RoomReady
Privacy Policy
Effective 26 August 2026
The short version
RoomReady is a work tool for hotel staff. Your hotel creates your account — you cannot sign up yourself. We hold your name, your phone number, the jobs you were assigned, and the photos you attach to them. We do not track your location, we do not run ads, and we do not sell anything about you to anyone.
Who we are
RoomReady is operated by Antusen Consultancy, registration no. 202603055866 (JM1041017-P), registered in Selangor, Malaysia. You can reach us at admin@roomready.my.
This policy covers the RoomReady phone app for hotel staff and the RoomReady manager portal at roomready.my.
How your account exists
There is no public sign-up. A manager at your hotel creates your account and gives you a temporary password, which you replace the first time you sign in. Your hotel decides who gets an account, what role they hold, and when the account is removed.
This matters for your rights below: for the work records in RoomReady, your hotel decides what is collected and why. We hold and process that information on their instruction.
What we collect
| What | Why |
|---|---|
| Your name | So the hotel knows who checked a room or closed a job |
| Your phone number | It is your username — you sign in with it |
| Your password | Stored only as a one-way hash. We cannot read it. |
| Your role and specialties | Decides what you can see, and which jobs route to you |
| Your language choice | Shows the app in English or Bahasa Malaysia |
| Your profile photo, if you add one | Shown on your profile and to your manager. Optional — the app works without it. |
| Your shift, and days marked Off or MC | So jobs are not assigned to you when you are not working |
| Jobs: the room, the problem, your notes, and the times you acted | The work record itself, and the hotel’s audit trail |
| Photos you attach to a job | Evidence of the fault and the fix |
| A notification token from your phone | So a new job can reach you when the app is closed |
What we do not collect
- Your location. The app requests no location permission and holds no GPS data.
- Any advertising identifier. There are no ads and no ad networks in the app.
- Analytics or behavioural tracking. There is no analytics SDK in the app.
- Your contacts, your SMS, your call history, or your microphone.
- Any file on your phone other than a photo you choose to attach.
Phone permissions, and why each one exists
- Camera — to scan the QR code on a room door, and to take a photo of a fault. You can also pick an existing photo instead, and you can file a job with no photo at all.
- Photo library — only when you tap “Choose from album”. We receive the one photo you pick, never the library.
- Notifications — to alert you to a job assigned to you.
- Modify audio settings — to play the short alert chime. The app does not record audio, and requests no microphone permission.
Who else touches your data
We use these services to run RoomReady. We do not sell your data to anyone.
- Supabase — the database, sign-in system, and photo storage. Hosted in Tokyo, Japan (AWS ap-northeast-1).
- Expo and Google Firebase Cloud Messaging — deliver the notification to your phone. They receive the notification token and the alert text, which names the room and the job.
- Vercel — hosts the manager portal. Served from Singapore.
- Stripe — takes your hotel’s subscription payment. Stripe handles the card details; we never see or store a card number. This involves the hotel’s billing contact, not staff accounts.
Where your data is stored, and why that is outside Malaysia
Your data does not stay in Malaysia. The database and photo storage sit in Tokyo, Japan (AWS ap-northeast-1), and the manager portal is served from Singapore. Japan and Singapore both have national data protection laws, and both providers are contractually bound to process your data only on our instruction.
We tell you this because it is a cross-border transfer of personal data under the Personal Data Protection Act 2010, and you are entitled to know where your information physically lives. By using RoomReady, your hotel consents to that transfer on behalf of its staff.
One thing worth knowing about profile photos
Job photos are stored privately and require a signed-in account to view. Profile photos are stored in a public bucket, which means anyone holding the exact image link can open it without signing in. The link contains a random account identifier and is not listed or searchable anywhere, but it is not access-controlled. If you would rather not have a photo stored this way, leave your profile photo unset — nothing in the app depends on it.
How long we keep it
Job records and their photos stay for as long as your hotel subscribes, because that history is the point of the product. If your hotel leaves RoomReady, we delete their data within 24 months unless they ask us to delete it sooner.
If your account is removed by your manager, you lose access immediately. Your name stays attached to the jobs you already did, because removing it would falsify the hotel’s maintenance record.
Your rights
Under the Personal Data Protection Act 2010, you may ask to see the personal data we hold about you, ask us to correct it if it is wrong, and ask us to limit how it is used.
Ask your hotel first — they control your account and can correct most things directly. If they cannot help, write to admin@roomready.my and we will respond within 21 days.
Security
Traffic is encrypted in transit. Each hotel’s data is isolated at the database level, so one hotel’s staff cannot read another hotel’s rooms or jobs. Passwords are stored as one-way hashes. Job photos require an authenticated request to retrieve.
Children
RoomReady is a workplace tool. It is not intended for anyone under 16, and accounts are created only by employers for their staff.
Changes to this policy
If we change what we collect or who we share it with, we will update this page and change the effective date at the top. Material changes will also be sent to the hotel’s registered contact.