Privacy Policy

Orqaa is an operations platform for hotels and similar properties. This Privacy Policy explains what information we collect, why we collect it, who we share it with, and the choices you have.

Orqaa is operated by Nexus Infratech LLC, a Texas limited liability company (“Orqaa”, “we”, “us”, “our”). You can reach us about anything in this policy at support@orqaa.com.

Orqaa is a workplace tool. It is not used by hotel guests, and it holds no guest, booking or reservation data.

1. Who this policy covers

Two different groups of people use Orqaa, and our role differs between them. This distinction runs through the whole policy.

Account holders. Property owners, and the general managers and assistant general managers they authorize, register for Orqaa, pay for it, and control how it is set up. For information about account holders, we decide how that information is used — we are the controller, or the “business” under US state privacy laws.

Property staff. Housekeeping, maintenance, front desk, laundry and supplies teams use Orqaa on their employer’s account. They do not sign themselves up. The property’s owner or manager creates each staff record, either individually or by uploading a staff list. Staff then sign in with the property’s numeric code and by selecting their own name — no email address and no password are required.

For information about property staff, the property is the controller and Orqaa acts as its service provider. We handle staff information on the property’s instructions, to run the service, and for nothing else. If you are a member of staff and want to see, correct or remove your record, contact your employer first — they can do it directly. If you contact us instead, we will pass your request to the property and help them respond.

Third parties whose details a customer enters. Customers store emergency contacts such as a plumber, an electrician or an HVAC company, sometimes with an individual’s name and phone number. We hold this on the customer’s behalf and never contact these people ourselves.

2. Information we collect

2.1 Account information

For owners, general managers and assistant general managers:

First and last name
Email address
Phone number
Password — stored only as a cryptographic hash, never as text we can read
Username, for manager accounts created by an owner
Preferred language: English, Spanish, Hindi or Gujarati
Preferred notification channels
Role, and which departments the account can access

2.2 Staff information

For staff records created by a property:

First and last name
Role and assigned departments
Preferred language
Email address, only where the property chooses to provide one

Properties may add staff one at a time or by uploading a spreadsheet containing these fields.

2.3 Property information

Property name and address, time zone, and the hour the operating day rolls over
Property type, and brand or sub-brand where applicable
A numeric property code, generated by us, that staff use to sign in
Compliance dates such as a fire inspection or a liquor license, with due dates and reminder lead times
Emergency contacts: label, optional name, phone number
Property documents you upload, such as floor plans or operating procedures

2.4 Information created by using Orqaa

Tasks — titles, descriptions, departments, frequency, shift, room, due dates and point values
Task activity — for each task on each day: its status, who changed it and when, who completed it and when, points earned, notes, and any low-stock items flagged
Shift records — check-in and check-out times, current shift, and whether someone is checked in
Help requests — the request, the department and room it was raised to, replies, and the full history of who did what and when
Department activity logs — which employee performed which action, at which property, at what time
Supply tickets and low-stock reports
Points and leaderboards, where the property has turned rewards on
Voice notes recorded through your device’s microphone
Photographs, videos, PDFs and other files attached to tasks, help requests or property records
Reports — daily, weekly and monthly shift reports, produced as PDFs and, where enabled, sent by email or push notification

Together these records show individual employee activity at work. Section 9 explains what that means and who is responsible for telling staff about it.

2.5 Documents processed by our AI feature

You can upload a brand standards manual, a standard operating procedure or an existing checklist, and Orqaa will draft a task list from it. We extract the document’s text, send it to our AI provider, and keep the uploaded document along with a processing record: file name, size and type, status, how many tasks were produced, how long it took, and the name, email and role of the person who started it.

Please do not upload documents containing personal information, guest information, or confidential material belonging to someone else. This feature is built for operating manuals and checklists.

