Privacy Policy

Scope of This Policy

This Privacy Policy applies to personal information we collect:

• Through websites owned and operated by us, including https://innexo.com and related pages ("Sites");
• Through our software applications and services (including the Innexo Property Management System / Hotel Management Platform) available via computers and mobile devices ("Apps");
• Through social media pages we control ("Social Media Pages");
• Through communications we send to you that link to this Privacy Policy and through your communications with us online or in person ("Communications"); and
• From other third-party sources such as public databases, marketing partners, and integration partners, where permitted ("Third-Party Sources").
• In this Privacy Policy, we refer to the Sites, Apps, Social Media Pages, and Communications collectively as the "Services."

Important Notice for Hotel Guests / Travelers

Innexo provides software used by hotels, lodging providers, and property managers. If you are a guest/traveler, Innexo may provide the platform through which your reservation, check-in, communications, or other services occur. However, the personal information you provide to a hotel or lodging provider is subject to that provider's own privacy practices and policies.

1) Our Role: Controller vs. Processor

Innexo may act in different roles depending on the context:

• Hotels/Lodging Providers using Innexo typically act as Data Controllers for guest information (they decide why and how guest data is processed).
• Innexo typically acts as a Data Processor / Service Provider for guest data processed on behalf of the hotel, subject to the hotel's instructions and our agreements.
• Innexo acts as a Data Controller for information about our business customers, prospects, website visitors, and users who create accounts directly with Innexo (e.g., demo requests, billing contacts, platform administrators).
• If you are a guest and want to exercise privacy rights about your stay, please contact the hotel/lodging provider first. Where applicable, Innexo will assist our customers in responding to valid requests.

2) Personal Information We Collect

A. Information You Provide to Us. We may collect personal information you provide when you use the Services, including contact data (first/last name, salutation, email address, phone number, mailing/billing address, professional title, company name); account data (username, password stored securely, authentication data, preferences, and settings); communications data (emails, chats, messages, feedback, forms, and other communications with us); support data (screenshots, videos, logs, files, or other information you provide to support for troubleshooting or investigation); payment and transaction data (billing details, invoices, payment status/history, and transaction metadata; payment processing may be handled by PCI-compliant providers); marketing data (preferences for receiving marketing communications and your engagement with them); and audio/electronic/visual data (recordings or transcripts of calls or meetings where permitted by law, and content you choose to submit).

B. Guest Data Entered by Hotels/Lodging Providers (Processed on Their Behalf). Hotels using Innexo may store guest information such as guest identity and contact details; reservation details (arrival/departure, room assignment, rates, folio information); stay history and preferences; notes added by hotel staff; and messages and service requests (where used).

C. Hotel Operational and Business Data. Innexo may process operational data such as room inventory and availability; rate plans and pricing; housekeeping status and task assignments; audit logs and operational reporting; and integrations configuration and sync status.

D. Information from Third-Party Sources. We may receive information from integration partners (e.g., channel managers, OTAs, payment providers, accounting systems) as configured by the hotel; public sources (e.g., publicly available professional information) where permitted; and marketing and event partners (e.g., co-sponsored webinars) where permitted.

E. Automated Collection (Device/Usage Data). We, our service providers, and business partners may automatically collect information about you and your device over time, including log data (IP address, device identifiers, browser type, OS, timestamps, pages viewed, referral URLs, crash/error logs); usage data (feature usage, settings changes, session duration, and performance metrics); communication interaction data (whether you open/forward emails or interact with messages, often via pixel tags/clear GIFs embedded in emails, where permitted); and web beacons (small images that may provide limited information such as cookie number, time/date, and page description).

3) Cookies and Similar Technologies

Some automatic collection is facilitated by cookies and similar technologies. We use them to:

• Maintain secure sessions and authentication
• Prevent fraud and protect accounts
• Remember preferences
• Improve performance and analytics
• Measure marketing effectiveness (where applicable)
• You can manage cookies in your browser settings. If you disable cookies, some features may not function. See our full Cookie Policy.

4) Sensitive Personal Information

Innexo does not intentionally collect sensitive categories of information (e.g., health data, data revealing racial/ethnic origin) through the Sites.

Biometric Data (Only if You Opt-In / Device-Based): If the Innexo App supports device-based biometric login (e.g., Face ID/Touch ID), biometric templates remain on your device and are managed by your device operating system. Innexo does not store biometric templates.

5) How We Use Personal Information

• A. Services and Operations: provide, maintain, and operate the Services; create and manage user accounts; provide customer support and troubleshooting; process payments and billing; communicate service messages, updates, and administrative information.
• B. Service Improvement, Analytics, and R&D: improve the Services and develop new features; understand how users interact with the Services; create aggregated, de-identified, or anonymized data for analytics and product development (and we will not attempt to reidentify it).
• C. Security, Fraud Prevention, and Safety: detect, prevent, and respond to security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; debug, maintain reliability, and prevent misuse.
• D. Marketing (Business-to-Business): send newsletters and product updates (you can opt out); provide event or webinar information; measure marketing performance (where permitted).
• E. Legal Compliance and Protection: comply with applicable laws and lawful requests; enforce our terms and agreements; protect our rights, privacy, safety, and property (including legal claims).
• F. New Purposes: We may use personal information for purposes not described here where permitted by law and compatible with the reason it was collected, or with your consent where required.

