Legal & Compliance

Privacy Policy

Effective Date: October 2026•Compliance: DPDP Act 2023 & IT Act 2000 (India)•Applies to: Landlords, Housing Societies, Residents & Visitors
Summary for quick reading: Nisavi operates a software platform for independent landlords, rental property managers, and housing society committees (RWAs / AOAs / CHS). We process data solely to facilitate property administration, visitor logs, rent records, society billing, and automated notifications. We never sell personal data to third-party advertisers. Each building and landlord account is logically isolated.

1. Introduction & Legal Framework

This Privacy Policy governs the collection, processing, storage, and safeguarding of personal data by Nisavi ("Nisavi", "we", "our", or "us") through our web applications, APIs, mobile applications, and automated communication channels (including WhatsApp).

This Policy is formulated in strict accordance with:

  • The Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and applicable rules framed thereunder;
  • The Information Technology Act, 2000 (IT Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules);
  • The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

2. Roles under the DPDP Act 2023 (Data Fiduciary vs. Data Processor)

To understand your rights and our obligations, please note the legal distinction between who controls the data and who processes it:

  • Nisavi as a Data Processor: For data entered by Property Owners, Landlords, Property Managers, or Housing Society Committees (RWAs, Cooperative Housing Societies, Apartment Owners Associations) — such as tenant names, lease agreements, resident records, flat numbers, maintenance dues, and gate visitor entries — the Property Owner or Society Committee acts as the Data Fiduciary, and Nisavi operates solely as a Data Processor carrying out processing on their written authorization.
  • Nisavi as a Data Fiduciary: When you register an account directly with us as an owner, committee member, or purchaser, or submit an inquiry through our website, Nisavi acts as a Data Fiduciaryfor your direct account and billing details.

3. Categories of Personal Data We Collect

We collect only the minimum data necessary for legitimate property management functions:

A. Account & Profile Information (Data Fiduciaries / Owners / Committee)

  • Full name, primary email address, mobile telephone number;
  • Society or building name, physical address, number of units, registration number (for registered RWAs/CHS);
  • Committee designations (President, Secretary, Treasurer, Estate Manager, Facility Staff);
  • Subscription, billing, and GST details for Nisavi SaaS platform subscriptions.

B. Resident & Tenant Records (Entered by Fiduciaries)

  • Tenant/Resident names, flat or unit numbers, contact numbers, email addresses;
  • Lease start and end dates, monthly rent amount, maintenance fee allocation, deposit records;
  • Payment history, outstanding arrears, payment reference numbers (UTR/receipts);
  • KYC / ID records (e.g., tenant police verification numbers, rental agreements) uploaded at the sole discretion and legal obligation of the property owner/society.

C. Gate & Visitor Management Records

  • Visitor name, mobile number, vehicle registration number (if entering with a vehicle);
  • Destination unit / resident being visited, purpose of visit (guest, delivery, cab, service staff);
  • Timestamp of check-in and check-out at security gate kiosks;
  • Visitor photograph (optional, where enabled by society security policy).

D. Complaints, Helpdesk & Society Operations

  • Maintenance complaints, ticket descriptions, repair category, photos of issue;
  • Staff assignments, resolution status, and feedback ratings.

E. Technical & Telemetry Information

  • IP address, device identifiers, browser type, operating system;
  • Login logs, security timestamps, rate-limiting tokens, session tokens.

4. Legal Basis & Purposes of Data Processing

In accordance with Section 4 and Section 7 of the DPDP Act 2023, data is processed only under clear, lawful bases:

  • Performance of Contract: To generate digital rent/maintenance bills, deliver payment links, display unit ledgers, and manage gate access;
  • Explicit Consent: Where you provide consent for receiving automated notices, updates, or demo walkthroughs;
  • Certain Legitimate Uses (Section 7 DPDP Act): For verifying gate entry to safeguard the physical safety of housing society residents, preventing unauthorized trespassing, and maintaining required society audit registers under applicable state Apartment Ownership or Cooperative Societies Acts;
  • Legal Compliance: Retaining financial transaction logs for tax, accounting, and statutory requirements under Indian law.

5. WhatsApp Integration & Notifications

Nisavi utilizes the official WhatsApp Business Platform (Meta Cloud API / authorized Business Solution Providers)to deliver critical property communications (such as payment receipts, maintenance invoices, gate entry approval requests, and society circulars).

