1. What this policy covers
Cookies and similar technologies — local storage, session storage — across two surfaces that behave very differently and must not be described as one thing:
- This website —
digilightpms.com, the marketing site you are reading now. - The Digilight PMS application — the software a hotel signs in to.
2. What runs on this website
This website uses analytics, measurement and advertising technologies, and they are active from the moment a page loads. We would rather say that in the first sentence than let you find it further down.
There is no cookie banner on this website, and nothing waits for you to press a button. The tools listed in §4 start when the page does, and they set cookies and similar identifiers in your browser — every one of them is named in §3.
That does not leave you without control. §9 sets out every route open to you — your browser's own settings, each provider's opt-out, and writing to us — and this site works identically whichever you use.
What loads, in order. Google Tag Manager is fetched from Google's servers when the page opens. It is a loader: it sets no cookies of its own, and its job is to hold and start the tools in §4. Those tools — Google Analytics 4, Microsoft Clarity, the Meta Pixel and Google Ads conversion tracking — then run. Your browser therefore contacts Google, Microsoft and Meta, and each of them sees that request: your IP address and browser, in the ordinary way that loading any file from another company's domain reveals them.
If you would rather none of it happened, blocking googletagmanager.com in your
browser or an extension prevents all of it at once, and the site works normally
without it.
Some things about this site are true regardless:
- The site has no server code — no API routes, no server actions, no middleware of its own. Nothing on our side attaches a cookie to a response.
- The fonts are self-hosted. They are downloaded when the site is built and served from our own domain, so your browser never contacts a third party for them.
- The contact page uses email and WhatsApp links, not a form. Nothing is posted to us from your browser.
- The social-media links in the footer are links, not embeds. Nothing loads from those networks unless you click through.
3. Cookies and similar identifiers set on this website
Two categories are set here. Neither is needed to make the site work — the site functions identically if you block or delete all of them.
| Category | What it does | Set by | Typical retention |
|---|---|---|---|
| Analytics | Counts visits and shows which pages and buttons are used, so we can improve the site. | Google Analytics 4, Microsoft Clarity | Up to 14 months |
| Advertising | Measures whether an advert led to a signup, and may be used to show our adverts elsewhere. | Google Ads, Meta Pixel | Up to 13 months |
The cookies themselves. This is the list as observed on a first visit. Providers occasionally rename or add to their own cookies; where that happens the categories and purposes above still describe them.
| Cookie | Set by | Purpose | Typical expiry |
|---|---|---|---|
_ga, _ga_<id> |
Google Analytics 4 | Distinguishes one browser from another so visits can be counted | Up to 2 years |
_gcl_au |
Google Ads | Measures whether an advert led to a trial, demo or enquiry | 90 days |
_fbp |
Meta Pixel | Measures whether a Facebook or Instagram advert led to a signup | 3 months |
_clck, _clsk |
Microsoft Clarity | Ties page interactions together into one session for heatmaps | 1 year / 1 day |
CLID, MUID, ANONCHK, SRM_B, SM |
Microsoft | Microsoft's own identifiers, set as part of Clarity | Up to 13 months |
Retention is the maximum life of the cookie or the provider's stated data-retention window, whichever is shorter. You can delete any of them at any time, and stop them being set at all — §9.
4. The tools we use
Each is listed with what it is for and whose privacy terms govern it. We would rather name everything than quietly add one later.
| Tool | Category | What it is for | Status |
|---|---|---|---|
| Google Analytics 4 | Analytics | Counts visits, pages and CTA clicks so we can see what is useful. | Active |
| Google Tag Manager | Loader — not itself a tracker | Holds and starts the other tools in this table. Sets no cookies of its own. | Active (see §2) |
| Microsoft Clarity | Analytics | Aggregated heatmaps and session replay, to find where the site confuses people. | Active |
| Meta Pixel | Advertising | Measures whether a Facebook or Instagram advert led to a signup. | Active |
| Google Ads conversion tracking | Advertising | Tells us whether an advert led to a trial, demo or enquiry. | Partly active — the linking component runs; no conversion is being reported yet |
Providers' terms: Google Privacy Policy · Microsoft Privacy Statement · Meta Privacy Policy.
These tools are operated by companies outside India, so the data described above may be processed outside India. See the Privacy Policy for how we treat international transfers.
None of this touches the application. Everything in this section applies to
digilightpms.com, the marketing site. The software a hotel signs in to carries no
analytics or advertising code at all — see §5.
Session replay, stated plainly. Microsoft Clarity records how you move through the page — clicks, scrolling, mouse movement — to produce heatmaps and replays. It is configured to mask text you type. It is a recording of page behaviour, not of you, and it is never used to identify you.