2.6 Payment information

Payments are handled by Stripe. Card numbers and other payment credentials are entered directly with Stripe and never reach Orqaa’s servers. We store a Stripe customer reference, your plan and billing cycle, billing country and currency, subscription and renewal dates, the status and date of your most recent payment, and a billing history containing amounts, invoice links, and the transaction references Stripe sends us.

2.7 Device and technical information

The platform your device runs on and the version of the app, sent with each request
A push notification token, if you allow notifications
Server logs recording the requests made to our service: method, path, response status, time taken, and the originating IP address
Information stored locally on your own device: your sign-in token, your role, your language, and your selected property code

2.8 What we do not collect

No hotel guest data. Orqaa has no guest-facing or booking function.
No biometric information, precise location, or health information.
No advertising identifiers, and no advertising. We do not run third-party analytics or behavioral tracking in the Orqaa mobile app.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have never done so.

3. Device permissions

The app asks for the permissions below. You can refuse any of them, or withdraw them later in your device settings. The related feature will stop working; the rest of the app will carry on.

Permission	What it is for
Notifications	Task reminders, help requests, shift reports and compliance alerts
Microphone	Recording a voice note on a task or help request
Files and photos	Attaching a photo or document, and uploading staff lists or standards documents
Network access	Communicating with our servers

4. How we use information

We use the information described above to:

create and administer accounts, and verify who is signing in
run the task, shift, help request, supplies, reporting and reminder features
send one-time passcodes and account security messages
deliver notifications and reports through the channels a property has chosen
draft task lists from documents you upload, when you ask us to
take payment, manage subscriptions, and keep billing and tax records
provide support and respond to feedback
keep the service secure, prevent abuse, limit request rates, and diagnose faults
understand how the service is used so we can improve it
comply with our legal obligations and enforce our Terms and Conditions

We do not use your information, or your customers’ or employees’ information, to train artificial intelligence models.

5. Artificial intelligence

Orqaa uses AI in exactly one place: turning an uploaded standards document into a draft task list.

The document’s text is sent to Anthropic PBC for processing. Under our agreement with Anthropic, this content is not used to train their models.
We send only the text of the document. We do not send account or staff records as part of that request.
The result is a draft for a person to review, edit and approve. It is not a compliance determination, and it carries no warranty. See our Terms and Conditions.

The in-app assistant, Orqaa Assist, answers a fixed set of questions about your own property’s live data. It runs entirely on our own servers using database queries — no AI model is involved, and none of your data leaves our systems when you use it.

6. Who we share information with

We do not sell personal information. We share it only with providers who help us run Orqaa, and only so they can do that work.

Provider	What they do	What they receive	Where
Anthropic PBC	AI drafting of task lists from documents	Text of uploaded standards documents	United States
Stripe, Inc.	Payment processing, subscriptions, invoices	Name, email, billing and payment records	United States
Google LLC (Firebase)	Push notification delivery	Push token, notification content	United States
SMS providers, including Twilio Inc.	Text message notifications, where enabled	Phone number, message content	United States and regional carriers
Email delivery provider	Transactional email, passcodes, shift reports	Email address, message content	United States
Cloud hosting and database providers	Hosting the application and its database	Service data	United States
Software development and support partners	Building, maintaining and supporting Orqaa under contract	Access to service data where needed for support	United States and India

We may also disclose information where the law requires it, in response to valid legal process, to establish or defend legal claims, to protect the rights and safety of Orqaa, our customers or the public, or to a buyer in connection with a merger or sale of the business — in which case this policy continues to apply.

Inside a property. By design, owners and managers can see the activity of staff at their property: who completed what and when, check-in and check-out times, points, and leaderboard position. Staff can see help requests and replies directed to their department. Our own support staff can access account and property records where needed for support, billing and abuse prevention.

7. Where information is stored

Orqaa’s servers and databases are located in the United States, and information you provide is stored and processed there. Some of our support partners work from India and may access service data from there in the course of maintaining the service, under contractual confidentiality and security obligations.

If you use Orqaa from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law differs from that of your own country.