6) AI and Automated Processing

Innexo may provide AI-assisted features (e.g., operational insights, forecasting, housekeeping prioritization, reporting summaries, or recommendations). These features may analyze platform usage and operational data to provide functionality within the Services.

We do not use Plaid data to train public models.

7) Plaid and Financial Data

If you choose to connect a bank account through Plaid, Plaid facilitates the secure connection to your financial institution. Innexo may receive certain financial data from Plaid as authorized by you, such as account identifiers, balances, and transaction history.

Innexo does not receive or store your banking credentials.

Plaid's end-user privacy policy is available at https://plaid.com/legal/#end-user-privacy-policy.

8) How We Share Personal Information

We may share personal information with:

• Affiliates (if applicable)
• Service Providers who help operate our Services (cloud hosting, support tooling, analytics, monitoring, security providers)
• Third Parties You Designate (integrations you enable, e.g., OTAs, channel managers, accounting providers)
• Professional Advisors (legal, auditing, accounting)
• Authorities and Others when required by law or to protect rights and safety
• Business Transferees in connection with a merger, acquisition, financing, reorganization, or sale of assets
• Our Practices (Sale/Sharing): We do not sell personal information for monetary compensation. However, some privacy laws define "sale" or "sharing" broadly to include certain types of disclosure for targeted advertising. Where applicable, you may opt out of "sale"/"sharing" as described in the State Privacy Rights section.

9) SMS Communications

By providing your phone number to Innexo, you consent to receive transactional SMS messages related to your account, platform activity, support requests, operational alerts, and verification codes. Message frequency varies. Message and data rates may apply. Reply STOP to opt out. Reply HELP for help.

Mobile information will not be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

SMS messages from Innexo are strictly transactional in nature and are not used for marketing or promotional purposes. You may opt out of SMS messages at any time by replying STOP. For assistance, reply HELP or contact support@innexo.com.

10) Your Choices

• Opt-Out of Marketing Emails: You can opt out by using the unsubscribe link in the email. You may still receive service-related communications.
• SMS/Text Messages: You can opt out of transactional SMS messages at any time by replying STOP to any message. Reply HELP for help.
• Cookies: Adjust cookie settings in your browser. See our Cookie Policy.
• Do Not Track / Global Privacy Control (GPC): Some browsers provide signals such as Global Privacy Control (GPC). Where required, we honor recognized opt-out signals for sale/sharing and targeted advertising.

11) Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including to comply with legal obligations and maintain business records.

When information is no longer required, we may delete it or de-identify/anonymize it. De-identified/anonymized data may be retained and used without further notice.

Hotels control retention and deletion of guest data stored in their Innexo account, subject to legal requirements and contractual obligations.

12) Security

We maintain reasonable safeguards designed to protect personal information, including:

• TLS encryption in transit (TLS 1.2+)
• Encryption at rest
• Role-based access controls
• MFA for administrative and infrastructure access
• Logging and monitoring
• Network security controls and firewalls
• No system is perfectly secure. You use the Services at your own risk. For more details, see our Security page.

13) Third-Party Sites

Our Sites may link to third-party websites. We do not control their practices. Please review their privacy policies.

14) International Data Transfers

We are headquartered in the United States and may use service providers in other countries. Your information may be transferred to, stored, and processed in the U.S. and other jurisdictions, which may have different privacy protections.

15) Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 without legally required consent.

16) Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date and post the revised policy.

17) How to Contact Us / Exercise Your Rights

For questions or privacy requests, email security@innexo.com. We may need to verify your identity before processing certain requests.

State Privacy Rights Notice (U.S.)

This section provides additional information to individuals in states with privacy laws that provide additional rights, including California (CCPA/CPRA) and other applicable U.S. state laws.

A. Rights You May Have (Depending on Your State). You may have the right to: know/access the personal information we collect and how we use it; request deletion of personal information (subject to exceptions); request correction of inaccurate personal information; opt out of sale or sharing for targeted advertising (as defined by law); opt out of certain profiling (where applicable); and not be discriminated against for exercising privacy rights.

B. "Do Not Sell or Share My Personal Information." If applicable, you may opt out of the "sale" or "sharing" of personal information for targeted advertising. Innexo does not sell or share personal information for targeted advertising. See our Do Not Sell or Share page.

C. Universal Opt-Out Signals (GPC). Where recognized and required, we honor Global Privacy Control (GPC) signals for opt-out requests.

D. Verification. For requests to know/access, delete, or correct, we may verify identity. If you are an authorized agent, we may request proof of authorization and verification.

E. Exceptions to Deletion. We may deny deletion requests when permitted by law, such as to complete a transaction or provide Services; detect security incidents and prevent fraud; debug and repair errors; comply with legal obligations; or exercise or defend legal claims.

F. How to Submit State Privacy Requests. Email security@innexo.com with the subject line Privacy Rights Request. Include your name and email, the request type (access / delete / correct / opt out), and any relevant account or hotel association (if applicable).

Related pages

Our Cookie Policy explains the essential, security, functional, analytics, and third-party cookies we use.

Learn about your opt-out choices on the Do Not Sell or Share My Personal Information page.

For the technical safeguards behind these commitments, read our Security page.

Hotels acting as data controllers can review our Data Processing Addendum for processor obligations.