5. Cookies the application sets
When a hotelier signs in to Digilight PMS, the application sets cookies that are strictly necessary to run it. They keep you signed in. Without them, sign-in cannot work.
There are two, and this is the complete list.
| Cookie | What it is for | Type | Expires |
|---|---|---|---|
auth-token |
Keeps you signed in, and identifies which hotel your session belongs to. | First-party, strictly necessary | 7 days |
staff-token |
The equivalent for Digilight India's own support staff, who sign in to a separate system. A hotelier never receives one. | First-party, strictly necessary | 7 days |
Both are set with the following attributes:
- HttpOnly — they cannot be read by JavaScript in the page.
- Secure — they are sent only over an encrypted HTTPS connection.
- SameSite=Lax — they are not sent when another website makes a request to us.
- Path=/, and no
Domainattribute, so they are not shared with any other host.
One exception worth naming: where a member of Digilight India's support staff enters
a customer's account with permission, the auth-token issued for that session lasts
30 minutes, not 7 days. See the DPA.
What the application does not set:
- No analytics cookies. None. The analytics described in §4 apply to this website only, not to the software you sign in to.
- No advertising or marketing cookies. None.
- No third-party cookies of our own.
- No cross-site tracking of any kind.
6. Local storage
On this website, the tools in §4 may store values in your browser alongside their cookies. The one we see set on a first visit is:
| Key | Set by | What it holds |
|---|---|---|
_gcl_ls |
Google Ads | The advert-click identifier used to attribute a later signup. |
We store nothing of our own here. Clearing your site data for digilightpms.com
removes it, and §9 explains how to stop it being set.
In the application, four small values are stored. None is an identifier, none is sent to us, and none is readable by a third party. They exist so the software remembers how you left it:
| Key | What it holds |
|---|---|
digilight-sidebar-collapsed |
Whether you collapsed the sidebar. |
digilight-sidebar-expanded-group |
Which sidebar menu you left open. |
digilight:ota-setup:dismissed:… |
Whether you dismissed the channel-setup card. |
digilight:market-intel:watchlist:… |
The competitor list you typed into the market-intelligence screen. |
The application uses no session storage, no IndexedDB, and no service worker.
7. Third parties
On this website: Google, Microsoft and Meta. Google Tag Manager is fetched from Google's servers on every page, and it starts the tools named in §4, each of which then contacts its own provider. All three therefore receive your IP address and browser details, and the analytics or advertising data described in §3 and §4. Nothing else on this site contacts a third party — see §2.
In the application: one screen — the market-intelligence screen — draws a map. The map tiles are loaded by your browser directly from the OpenStreetMap Foundation, and the map's marker icons from Cloudflare. Those two receive your IP address when the map draws, in the ordinary way that loading any image from another website does. They set no cookies of ours and we receive nothing from them.
8. The payment gateway
When you pay for a subscription, the payment gateway's own checkout sets its own cookies while you are on it, in order to process your payment securely. Those are the gateway's cookies, set on the gateway's own checkout, and are governed by the gateway's cookie and privacy notices rather than this one.
9. How to control cookies
Every route below works without asking us, and none of them costs you anything — this site behaves identically whether you use them or not. Nothing here is required to read the site, get a demo, or start a trial.
- Stop all of it at once: block
googletagmanager.comin your browser or a content blocker. That prevents the loader, and therefore every tool in §4, from starting at all. - In any browser: every browser lets you see, block and delete cookies — usually
under Settings → Privacy. Deleting your site data for
digilightpms.comremoves everything listed in §3 and §6. - Google Analytics: Google publishes an opt-out browser add-on that stops Analytics measuring you on any site — tools.google.com/dlpage/gaoptout.
- Google Ads: you can turn off ad personalisation at myadcenter.google.com.
- Meta: ad preferences and off-Facebook activity are controlled at facebook.com/adpreferences.
- Microsoft: Clarity follows your browser's cookie controls; Microsoft's own privacy controls are at account.microsoft.com/privacy.
- By writing to us: email support@digilightpms.com and we will help. If you want us to delete what we hold about your visits, say so and we will act on it — see the Privacy Policy for the rights available to you and how we handle a request.
Blocking the application's strictly necessary cookies has exactly one consequence: you will not be able to sign in. There is no way around that, because those cookies are what a signed-in session is.
10. Changes to this policy
Every change is recorded in the version history at the foot of this page.
11. Contact us
- Business: Digilight India
- Product: Digilight PMS
- Website: www.digilightpms.com
- Support email: support@digilightpms.com
- WhatsApp: +91 95488 38588
- Support hours: Monday to Saturday, 10:00 AM – 6:00 PM IST
- Business address: Meerut, Uttar Pradesh, India
For questions about cookies, see also the Privacy Policy.