8. How long we keep information

Information	How long we keep it
One-time passcodes and incomplete registrations	Deleted automatically within 24 hours
Account and property records	For as long as the account is active, then 90 days
Task, shift, help request and activity records	For as long as the account is active, then 90 days
Uploaded files, voice notes and documents	For as long as the account is active, then 90 days
Billing, invoice and tax records	7 years, as tax and accounting rules require
Server access logs	90 days
AI document processing records	24 months

Deleting a single task does not erase its history — completed work stays on the record so that past reports remain accurate.

After an account is closed, we keep data for 90 days so it can be recovered or exported, then delete or anonymize it. You can ask us to delete it sooner by writing to support@orqaa.com.

9. Monitoring in the workplace

Orqaa records identifiable information about what individual employees do at work: when they check in and out, which tasks they complete and which they do not, the help requests they raise and answer, their department activity, and their points and ranking where rewards are enabled. Owners and managers can see all of it, and it appears in shift reports.

If you are a property using Orqaa, you are responsible for:

telling your staff, before they start using Orqaa and in a language they understand, that this information is recorded and who can see it
obtaining any consent, and completing any notice or consultation process, that the law in your area requires
using this information lawfully in any employment decision

If you are a member of staff: the records above are visible to the owners and managers at your property. Your employer decides what is recorded and how it is used. Please raise any question about it with them.

Anyone who has the property code and appears on the staff list can sign in under that name. Properties should treat the property code as confidential and remove staff records promptly when someone leaves.

10. Security

We take these measures, among others:

Passwords are stored only as bcrypt hashes. One-time passcodes are hashed and expire after a few minutes.
All traffic between the app and our servers is encrypted using HTTPS.
Every request to our API requires a signed authentication token, and access to data is limited by role and by property.
Uploaded files are checked against a list of permitted file types, size-limited, and stored under randomly generated names.
Our API applies rate limiting and standard security headers.
Administrative functions are restricted to accounts holding an administrator role.

No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

11. Your rights and choices

Everyone. You can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, or delete it. Write to support@orqaa.com and we will respond within 45 days. If we need more time, we will tell you why and how long we need.

Residents of California, Texas, Virginia, Colorado, Connecticut, Utah and other states with comprehensive privacy laws. Depending on where you live, you may also have the right to: know what categories of personal information we collect, use and disclose; obtain a portable copy; correct inaccuracies; delete your information; opt out of targeted advertising, the sale of personal information, or profiling with legal effects; and not be treated differently for exercising any of these rights.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or automated profiling. There is therefore nothing to opt out of in those categories.

To exercise a right, email support@orqaa.com from the address on your account, or tell us enough about your record for us to find it. We will verify who you are before we act, because we will not hand someone’s employment record to the wrong person. An authorized agent may make a request on your behalf with written permission that we can verify.

Appeals. If we refuse your request, we will tell you why. You may appeal by replying to our decision within 45 days, and we will respond to the appeal within 60 days. If we deny your appeal, you may complain to your state Attorney General — for Texas residents, the Office of the Attorney General of Texas.

Staff records. If you are a member of staff at a property that uses Orqaa, your employer controls your record and can amend or delete it directly. Send your request to them. If you send it to us, we will forward it to the property and support them in responding.

Notifications. You can turn push notifications off in your device settings, and owners can change notification preferences in the app. We will still send essential messages about security, billing and your account.

12. Children

Orqaa is a workplace tool for business use. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child’s information has reached us, write to support@orqaa.com and we will delete it.

13. Changes to this policy

We will post any change on this page and update the date at the top. If a change materially affects how we handle your information, we will notify account holders by email or through the app at least 30 days before it takes effect.

14. Contact us

Nexus Infratech LLC, operating as Orqaa
support@orqaa.com

If you have a concern about how we handle your information, contact us first — we would rather fix it. You also have the right to complain to your state Attorney General or your local data protection authority.