  • Messages are sent strictly for operational and account-related transactions;
  • We do not broadcast unsolicited third-party advertising or spam over WhatsApp;
  • Residents may reply 'STOP' or adjust their notification preferences, though opting out of transactional messages may impair timely notice of gate approvals or overdue payment deadlines.

6. Data Isolation, Storage & Security Standards

We apply industry-standard technical and organizational security measures to protect your data:

  • Multi-Tenant Logical Isolation: Data belonging to different landlords or housing societies is strictly segregated in the database using tenant isolation keys. No landlord, tenant, or committee member can access records of another society;
  • Role-Based Access Control (RBAC): Granular permissions ensure guards only view active gate logs, residents only view their own unit's bills, and treasurers view society finances;
  • Encryption: Data in transit is encrypted using modern TLS (TLS 1.2 / TLS 1.3). Sensitive credentials and API tokens are encrypted at rest using AES-256;
  • Cloud Infrastructure: Hosted on secured cloud servers with continuous monitoring, automated backups, and DDoS protection.

7. Data Sharing & Third-Party Processors

Nisavi does NOT sell, trade, rent, or lease personal data to marketing agencies or data brokers. We share data only with verified sub-processors necessary to run the service:

  • Database & Cloud Hosting: Firebase (Google Cloud Platform) and secure cloud infrastructure within certified data centers;
  • Payment Gateways: PCI-DSS compliant payment gateways (e.g., Razorpay, Cashfree) for processing UPI, debit/credit cards, and net banking payments. Payment card numbers are never stored on Nisavi servers;
  • Communication Gateways: Meta / WhatsApp Business API for dispatching transactional alerts;
  • Law Enforcement & Regulators: When legally mandated by an order from a competent court, cyber crime authority, or statutory government body in India.

8. Data Retention & Deletion Schedule

  • Gate Visitor Logs: Retained for 90 days by default (or the custom duration configured by the Society Committee), after which visitor details and vehicle records are automatically purged or anonymized;
  • Accounting & Ledger Records: Retained for the statutory duration required under Indian accounting standards and the Companies Act / Cooperative Societies Act (typically up to 7 years);
  • Active Account Data: Retained for the lifetime of the active subscription plus a 60-day grace period upon account closure to allow export of historical books;
  • Account Deletion: Upon receiving a formal deletion request from an authorized Data Fiduciary, all associated personal records are permanently erased, subject to mandatory legal hold exceptions.

9. Rights of Data Principals (Under DPDP Act 2023)

As a resident, tenant, or landlord in India, you hold the following statutory rights:

  • Right to Access: You can request a summary of personal data being processed about you and the identities of any Data Processors with whom it has been shared;
  • Right to Correction & Erasure: You may request the rectification of inaccurate data or the deletion of data no longer necessary for the purpose it was collected;
  • Right of Grievance Redressal: You have the right to register a grievance with our designated Grievance Officer and receive resolution within statutory timelines;
  • Right to Nominate: You have the right to nominate an individual who will exercise your data rights in the event of death or incapacity.

Note for Residents & Tenants: Because your tenancy and maintenance records are managed by your Landlord or Housing Society (the Data Fiduciary), requests for modification or removal of unit lease data should first be directed to your landlord or society management committee. We assist fiduciaries in honoring valid requests.

10. Children's Data Protection

In compliance with Section 9 of the DPDP Act 2023, Nisavi does not knowingly process personal data of children under 18 years of age without verifiable parental or legal guardian consent, nor do we engage in targeted advertising, tracking, or behavioral profiling of minors.

11. Grievance Officer & Contact Details

In compliance with Section 11 of the DPDP Act 2023 and Rule 5(9) of the Information Technology SPDI Rules 2011, Nisavi has appointed a designated Grievance Officer:

Designation: Data Protection & Grievance Redressal Officer
Platform: Nisavi Property & Society Management (nisavi.in)
Jurisdiction: India
Submit Grievance / Inquiries: Via our Official Helpdesk & Contact Portal
All formal privacy grievances will be acknowledged within 24 hours and addressed within 15 working days.

12. Updates to this Policy

We may update this Privacy Policy periodically to reflect technological changes, product updates, or notifications under the DPDP Act 2023. Any substantial updates will be highlighted on our website and notified to registered account administrators. Continued use of Nisavi following the posting of changes constitutes acceptance of the revised terms.