tokens, card details and links to documents are never written into our logs. Signing out of a device everywhere takes effect immediately rather than waiting for a session to expire.
No system is perfect. If something happens to your information we will tell your property without delay, and we will tell affected people where we are required to.
Your rights
You may ask to see what is held about you, to have it corrected, to have it deleted, and to object to a particular use of it. Guests of properties in the European Union or travelling from it have these rights under the GDPR; Seychelles data protection law applies too. Ask your property, or write to us and we will pass it on and help.
Deleting your data
If you are a guest: ask the property you stayed with, or email privacy@inviterly.com with your name and the dates of your stay. We will confirm with the property and delete what is not legally required to be kept — and we will tell you plainly what has to stay and why. Your passport images are destroyed on the schedule above whether or not you ask.
If you are a property: disconnecting WhatsApp in Integrations removes the credential immediately. To close an account and have its data erased, email us from the owner's address and we will delete it, including backups, within 30 days.
We answer within 30 days.
Children
Inviterly is not for children to use. Children do appear in a booking — a child's age is recorded because the tourism levy exempts young children, and a family's check-in may include a child's passport. That information is given by the adult travelling with them and is treated exactly as any other guest document.
Changes
If this policy changes we will change the date at the top, and we will tell properties directly when the change is one that matters.
Contact
Write to privacy@inviterly.com. If you are a guest, telling us which property you stayed at and when will get you a much faster answer.