Privacy Policy

1.Who we are and what this covers

Khula Aashiana is software that shows the members of a co-operative housing society how their society's money is collected and spent. It is operated by [Operating company, to be confirmed], [Registered address, to be confirmed] ("we", "us").

This policy covers our website (www.khulaaashiana.com), the Khula Aashiana app, the sample society at demo.khulaaashiana.com, and emails we send. It explains what personal data we handle, why, who can see it, and the rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025.

2.Our two roles: your society's records and our own

We handle personal data in two different capacities, and your rights work slightly differently in each.

Your society's records

When a society uses Khula Aashiana, the society decides what records to keep and who may see them, under the Maharashtra Co-operative Societies Act, 1960, its rules and the society's bye-laws. For those records the society is the Data Fiduciary and we act as its Data Processor: we store and process the records only on the society's instructions and only to run the service for it.

Our own relationship with you

For information we collect for our own purposes, such as when you request a pilot, write to us, browse our website or sign in, we are the Data Fiduciary.

3.What we collect

From your society (when it uses the app)

• Member register details: name, flat number, email address, phone number, whether you are an owner-member or tenant, and whether the flat is let out.
• Committee and staff roles: who is Chairman, Secretary, Treasurer, committee member, accountant or auditor, and for which period.
• Flat details used for billing: carpet area, parking, water inlets and similar facts from the society's records.
• Bills, dues and receipts for each flat; payment amount, date, method and reference (for example a cheque number or UPI reference).
• Vendor and contract records: vendor names, GST numbers, quotations, invoices and approvals.
• Bank statement lines, budgets, ledger entries, audit reports and their findings.
• Records requests and questions raised by members, and the answers given.

From you directly

• Your email address when you sign in, and anything you type into the app, such as a question to the committee or a records request.
• What you send us when you request a pilot or contact us: your name, role in your society, society name and contact details.

Automatically, when you use the service

• Sign-in and session data, and a record of the actions you take in the app (for example "approved invoice SF/26-27/107").
• Technical data: IP address, browser and device type, and time of access, kept in security and server logs.
• Cookies described in section 10.

What we do not collect

We never receive or store card numbers, card security codes, UPI PINs or net-banking passwords. Online payments are handled by the payment gateway, Razorpay, which states that it is PCI DSS Level 1 certified.

4.Why we use it

• To run the service for your society: calculating and issuing bills, recording payments and receipts, routing invoices for approval, keeping the books and showing members the society's records.
• To show transparency the law already gives members: members have a right to inspect society records and obtain copies under the Maharashtra Co-operative Societies Act. The app makes that access easier.
• To keep the service secure: signing you in, preventing misuse, detecting tampering and investigating problems.
• To communicate: sign-in links, bill and receipt notices, monthly integrity seals, and replies to your messages.
• To meet legal obligations, such as responding to lawful requests from authorities and keeping records for the periods the law requires.
• To improve the product, using information that does not identify you wherever possible.

We process personal data either because the society needs it to meet its own legal obligations and run its affairs under its bye-laws, or with your consent where consent is required. Where we rely on consent, you can withdraw it at any time (see section 7); withdrawal does not affect processing that already took place.

We do not sell personal data, use it for advertising, or build profiles of you for marketing.

5.Who can see what inside your society

Transparency is the purpose of Khula Aashiana, so it matters to be exact about who sees what:

• All members of your society can see the society's finances: expenses, vendors, contracts and quotations, the budget, the ledger, bank reconciliation, audits, and which committee members approved each item, by name.
• Your own bill, dues and receipts are visible to you and to the office-bearers and accountant who manage billing.
• Dues of individual flats are shown to other members only as totals, unless your society's general body resolves to publish a named list.
• Questions and records requests you raise are visible to all members with your flat number, and answers are permanent. Do not include personal information you would not want other members to see.
• People outside your society cannot see your society's records.

