Skip to main content

Legal

Security Policy

How we protect your hotel’s data, what we commit to operationally, and how to report a vulnerability to us.

Effective date
28 July 2026
Last updated
28 July 2026
Version
1.5
Contents (11 sections)

Every change to this document, most recent first.

VersionDateWhat changed
1.523 August 2026Corrected to describe both ways an account can start. Versions 1.0 to 1.4 said that every plan begins with a free trial and that nobody pays for Digilight PMS before they have used it in full. That is true of the trial route, and it is not true of the Subscribe route, which has always been able to take a first payment straight away without a trial — the application creates a subscription that is awaiting payment, with no trial window, and access begins when the payment is confirmed. The Terms and the Refund & Cancellation Policy now state both routes. The correction matters most in the Refund & Cancellation Policy, where the trial was given as the REASON there is no cooling-off period: for a customer who never took a trial, that reason did not hold, so the rule now stands on its own rather than on a premise that was false for them. No refund right has been removed or added, no price changed, no plan changed, and the surrounding commitments — no card is collected to start a trial, nothing renews automatically, nothing is charged without explicit consent — are unaltered. This is a correction of a factual statement about the product.
1.416 August 2026The free trial is seven days. The trial length was standardised across the plan catalogue on 11 August 2026: every plan row carries it and the signup route reads that row, so seven days is what an account receives. The Terms and the Refund & Cancellation Policy have been corrected to state the length the application actually grants, and the marketing site was corrected in the same change — including the structured data behind the search-result answer to "how does the free trial work". Nothing else moved: no price changed, no plan changed, no refund right changed, and the commitments that surround the trial — no card is collected, nothing renews automatically, nothing is charged without explicit consent — are unaltered. This is a correction of a factual statement about the product, not a change to what anyone is entitled to.
1.36 August 2026Corrected to describe the marketing site as it now behaves. For the India commercial launch the cookie consent banner was switched off, and with it Google Consent Mode: the analytics and advertising tools on digilightpms.com — Google Analytics 4, Google Tag Manager, Microsoft Clarity, the Meta Pixel and Google Ads conversion tracking — now run from the moment a page loads rather than after a choice. Versions 1.1 and 1.2 described a banner and a consent gate that a visitor is no longer shown, so every statement to that effect has been removed from the Cookie Policy and the Privacy Policy rather than left standing. Because the banner no longer carries the disclosure, the documents now do more of that work themselves: the Cookie Policy names every cookie actually set, who sets it and how long it lasts, and lists every way to switch them off — a single setting that blocks all of them at once, browser controls, and each provider’s own opt-out. Nothing was removed from the vendor disclosures, no retention period changed, and there is no change to what the application collects or to any commitment about hotel or guest data. The application still sets only its two sign-in cookies and still carries no analytics or advertising code.
1.25 August 2026Corrected the description of how consent is enforced. Version 1.1 said that nothing at all loaded before a visitor chose, and that rejecting meant the third parties received nothing whatsoever. The site has moved to the tag-manager arrangement Google recommends, in which Google Tag Manager loads on every page and consent governs what its tags are permitted to do. That distinction is small in substance and large in accuracy: the loader itself sets no cookies and sends nothing to Google Analytics, Google Ads, Meta or Microsoft before consent, but fetching it does disclose the request to Google. The Cookie Policy now says so plainly, explains what the loader is, and tells readers how to block it if they prefer. The Privacy Policy was updated to match. No change to what is collected, to any retention period, or to any commitment about hotel or guest data.
1.15 August 2026Consent-based analytics and advertising disclosed. The marketing website now asks for consent before loading anything that measures or advertises, and the Cookie Policy was rewritten to describe it: the four cookie categories and how long each lasts, the tools each category covers (Google Analytics 4, Google Tag Manager, Google Ads, Microsoft Clarity and the Meta Pixel), the Google Consent Mode v2 signals, and how to withdraw consent at any time. The Privacy Policy was updated to match, adding the marketing-site providers as a separate table and stating that they never receive application data and are never joined to a hotel account. Two stale factual claims were corrected: the dependency count and the number of social-media links. No change to the Terms, the DPA, or any commitment about hotel or guest data.
1.028 July 2026Approved for publication and put in force. The company facts needed to publish were supplied and applied across the suite: the operating name Digilight India, its place of business and jurisdiction at Meerut, Uttar Pradesh, its GST position (not registered), and its support and grievance contact. The clauses previously deferred to review were completed with standard terms: limitation of liability, indemnity, warranties, governing law and jurisdiction, breach-notification timing, sub-processor change notice, return and deletion, and the refund rules. Indexed, listed in the sitemap, and binding from the effective date.
0.3-draft14 July 2026Reconciled against the product. Click-wrap now exists, so the clauses that said no agreement was captured and no version was recorded are replaced by clauses describing what the software actually does. The IP address and user-agent recorded at signup are now disclosed, because collecting them without saying so would have been a new privacy gap opened while closing a contract one. Two false statements were removed from the product itself rather than written around. Still not reviewed. Still not in force.
0.2-draft13 July 2026Complete draft prepared for review by counsel. Every factual statement is drawn from the codebase; every legal judgement and unmade business decision is left as a marked block. Not reviewed. Not in force.
0.1-draft12 July 2026Section structure published for legal review. No operative terms.

Digilight PMS is a product of Digilight India. Questions about this document: support@digilightpms.com.