Master Privacy Policy & Data Protection Charter

Last Updated & Effective Date: September 20, 2026 Applicable Legal Framework: Digital Personal Data Protection Act, 2023 (DPDP Act, India), Information Technology Act, 2000, and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Platform: MyFlat Apartment & Society Management Software ("Platform", "Service") Operator / Data Processor: MyFlat Technologies Private Limited ("Company", "we", "us", "our")

EXECUTIVE SUMMARY & SCOPE

MyFlat is committed to robust digital personal data protection and privacy compliance. This Privacy Policy details the categories of personal data collected, processing purposes, cross-role visibility rules, data retention limits, and data principal rights.

IMPORTANT STATUTORY DELINEATION OF ROLES:

Data Fiduciary: The respective Apartment Owners Association (AOA), Resident Welfare Association (RWA), Cooperative Housing Society (CHS), or Society Management Committee determines the purposes and means of processing personal data regarding its flats, owners, tenants, staff, and visitors.
Data Processor: MyFlat Technologies Private Limited acts strictly as a "Data Processor" (or intermediary technology service provider) processing personal data solely on the documented instructions and operational configurations of the respective Society Data Fiduciary.

1. CATEGORIES OF PERSONAL DATA PROCESSED

To deliver society management, access control, billing, and community engagement features, the Platform processes the following categories of data:

1.1 Account & Resident Identity Data

Primary Credentials: Full name, verified mobile phone number, secondary contact numbers, email address.
Society & Flat Allocation: Flat/unit number, block/tower name, ownership/tenancy designation, move-in/move-out dates, family member lists, and linked co-residents.
Verification Records: Title deeds, sale agreements, rental lease agreements, or government ID copies uploaded voluntarily by users or society administrators for verification purposes.

1.2 Access Control, Visitor & Security Gate Data

Visitor Logs: Visitor full name, purpose of visit, visiting flat number, vehicle license number, entry/exit timestamps, and digital photographic capture taken at the security guard station.
Delivery & Service Logs: Delivery agent company name (e.g., Amazon, Swiggy, Zomato, Blinkit), delivery entry passcode/OTP, vehicle details.
Staff Attendance: Daily domestic staff, maids, drivers, security personnel check-in/out timestamps and gate-pass QR scan tokens.

1.3 Financial, Billing & Transaction Data

Maintenance Ledgers: Invoicing records, dues assessments, late fees, penalty records, credit adjustments, and payment receipts.
Payment Transaction Metadata: Payment gateway transaction reference IDs, UPI transaction IDs, order IDs, bank payment status, timestamps, and receipt numbers. (Note: Complete credit/debit card numbers and CVV codes are never handled or stored on MyFlat servers; they are processed directly by RBI-authorized payment gateways like Razorpay).
Festival & Facility Booking Collections: Voluntary fund contributions, facility reservation charges, and event ledger entries.

1.4 Community Buzz, Classifieds & Social Data

User Posts & Photos: Content published on Society Buzz feeds, community photo walls, buy/sell marketplace classifieds, and skill exchange listings.
Interactive Engagement: Likes, comments, community poll votes, RSVP confirmations, and club forum discussions.
Support & Complaints: Helpdesk ticket descriptions, voice complaint recordings (processed via AI voice transcriptions), attached fault photos, and resolution feedback.

1.5 Telemetry, Device & Technical Data

Technical Identifiers: IP address, device model, operating system version, browser type, unique device identifiers (UDID/FCM tokens for push notifications), screen resolution, crash analytics, and timestamped audit logs.

2. PURPOSES OF DATA PROCESSING

Data collected through the Platform is processed strictly for legitimate operational purposes:

Security & Gate Control: Authenticating entry, notifying residents of visitor/delivery arrivals, and generating digital gate passes.
Billing & Accounting Automation: Calculating monthly maintenance bills, issuing digital receipts, maintaining society audit trails, and sending dues reminders via WhatsApp or SMS.
Emergency Broadcasts: Routing localized SOS alerts (medical, fire, lift panic) to nearby neighbors, guards, and committee members.
Community Collaboration: Enabling intra-society communication, facility reservations, classifieds, and democratic society voting.
AI Module Efficiency: Executing AI OCR meter reading parsing, ANPR plate recognition, voice transcriptions, and notice translations per society feature switches.
Platform Reliability & Cyber Defense: Preventing fraud, authenticating login sessions via OTP/MPIN, monitoring server stability, and detecting security threats.