6.Who we share it with

We share personal data only with the following, and only as much as each needs:

• Service providers that run the platform for us: Supabase (database and sign-in, data stored in Mumbai), Vercel (web hosting), Razorpay (online payments into your society's own bank account), and our email providers (Hostinger for our mailbox; a delivery service for sign-in and notice emails). Each is bound by contract to use the data only to provide its service to us.
• Your society's auditors and advisers, when the society gives them access.
• Authorities, when the law requires it, for example a court order or a request under a statute.
• A successor business, if Khula Aashiana is transferred, on the condition that this policy continues to protect your data.

When we add a new service provider that handles personal data, we will list it on this page.

7.Your rights

Under the DPDP Act you can:

• Ask for a summary of the personal data held about you and how it is processed, and who it has been shared with.
• Ask for inaccurate or incomplete data to be corrected, completed or updated.
• Ask for data to be erased when it is no longer needed and no law requires it to be kept.
• Withdraw consent you have given.
• Nominate another person to exercise your rights if you die or become unable to.
• Complain to us, and then to the Data Protection Board of India if you are not satisfied.

How erasure works for financial records

A society's financial records cannot simply be deleted: co-operative, tax and audit laws require societies to keep their books, and Khula Aashiana is designed so that posted entries are never edited or erased. If a financial record about you is wrong, it is corrected with a new, visible correcting entry. Data that is not part of the books, such as a closed account's sign-in details, is erased on request.

How to make a request

For your society's records, write to your society's Secretary, who decides on the request; you can also write to us at connect@khulaaashiana.com and we will pass it to the society and help it respond. For anything else, write to us directly. We acknowledge every request within 7 days and aim to resolve it within 30 days. We may need to confirm your identity first.

8.How long we keep it

• Society records: for as long as the society uses Khula Aashiana, and afterwards for the periods the Maharashtra Co-operative Societies Act, tax laws and audit requirements oblige the society to keep them, unless the society asks us to hand them over and delete our copy sooner, where the law allows.
• Security and access logs: at least one year, as the DPDP Rules require, then deleted unless needed for an investigation.
• Pilot requests and correspondence: up to 12 months after our last contact, unless they lead to an agreement.
• When a society leaves: we give it a full export of its records and then delete our copy, except what we must keep by law.

9.Where your data is stored

Your society's database is stored in India, in Mumbai. Some of our service providers may process limited data outside India, for example when our web host serves pages through its global network or when an email is delivered. Any transfer outside India follows the DPDP Act and any restrictions the Government of India notifies.

10.Cookies

We use only the cookies the service needs to work. We do not use advertising or tracking cookies.

• Sign-in cookies (names starting with "sb-") keep you signed in to the live app.
• ka_theme remembers whether you chose light or dark mode.
• ka_sidebar remembers whether you collapsed the menu.
• ka_persona remembers which role you picked in the sample society. It is used only on the demo.

If we ever add analytics, we will update this section first and ask for consent where the law requires it.

11.How we protect it

Access rules in the database decide what each person can see, connections are encrypted, and every change is recorded in a tamper-evident history. Our Data Privacy page explains the safeguards in plain language.

If a personal data breach happens, we will tell the affected society and people without delay, explain what happened and what they can do, and report it to the Data Protection Board of India as the DPDP Rules require.

12.Children

Khula Aashiana is for adults: society members, committee members and the professionals who work with them. We do not knowingly collect personal data from anyone under 18. Where a flat is held for a minor, the society deals with the minor's parent or legal guardian, and any processing needs that guardian's verifiable consent.

13.Changes to this policy

We will post any change on this page with a new date. If a change materially affects how we use your data, we will also tell your society and, where required, ask for your consent again.

14.Contact and Grievance Officer

Grievance Officer: [Grievance Officer name, to be confirmed]
Email: connect@khulaaashiana.com
Address: [Registered address, to be confirmed]

We acknowledge complaints within 7 days and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.