Legal · SAAS-404
Privacy policy
This Privacy Policy explains how the Tetrea platform operator (“Tetrea”, “we”, “us”) collects, uses, and shares personal data when you visit our marketing site, create a subscription account, or use Tetrea as staff of a hospitality customer.
For guest and operational data that customers store in the product, customers typically act as controllers and Tetrea acts as a processor. That relationship is covered in our Data Processing Agreement.
1. Who this policy covers
- Visitors to the public marketing and pricing site
- Organisation owners and staff users of Tetrea
- People who request a demo or contact us
It does not replace a property’s own guest-facing privacy notice for direct booking sites.
2. Data we collect
Account and billing
Name, email, organisation name, property details, role, authentication data (including MFA secrets where enabled), subscription package, invoices, payment status, and usage metering (properties, rooms, seats, outlets, modules).
Product usage
Audit logs for sensitive actions, support diagnostics (when authorised), device registry metadata for POS terminals, and technical logs (IP, user agent, timestamps) needed to secure the service.
Marketing site
Contact form or mailto enquiries, and standard web server logs. We do not sell personal data.
Customer-hosted guest data
Reservations, guest profiles, folios, preferences, and related hospitality records are processed on behalf of the customer under the DPA — not for Tetrea’s independent marketing.
3. How we use data
- Provide, secure, and improve the SaaS platform
- Authenticate users and enforce entitlements and metering
- Bill subscriptions, send dunning and trial notices, and issue invoices
- Respond to support and demo requests
- Comply with law and protect against abuse or fraud
4. Legal bases (where applicable)
Depending on your location, we rely on contract performance (providing the subscription), legitimate interests (securing multi-tenant infrastructure, product analytics that do not override rights), consent where required (certain cookies or marketing), and legal obligation.
5. Sharing
We share personal data only with:
- Infrastructure and email subprocessors needed to run the service
- SaaS payment providers for subscription billing (distinct from guest payment gateways)
- The platform Channex connection when the channel module is entitled and configured
- Professional advisers or authorities when legally required
We do not sell personal data. Platform support may view tenant data only under audited impersonation or support override flows when authorised.
6. International transfers
Tetrea is Maldives-first. Data may be processed in regions where our hosting or subprocessors operate. Where required, we use appropriate transfer safeguards (contractual clauses or equivalent).
7. Retention
Account and billing records are kept for the life of the subscription and as needed for tax and dispute resolution. After cancellation, Customer Data follows the product retention / read-only grace window, then deletion or anonymisation unless law requires longer retention. Security logs are retained for a limited operational period.
8. Security
We apply access control, encryption in transit, tenant isolation (including database RLS where deployed), audit logging for financial actions, and least-privilege admin tools. No method of transmission or storage is perfectly secure; please protect staff credentials and enable MFA where offered.
9. Your rights
Subject to applicable law (including Maldives data protection rules and, where relevant, GDPR), you may request access, correction, deletion, restriction, or portability of personal data we hold as controller, and object to certain processing. Staff users should also contact their organisation owner for data held in the property tenant. Contact [email protected].
10. Children
The marketing site and staff product are not directed at children. Guest records that include minors are processed only as instructed by the customer property.
11. Changes
We will update this page when practices change and adjust the “Last updated” date. Material changes may also be notified in-product or by email to organisation owners.
12. Contact
Privacy enquiries: [email protected] · Legal: [email protected] · Contact
This policy is a platform commercial draft for launch readiness. Final counsel review may refine jurisdiction-specific disclosures before broad public sale.