COMMERCIAL DATA SELLING PROHIBITION: We do NOT sell, rent, or trade your personal data, phone numbers, or residential addresses to third-party data brokers or marketing telemarketers.

3. CONSENT & PROCESSING ARCHITECTURE

3.1 Digital Consent at Signup

By registering an account, linking a device via QR scan, or logging in via OTP, you provide explicit digital consent for the processing of your personal data in accordance with this Privacy Policy and the DPDP Act, 2023.

3.2 Mandatory vs. Optional Processing

Core Security & Billing Data: Basic name, flat number, phone number, and gate entry logs are mandatory for society safety, building administration, and statutory cooperative society audits.
Optional Community Data: Participation in Buzz social feeds, photo contests, skill exchanges, and marketplace listings is strictly voluntary. You may refrain from uploading social media or classified items at your discretion.

4. STRICT MULTI-TENANT ISOLATION & ACCESS CONTROL HIERARCHY

The Platform implements rigorous logical data segregation and role-based access control (RBAC):

User Role	Accessible Data Scope	Data Restrictions
Super Admin (Platform Level)	Platform system health, tenancy metrics, aggregated revenue, global module switchboards, diagnostic error logs.	Never views private resident communications unless formally escalated for cyber forensics or under court order.
Society Committee (President, Secretary, Treasurer)	Society-wide flat rosters, maintenance ledgers, financial balance sheets, gate pass logs, complaint tickets, and broadcast notices.	Cannot access private bank account credentials, personal MPINs, or data belonging to other societies.
Security Guard (Gate Desk)	Live visitor check-in form, pre-approved visitor PINs, staff attendance QR scanner, emergency SOS dispatch desk.	Zero access to resident maintenance dues, billing ledgers, financial data, or resident private contacts.
Resident (Owner / Tenant)	Own flat ledger, family member profiles, personal visitor history, facility bookings, Society Buzz, notices, and directory listings.	Cannot access billing ledgers, payment details, or private profile documents of other flats.
Commercial Advertiser	Aggregated campaign impressions, click-through rates (CTR), and anonymized conversion analytics.	Zero access to resident identities, names, phone numbers, flat numbers, or society identifiers.

5. THIRD-PARTY DATA PROCESSORS & INFRASTRUCTURE PARTNERS

We transfer minimal necessary data to vetted third-party technical service providers under strict data protection contracts:

Cloud Hosting & Database Infrastructure: Secure cloud data centers located physically within India (AWS / Google Cloud India Regions) offering ISO 27001, SOC 2 Type II, and PCI-DSS certified environments.
Payment Processing: RBI-authorized payment aggregators (e.g., Razorpay) for encrypted payment tokenization.
Communication & Notification Gateways: Enterprise SMS/OTP aggregators and Meta WhatsApp Business Cloud API partners for dispatching one-time passcodes, gate approval pings, and dues invoices.
AI Processing Engines: High-security enterprise AI inference APIs for automated text summarization, OCR, and multi-language translation.

6. VISITOR, DELIVERY AGENT & NON-APP USER PRIVACY

Visitors, delivery agents, cabs, and contract workers whose names, vehicle numbers, and photos are recorded at the gate desk are considered Data Principals.
This data is collected on behalf of the Society under the statutory legal ground of Legitimate Use for ensuring physical security, safety of residents, and crime deterrence.
Visitor data is maintained exclusively for building safety, is logically partitioned by Society, and is subject to automated archival and purging schedules.

