How Makestays looks after your data.

Where your data is

The Makestays app and its database run on a server in Mumbai, India. Guest ID photos, task photos and message attachments are kept in private storage on the same server and are only shown through short-lived links.

Some data passes through the services that do the work: emails go out through Resend, WhatsApp messages through a WhatsApp Business provider, guest payments through Razorpay or Stripe, and AI reply drafts through DeepSeek, which receives the guest messages a draft is written from.

Payment keys and door codes

Your Razorpay and Stripe keys are stored encrypted and are never shown again in full after you save them.

Smart lock door codes are stored encrypted and can only be read by the server, never by the app in a browser.

No card data

Makestays does not store guests' card details. Guests pay on Razorpay's or Stripe's own checkout, into your account. Card details that a channel sends with a booking are removed before the booking is saved.

Backups

The database is backed up every night.

Team access

Each person on your team has their own sign-in and a role: owner, manager, front desk, cleaner or viewer. Every page and every action checks the role, and a member can be limited to the properties you choose. Revenue is only shown to roles with finance access.

Guest IDs

ID photos that guests upload at check-in are seen only by you and the team roles that handle check-ins, and are deleted 30 days after check-out by default.

What we do not claim

Makestays does not hold a security certification such as SOC 2 or ISO 27001, and we do not publish an uptime figure. If your business needs either, ask us before you sign up.