Privacy Policy

This Privacy Policy explains how Prefertrip Private India Limited ("Prefertrip," "SwarmForge," "we," "us," or "our") collects, uses, discloses, and protects personal information when people visit https://app.swarmforge.simplicore.ai or https://swarmforge.simplicore.ai, use the SwarmForge hotel operations service and related applications, or contact us.

SwarmForge is a product of SimpliCore AI. The Service is operated, contracted and billed by Prefertrip Private India Limited, a company incorporated in India — the parent company of SimpliCore AI. SwarmForge is a sister company of PreferTrip. Registered office: [Registered address], India. CIN: [CIN]. GSTIN: [GSTIN].

SwarmForge is an AI-assisted operations platform for hotels. It supports hotel teams with guest communications, tasks, approvals, goals, reports, and AI-generated recommendations. The hotel's property-management system (PMS) remains the hotel's system of record for reservations and rooms.

This policy covers website visitors, hotel customers and their authorized users, and guest or other personal information that a hotel customer submits to or processes through SwarmForge. A hotel may provide a separate privacy notice to its guests. If you are a hotel guest, please contact the hotel that collected your information for questions about its use of your information. Where the hotel determines why and how guest information is processed, the hotel is the controller/business and SwarmForge processes that information on the hotel's instructions under the applicable customer agreement and data-processing terms.

Company contact: Prefertrip Private India Limited — Mailing address: available on request — contact admin@simplicore.ai

Privacy contact: admin@simplicore.ai

Depending on how the service is used, we may collect:

• Account and business contact information: name, work email, phone number, employer, job title, hotel/property affiliation, login credentials or authentication data, and account preferences.
• Hotel and operational information: hotel name and address, room and reservation data imported by a hotel, room status, tasks, requests, approvals, service catalog, operating rules, goals, policies, uploaded documents, and related records.
• Guest information supplied by hotels: guest names, phone numbers, stay and room details, messages, opt-in or opt-out records, service requests, preferences, charges, and relevant conversation history. Hotels should provide only information they are authorized to share and should avoid uploading unnecessary sensitive information.
• User content and AI interaction data: prompts, instructions, documents, context provided to an AI feature, generated drafts or recommendations, human edits, approvals or rejections, and related outcomes. This can include personal information contained in the submitted material.
• Usage, device, and diagnostic data: log-in and activity timestamps, pages and features used, browser/device information, IP address, error and performance data, and security events.
• Billing and plan information: subscription tier, usage and AI metering, invoices, payment status, and business billing contacts. Billing is currently handled manually by invoice and bank transfer — we do not collect or store payment-card data through the service.
• Support and communications: support tickets, onboarding communications, feedback, and information you choose to provide.
• Website and cookie data: information collected through cookies or similar technologies, as described in "Cookies and analytics."

We do not intentionally request sensitive personal information such as government identifiers, precise geolocation, health information, or payment-card details for the service. If a hotel submits such information, it remains responsible for ensuring that the submission and processing are lawful and appropriate.

We receive information directly from website visitors, hotel customers, account users, and support contacts; from hotel systems and files that the hotel chooses to connect or upload (including PMS CSV imports); from messaging providers when a hotel enables WhatsApp; from our service providers; and automatically from use of the website and service.

Hotel customers are responsible for providing required notices to guests and other individuals, obtaining required permissions or consent, and ensuring their instructions to SwarmForge comply with applicable law and their agreements with those individuals.

We use personal information to:

• provide, operate, maintain, and secure the website and service;
• create and administer hotel and user accounts, verify access, and apply role-based permissions;
• process hotel data to show operational views, reports, tasks, conversations, and audit history;
• generate AI drafts, summaries, recommendations, and goal or opportunity analyses requested or enabled by the hotel;
• route messages and tasks, record guest messaging consent or opt-out, and support hotel-approved communications;
• bill for the service, measure usage, enforce plan limits, and manage subscriptions;
• provide onboarding, customer support, and service communications;
• monitor performance, troubleshoot errors, investigate misuse, and prevent fraud or security incidents;
• comply with law, enforce agreements, and protect SwarmForge, customers, users, and others; and
• improve the service using aggregated or de-identified information where permitted by law and contract.

We do not use hotel customer content or guest personal information to train AI models. Our AI provider is xAI (Grok); we have enabled xAI's zero-data-retention setting for our API usage, and xAI does not use API inputs or outputs to train models. We use provider models to process customer content solely to return the requested service output, under the provider's terms and customer instructions.

SwarmForge uses AI to prepare drafts, recommendations, summaries, and operational analyses from hotel-provided context, policies, documents, and service data. AI output may be inaccurate or incomplete and should be reviewed before it is relied on.

The product is designed around approval controls: guest-facing messages and other consequential actions are subject to hotel-defined controls and human review. Hotel users remain responsible for reviewing outputs and deciding whether to approve, edit, send, or act on them.

One automated notification exists today: when a task is assigned or reassigned, the hotel's configured WhatsApp number may send the assigned staff member a task-assignment message using a pre-approved template. Staff can opt out of these messages, and the hotel's GM can pause them. No other guest- or staff-facing messages are sent without human review.

SwarmForge is designed to keep each hotel's information separated from other hotels' information. Hotel data is logically isolated by property/tenant in application code, and access is limited through role-based permissions: GMs can access guest identity and full property operations; managers generally see room numbers rather than guest names or phone numbers; staff are limited to assigned work and information needed for their duties; and owners receive portfolio aggregates rather than guest names, phone numbers, or message contents. Actual access depends on configured roles, permissions, and product features.

