Privacy Policy
This Privacy Policy explains how Guestrar Inventory collects, uses, and safeguards personal information, business records, and stock data across our multi-tenant delivery challan and inventory platform.
1 Information We Collect
When you register an account, utilize the inventory portal, or interact with our mobile application, we may collect the following categories of information:
- Account & Identity Information: Full name, business email address, phone number, designated company affiliation, encrypted passwords, and profile avatars.
- Enterprise Inventory & Master Data: Product catalog, SKU codes, item categories, stock transactions, customer/vendor party details, and delivery challans generated within your tenant scope.
- Authentication & Security Logs: One-Time Passwords (OTP), login timestamps, IP addresses, browser agent strings, and session activity logs to prevent unauthorized access.
- Inquiry & Support Communications: Messages, email correspondence, and support requests submitted via our public contact channels.
2 How We Use Your Information
We use collected data solely for legitimate business, operational, and security purposes, including:
3 Multi-Tenant Architecture & Data Isolation
Guestrar Inventory is designed with strict multi-tenancy controls. Each registered company operates inside its own isolated logical partition:
✓ Scoped Data Queries
Every database request automatically applies tenant filters ensuring that users from Company A cannot query, view, or alter records belonging to Company B.
✓ Role-Based Permissions
Sub-administrators and staff only access modules explicitly granted by their designated company administrator.
4 Data Protection & Security Practices
We implement industry-standard administrative, physical, and technical safeguards:
- Encryption in Transit: All HTTP interactions with web interfaces and API endpoints are encrypted using standard TLS (Transport Layer Security).
- Cryptographic Hashing: User passwords are encrypted using one-way bcrypt hashing algorithms. Plaintext passwords are never stored or logged.
- Sanctum Token Security: Mobile and external API connections are authenticated via bearer tokens with rate limiting and automatic expiration.
- Expiring OTP Codes: Email OTP codes used during login and password resets expire automatically within 10 minutes to prevent replay attempts.
5 Data Retention and Account Termination
We retain company records as long as your tenant subscription is active or in grace period status. If an account is permanently canceled or terminated, inventory data may be retained for up to 90 days to permit export before irreversible purging, unless statutory financial regulations require extended audit archives.
6 No Third-Party Data Monetization
We have a zero-tolerance policy against commercial data trading: we never sell, rent, or lease your inventory numbers, customer lists, or personal information to third-party advertisers or data brokers.
7 Your Rights & Questions
Depending on your jurisdiction, you have the right to request access to your personal data, rectify inaccuracies, request deletion, or export your delivery challan and party records.