Every property has to see a guest's ID at check-in. Zitlin lets you keep a photograph of it against the booking, shows it only to the people who should see it, records every time someone looks, and deletes it for you once you no longer need it.
Every property in the region has the same five minutes at the desk: the guest arrives, hands over a passport or a national ID, and somebody has to record it. What happens next is where properties differ. A photocopy goes in a drawer. A photograph sits in the manager's phone gallery, next to their family pictures. A scan lands in a WhatsApp group. None of those has an owner, a lock, or an end date — and every one of them is still there years after the guest has forgotten the stay.
Zitlin keeps the record where the booking already is, and treats it as what it is: the most sensitive thing your property holds.
Capture the ID at the desk, from the same app
Front and back, against the guest
Open the guest, add a photograph of the front of the card and, where the address is on the reverse — an Aadhaar, a driving licence — the back as well. Two is the limit, because nothing needs a third.
The picture is taken with whatever the desk already has: a phone, a tablet, the laptop's camera roll. JPG, PNG or WebP up to 10 MB, resized before it leaves the device, so a full-resolution phone photograph is perfectly fine.
Alongside it sit the plain fields — ID type and ID number — for the ten kinds of document properties in this region actually see: passport, national ID, driving licence, citizenship card, income tax card, corporate ID, overseas citizen card, ration card, government ID, and one for everything else. Many properties record only these and never photograph the card at all. That is a complete way to use Zitlin.
Nothing is shown until somebody asks
The guest screen knows only whether a document exists. There is no thumbnail and no preview, so a screen left facing the lobby shows nothing of the person who checked in an hour ago.
When a member of staff does open one, Zitlin creates a private link that expires after a minute. It cannot be bookmarked, and if it is forwarded it has already stopped working by the time it arrives. Nothing durable that could reach the image is ever written down.
Who may look, and the record of their looking
| Action | Who can do it |
|---|---|
| Add or replace a document | Front desk and above |
| Open a stored document | Front desk and above, after entering their PIN |
| Remove a document | Rooms manager and above, after entering their PIN |
Scanning an ID happens at check-in with the guest standing there, so capture is quick and unblocked. Opening one three weeks later is the act worth pausing for, which is why it asks for a PIN and why the audit log records it by name.
Every capture, every view and every deletion is written down — who, which guest, which side, and when. Viewing is recorded deliberately: for an identity document, knowing who looked is the control.
They delete themselves
The safest state for a photograph of somebody's passport is deleted, and a retention rule only works if nobody has to remember it. Zitlin runs the deletion for you, every night.
- The window is yours to set — 30 days to five years, or off where your local record-keeping duty requires you to hold records indefinitely. The default is 180 days.
- The clock runs from the guest's last stay, not from the upload. A regular who comes back every quarter is never asked for their passport twice.
- Removing a guest destroys their documents immediately, without waiting.
Ask support to set your window before you start capturing, rather than after — how long a hotel must keep identity records is local law, and it is not a decision a product should make on your behalf.
Why this sits inside the PMS
A guest's identity record belongs to a stay. Kept anywhere else, it drifts: nobody knows which folder holds it, nobody knows when it can go, and nobody can say who has looked at it. Kept on the booking, it arrives with the reservation, leaves with the retention window, and carries its own history.
It also means the front desk has one screen to work from at check-in — the booking, the room's status, the folio, and the guest's record, together.
Guest records that look after themselves
Capture the ID at the desk, show it only to the staff who should see it, and let Zitlin delete it when the time comes. Free forever plan, and no card to start.
Start free
Who this is for
- Hotels and guesthouses in India, Nepal, Sri Lanka and Bangladesh, where recording a guest's identity document is an ordinary part of registration
- Properties hosting foreign nationals, who keep passport details for longer and need to produce them on request
- Anyone currently using a phone gallery or a WhatsApp group for guest ID photographs, which is the arrangement this page exists to replace
- Owners who worry about what happens to the copies — because a retention window that runs by itself is the only kind that actually runs
What Zitlin does not do
Zitlin holds and protects the record. It does not file anything on your behalf — there is no automatic submission to a police portal, no C-Form or FRRO filing, and no identity verification against a government database. If your obligation includes filing, Zitlin is where you keep what you file, not the thing that files it.
Frequently Asked Questions
Where are guest ID photographs stored? In private storage that no public link reaches. The guest record itself holds only whether a document is on file, never an address for the image. When somebody opens one, Zitlin mints a private link that stops working after a minute, so nothing that could reach the photograph survives in a browser history, a log file or a forwarded message.
Who in my team can look at a stored ID? Front desk and above, and on a property using staff sign-in they are asked for their PIN first — the same interruption Zitlin puts in front of voiding an invoice. Removing a document sits a level higher, with your rooms manager. Housekeeping and waiting staff cannot reach guest documents at all.
Is there a record of who looked at a guest's ID? Yes. Capturing, viewing and deleting a document are each written to the audit log with the guest's name and the person who did it. Viewing is recorded because for an identity document the record of who looked is the protection, not a report on one.
How long does Zitlin keep guest ID photographs? As long as you tell it to. The default is 180 days, and the clock runs from the guest's last stay rather than from the day the photograph was taken, so a regular is never asked to hand over their passport again every few months. The window can be set anywhere from 30 days to five years, or switched off where local record-keeping requires that. Deletion then happens on its own, nightly.
What happens if a guest asks us to delete their ID? Remove it from their record and the photograph is destroyed there and then. Deleting the guest does the same thing immediately, without waiting for the retention window. Capturing a document is a Zitlin Pro feature; viewing and deleting one never are, so a property whose trial has ended can still honour that request.
Does the ID photograph go to Booking.com or my other OTAs? No. Nothing about a stored document leaves Zitlin. Guest ID photographs, folio charges added after arrival, restaurant bills and housekeeping all stay in your property.
Can we record the ID number without photographing the card? Yes, and plenty of properties do. The ID type and number are ordinary fields on the guest record — passport, national ID, driving licence, citizenship card and the rest — and the photograph is a separate step you can skip entirely.