Authorized SwarmForge personnel may access customer information only when needed for service operation, support, security, or legal obligations, subject to internal access controls. Platform operator actions are recorded in audit logs. Customers should assign the least access needed, promptly remove users who leave, and never share logins.

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure, including TLS encryption in transit and AES-256-GCM encryption of uploaded files at rest. No service can guarantee absolute security. A formal description of the production security program (hosting environment, backups, vulnerability management, incident response) should be confirmed before any certification-level claim is published.

If we become aware of a personal-data breach, we will investigate, take appropriate steps to contain and remediate it, and provide notices as required by law and our agreements with customers.

We may disclose information:

• to service providers that host, operate, support, or secure SwarmForge, provide AI or messaging functionality, or provide customer support — see "Our service providers" below;
• to the hotel customer and its authorized users, according to the hotel's configuration and instructions;
• to Meta/WhatsApp when the hotel enables messaging and the communication requires it;
• to professional advisers, auditors, insurers, or financial institutions where reasonably necessary;
• to a government authority, regulator, court, or other party when required by law or needed to protect rights, safety, or the service; or
• in connection with a merger, financing, acquisition, reorganization, or sale of all or part of our business, subject to appropriate protections.

We do not sell personal information for money. We do not use cross-context behavioral advertising or advertising pixels. We do use Google Analytics on public pages (see "Cookies and analytics"); analytics opt-out information is provided there.

Our service providers

We require service providers to handle information under appropriate contractual confidentiality, security, and data-protection obligations.

SwarmForge and its service providers process information in the United States. Hotels located outside the United States (including our pilot hotel in India) should be aware that guest and operational information they submit is transferred to and processed in the United States. Hotel customers are responsible for providing required notices to individuals and ensuring a lawful basis for any cross-border transfer under applicable law (including, where relevant, India's Digital Personal Data Protection Act). Contact us at admin@simplicore.ai for more information.

We retain information for as long as reasonably necessary to provide the service, meet customer instructions and contractual commitments, maintain security and auditability, resolve disputes, and comply with legal obligations. Retention can vary by data type and customer configuration. When information is no longer needed, we delete it, de-identify it, or securely isolate it, subject to legal, backup, and audit-log requirements.

Current product behaviors:

• Hotel data, logins, and WhatsApp history are not automatically deleted when a subscription ends.
• Disabling a hotel account stops access and processing but leaves the hotel's data intact.
• Guest message contents in the section inbox are redacted after 180 days.
• The owner health-score history is retained for 90 days.
• Platform-operator audit logs are retained indefinitely.
• Raw files you upload are deleted automatically 150 days after upload. Bookings you import and documents you save stay until you remove them. Bill evidence attached to a charge stays with the charge.

A complete deletion schedule (hotel content, uploaded files, support tickets, account data, security logs, backups, and data remaining after account termination, including how a hotel can request export or deletion and the completion timeline) must be formally approved and will be reflected here and in the customer agreement or data-processing addendum. Legal holds and records required by law may be retained longer.

We use a limited set of cookies and similar technologies:

• Essential cookies: login session and authentication cookies required to operate the service. These are strictly necessary and cannot be disabled.
• Security: Cloudflare Turnstile on sign-in and registration pages performs an anti-spam/anti-bot check, which may set Cloudflare security cookies.
• Analytics: Google Analytics (measurement ID G-TRBS358L3X) runs on our public pages — including the login, registration, demo, owner, and operator sign-in pages — to measure aggregate usage. Google may collect IP address, device/browser information, and page-view data under Google's own privacy terms. No advertising pixels or cross-context behavioral advertising technologies are used.

You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on, enabling "Do Not Track" or equivalent browser settings, or blocking analytics cookies in your browser. We do not currently provide an in-app analytics consent toggle.

Depending on where you live, you may have rights to access, correct, delete, obtain a copy of, or restrict or object to certain processing of your personal information, and to withdraw consent where processing is based on consent. You may also have the right to appeal a decision about a privacy request or lodge a complaint with a regulator.

If your information was submitted by a hotel through SwarmForge, contact that hotel first. We will assist the hotel in responding to privacy requests as required by our customer agreement and applicable law. For information we control directly, submit a request to admin@simplicore.ai. We may need to verify your identity and authority before acting. We will not discriminate against you for exercising applicable privacy rights.

Service and security notices may still be sent when necessary to operate an account.

The website and service are designed for businesses and are not directed to children. We do not knowingly collect personal information directly from children under 13. Hotel customers must not submit children's information unless they have the required authority and legal basis to do so.

The service may connect to or link to third-party products, websites, or messaging services (including WhatsApp/Meta). Those services are governed by their own privacy notices and terms. SwarmForge is not responsible for the privacy practices of third parties acting independently.

We may update this Privacy Policy from time to time. We will post the revised policy and update the "Last updated" date. If a change materially affects how we handle personal information, we will provide additional notice where required by law or contract. Continued use of the service after an update is subject to the revised policy to the extent permitted by law.

For privacy questions or requests, contact:

Prefertrip Private India Limited (operating SwarmForge, a product of SimpliCore AI)
Mailing address: available on request — contact admin@simplicore.ai
Email: admin@simplicore.ai

For hotel guest-data questions, please also contact the hotel that collected your information.