Privacy Policy

1. Who is responsible

The owner of each residence decides what resident and staff information they collect and why. For that information the owner is the data fiduciary and Sthavira processes it on the owner's behalf. For owner accounts, our public pages and our own records, Sthavira is the data fiduciary.

2. What we collect

• Account details: name, email address, phone number, role and password (stored by our authentication provider in hashed form; we never see it).
• Application details: the residence you apply to, emergency contact, the type of identity proof, and for Aadhaar only the last four digits. Full Aadhaar numbers are not requested.
• Documents and photos: identity proof, profile photos, complaint attachments, expense receipts and payment proofs that you or the owner upload.
• Stay records: room and bed, move-in and move-out, bills, payments, receipts, agreements, requests, leave, meal choices, notices, visitor and parcel logs.
• Owner records: properties, staff, expenses, public profile content and verification documents.
• Technical data: notification tokens if you turn notifications on, basic logs, and a keyed one-way hash of your IP address (not the address itself) kept only for the few minutes of a rate-limit window and then deleted automatically.
• On your device only: when you browse PGs without an account, your saved shortlist and search stay in your browser's storage and are not sent to us.

3. Why we use it

• to create and secure your account and let the right people approve it;
• to run the residence: rooms, bills, receipts, requests, dining and notices;
• to let the public find verified residences and send enquiries;
• to send service messages and, if you choose, notifications;
• to prevent fraud and abuse, keep the service secure, and meet legal obligations.

We do not sell personal data and we do not use it for third-party advertising.

4. Who can see it

• Your residence: the owner and the staff they authorise can see the records needed for their role. Other residents cannot see your records.
• The public: only what an owner publishes on a PG profile (name, area, photos, prices, amenities and rules) and the authenticity check of an issued document. Phone numbers and resident data are never public.
• Service providers who process data for us under contract: Google Firebase (authentication, database, file storage, notifications), Vercel (hosting), Razorpay (payments, when enabled), Google (email delivery for receipts and alerts), and Meta Platforms (WhatsApp messages, only if the service is enabled for your residence and you opt in).
• Authorities when the law requires it, for example police verification or a lawful request.

Some providers may store data outside India. We use providers with recognised security standards.

5. How long we keep it

We keep data while your account or stay is active. After a move-out or account closure we keep financial records, receipts and related history for as long as tax and accounting law requires (generally eight years), and other records only as long as needed for disputes and security. Identity-proof images are deleted after the retention period set for move-outs (currently 180 days after you leave, unless a legal hold applies). Records we are not required to keep are anonymised on request or when no longer needed.

6. Security

Data is encrypted in transit. Access is limited by role and residence, documents are served through short-lived signed links, and administrative actions are logged. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.

7. Your rights

You can ask to:

• see a summary of the personal data we hold about you;
• correct or complete it;
• erase it, where we are not required to keep it;
• withdraw consent, for example for notifications, at any time;
• nominate someone to act for you if you cannot.

You can download your data and request deletion yourself from Settings in the app (“Download my data” and “Request account deletion”). For data held by your residence, you can also ask the owner directly. We reply within 30 days. If you are not satisfied you may complain to the Data Protection Board of India.

8. Children

Sthavira is not meant for children under 18 without a parent or guardian. Where a resident is under 18, the owner must obtain verifiable consent from the parent or guardian before adding them.

9. Changes

We will post changes here and tell you in the app or by email when they are significant.

10. Grievance officer and contact

For privacy questions, requests or complaints, contact our Grievance Officer: email kinker711@gmail.com or call +919008726954.