Privacy Policy

1. Who we are and our role

FlatOrbit is operated by FlatOrbit, [Registered office address].

• For data an apartment organization (for example a residents' association or property manager) enters about its community - owners, tenants, occupancies, dues - that organization is the data fiduciary and we process the data on its behalf. Contact the organization first about how it uses your data; we will help it respond.
• For your FlatOrbit account and a tenant profile you register yourself, we are the data fiduciary.

2. What we collect

• Account: name, email address, optional mobile number, password (stored only as a one-way hash), roles and the organization you belong to.
• Tenant profile: name, verified email, optional phone, your permanent Tenant ID, and the consents you gave to each apartment.
• Occupancy: flat, move-in and move-out dates, tenant type and number of occupants (a count only - no details of family members or children), notes entered by staff.
• Documents: rental agreements and files staff or you upload, kept private and downloadable only by people with access.
• Owners: name, contact details, the flats owned and ownership history.
• Community accounts: dues billed to you, payments, receipts, payment references and proof you upload when you report a payment. We do not collect card or bank account details.
• Security and technical: sign-in times, active sessions, a hashed IP address and browser details for security and audit logs, and notification history.

3. Why we use it

• To let apartments keep accurate records of who lives in which flat and when, run move-ins and move-outs, and manage maintenance dues and community accounts.
• To let you reuse one verified tenant profile when you move, and see your own records and dues.
• To send service messages you need (invitations, verification and password reset links, reminders) - you can turn off optional notifications.
• To keep the Service secure, prevent misuse, keep audit trails and meet legal obligations.

We rely on your consent (for example when you register or accept an apartment's invitation) and on the legitimate uses the law permits, such as complying with law and protecting the Service. You can withdraw consent at any time from your tenant portal or by contacting us; this does not affect processing already done, and an apartment may still keep records it must keep by law.

4. Who can see your data

• Staff of an organization, limited by their role and the properties they manage. Owners see only their own flats.
• A new apartment never sees your previous addresses, owners or occupancies.
• Service providers who help us run FlatOrbit (hosting and email delivery), bound to protect the data and use it only for us.
• Authorities, where the law requires it. We do not sell personal data.

5. Where it is stored

Data is stored on servers located in India. If that changes, transfers outside India will follow the DPDP Act and any restrictions the Government notifies.

6. How long we keep it

• Closed occupancy records: 8 years, after which notes are cleared and the tenant identity is anonymised (dates and counts stay so reports still add up).
• Audit logs: 8 years. Archived or replaced documents: 3 years.
• Notifications: 12 months. Used or expired links, unconfirmed society sign-ups and ended sessions: 90 days. Import files: 30 days.
• Vehicles you remove from the register: 12 months after removal.
• Domestic help and service staff records (photo, phone, ID): 12 months after they are marked as having left; records of people blocked by the office are kept while blocked.
• Gate register entries and visitor passes (visitor names, phones, vehicle numbers): 12 months after the visit.
• Mobile app sign-ins (device name, platform, last-used time): signed out after 90 days of no use and deleted a year after sign-out.
• Amenity bookings: 3 years after the booking date (charges stay in the society's accounts).
• Helpdesk requests (conversation and photos): 3 years after the request is closed.
• Ownership transfer requests: the proposed new owner's name and email and any notes are cleared 24 months after the request is decided.
• Community account records are kept as long as the organization needs them for its accounts and legal obligations.

7. How we protect it

Encrypted connections (HTTPS), hashed passwords, strict role- and organization-based access checks, private document storage, sign-in protection against repeated guessing, session controls you can manage, audit logs of sensitive actions, and regular backups. If a personal data breach occurs, we will inform the affected organizations, the Data Protection Board of India and affected people as the law requires.

8. Your rights

• Access a summary of your data and how it is used, and get a copy.
• Correct or complete inaccurate data, and update your profile.
• Ask for erasure of data no longer needed (some records may have to be kept for a period required by law or contract - we will tell you when that applies).
• Withdraw consent, and nominate someone to exercise your rights if you die or become incapacitated.
• Raise a grievance with us, and if not resolved, complain to the Data Protection Board of India.

Tenants can make requests from the tenant portal ("Data sharing" and privacy requests). Anyone can email us at the address below.

9. Cookies

We use only the cookies needed to keep you signed in and protect forms (session and security cookies), and one that remembers the language you chose (fo_lang, kept for a year). We do not use advertising or third-party tracking cookies.

10. Children

FlatOrbit accounts are for adults (18+). We record only the number of occupants in a flat, not details of children.

11. Changes

We will post changes here with a new version and date, and tell you in the Service or by email about material changes.

12. Contact and Grievance Officer

Grievance Officer: [Grievance Officer name], [email protected]. General questions: [email protected]. We acknowledge grievances within 24 hours and aim to resolve them within 15 days.