7. DATA RETENTION & PURGING POLICIES

We retain personal data only for as long as necessary to fulfill the purposes outlined herein or as mandated by Indian statutory regulations:

Visitor Gate Logs & Photos: Retained for thirty (30) to ninety (90) days (as configured by the Society Management Committee), after which digital visitor photos and temporary passcodes are automatically purged.
Financial & Accounting Ledgers: Retained for a minimum period of eight (8) years to comply with Indian cooperative society laws, taxation statutes, and mandatory financial audit guidelines.
Deactivated Resident Accounts: When an owner or tenant vacates a flat, personal active app login credentials and MPINs are revoked. Historical audit trails (e.g. past payment receipts and complaints logged during residency) are archived for society accounting integrity.

8. TECHNICAL, ORGANIZATIONAL & CYBER SECURITY SAFEGUARDS

The Platform employs defense-in-depth security measures to prevent data breaches, unauthorized access, alteration, or disclosure:

Encryption: All data in transit is protected using TLS 1.3 encryption with 256-bit SSL certificates. Sensitive database columns (passwords, MPIN hashes, access tokens) are hashed using industry-standard bcrypt algorithms.
Database Partitioning: Multi-tenant logical isolation ensures that no Society can access, query, or view data from another residential society.
Access Logs & Audit Trails: Every administrative action (role promotion, manual invoice generation, cash entry adjustment, notice broadcast) is stamped with the acting user's ID, timestamp, and IP address.
Zero Raw Credential Storage: We never store plaintext MPINs, OTPs, or credit/debit card numbers.

9. EXCLUSION OF PLATFORM LIABILITY FOR USER CREDENTIAL BREACHES

To the maximum extent permitted by applicable law:

User Safeguarding Obligation: Users are solely responsible for protecting their mobile devices, screen locks, and MPINs. The Company disclaims all liability for data exposure resulting from users sharing OTPs, loaning logged-in smartphones, or failing to lock personal devices.
Society Administrator Actions: The Company operates purely as a technology processor and is not liable for data misuse, unauthorized downloads, or privacy leaks perpetrated by rogue or negligent Society Management Committee members or security guards.
Phishing & Malware: The Company is not responsible for data accessed via malware, keyloggers, or spyware installed on users' personal mobile phones or computers.

10. DATA PRINCIPAL RIGHTS UNDER THE DPDP ACT, 2023

Subject to statutory exemptions and legal retention obligations, every verified user possesses the following rights:

Right to Access & Summary: Request a digital summary of your personal data processed by the Platform.
Right to Correction & Updating: Request rectification of inaccurate or outdated profile details through the app interface or your Society Committee.
Right to Erasure: Request deletion of non-statutory personal data when tenancy terminates, subject to society dues clearance and statutory audit requirements.
Right to Grievance Redressal: Register data protection complaints with our Grievance Officer and escalate unresolved issues to the Data Protection Board of India.
Right to Nominate: Nominate an authorized representative to exercise data rights in the event of death or incapacity.

To exercise any of these rights, submit a written request to grievance@myflat.app with proof of identity and society membership.

11. CHILDREN'S DATA POLICY

The Platform is not directed at children under the age of eighteen (18) years for independent account registration. Where child or minor resident records (e.g. child name or age) are entered into family rosters or club memberships, such entries must be made exclusively with the consent of the verified parent or legal guardian who holds the primary flat account.

12. AMENDMENTS & NOTIFICATIONS

We may update this Privacy Policy periodically to reflect technological advancements, operational enhancements, or statutory amendments to the DPDP Act. When material changes occur, we will provide in-app banner notifications or update the "Last Updated" date at the top of this Charter. Continued use of the Service after changes indicates your acknowledgement and consent to the updated policy.

13. DATA GRIEVANCE OFFICER & STATUTORY REDRESSAL DESK

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, the details of our designated Data Grievance Officer are provided below:

Data Protection & Grievance Officer: Mr. Tarkeshwar Rao / Legal Compliance Cell CloudEye Technologies India Private Limited

Registered Office: Siripuram, Visakhapatnam, Andhra Pradesh— 530003, India
Grievance & Legal Desk Email: care@myflat.1step.in
Response Turnaround: Acknowledgement within 48 working hours; formal resolution within statutory timelines (maximum 30 days).