FlatConnect (“we”, “our” or “us”) is a residential society and apartment community management platform operated by Saumya Prakash, a sole proprietor based in India, trading as FlatConnect. This Privacy Policy explains what personal data we collect through the FlatConnect mobile app, web app, website and admin systems (together, the “Platform”), why we collect it, who else processes it, how long we keep it, and what rights you have.
This Privacy Policy is published in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it, and the Information Technology Act, 2000 and the rules made thereunder. It is intended to serve as the notice required when personal data is collected.
Please read it alongside our Terms of Service and Refund & Cancellation Policy.
FlatConnect is software provided to a society, RWA or apartment association. That matters for privacy, because it determines who decides what happens to your information.
| Decided by your society | Decided by FlatConnect | |
|---|---|---|
| What goes in | Which residents, flats, staff, guards and visitors are recorded; what maintenance, expense and income entries are made; which documents are uploaded; which notices are sent. | What fields the Platform offers, and the technical limits on what can be recorded. |
| Who sees it | Who is given access, with what role (manager, resident, guard) and at what permission level; which features are enabled. | How role-based access control works, and the security that enforces it. |
| Messages | Which notification types and channels are switched on for the society, and what its notices say. | The channels available, and the technical delivery of service messages. |
| Our own records | — | Account and login data, subscription and billing records, support correspondence, and security logs. |
So: we process society, resident, staff and visitor information on your society’s instructions and on its behalf, for the purpose of providing the Service. We process our own account, subscription and billing records for our own purposes as described in sections 4 and 15.
Your society is responsible for giving the notices and obtaining any consents it is required to obtain under applicable law for the information it records about its residents, staff and visitors. If your request concerns a society record — a dues entry, a residency record, a visitor log — we may need to involve your society’s managers to action it, and we will tell you if we do.
We collect only what the Platform needs in order to work. The table below itemises the categories, why each is collected, and what function it enables.
| Data | Why we collect it |
|---|---|
| Mobile number | It is how you sign in and how we verify you by one-time passcode. It is also how your society identifies you against a flat, and how you receive service notifications. |
| Name | To identify you within your community, to attribute dues and payments to the right person, and so that notices and visitor approvals show who acted. |
| Email address (where provided) | Account-related notifications, receipts, reports, and support correspondence. |
| Flat or unit number, tower or block, society | To place you in the right unit so that maintenance, dues, notices and visitor records attach to the correct flat. |
| Role (owner, tenant, resident, manager, guard, staff) | To determine what you can see and do. Role-based access control is what stops one resident seeing another flat’s information. |
| User and account identifiers | Internal identifiers that link your account to your society, flat and records. |
| Profile photograph (optional) | Shown to authorised users within your society, where enabled. |
| Occupancy and residency history | So the society knows who occupied which unit when, and so historical dues and payments remain correctly attributed. |
Where a society uses the Platform, the following society information is stored and may include personal data about residents:
Purpose: to operate the society’s billing, accounting, communication, directory, access-control and record-keeping functions.
| Data | Why we collect it |
|---|---|
| Device information — device type, operating system, app version | To deliver the right build, diagnose faults, and support you. |
| Authentication data — secure session tokens, one-time passcode records, sign-in events | To keep you signed in securely, to detect and prevent unauthorised access, and to investigate suspicious activity. |
| Push notification token | To deliver notifications to your device. |
| Usage and diagnostic data — how features are used, errors and crashes | To fix bugs, improve reliability and understand which features need work. We do not use this to profile you or to make decisions about you. |
| Security and administrative logs | To maintain an audit trail of material actions, prevent fraud and misuse, and meet our security and legal obligations. |
When you contact us by email, phone or WhatsApp, we keep that correspondence, including your contact details and what you told us, so that we can help you, keep a record of what was agreed, and handle any grievance or dispute.
If you choose to grant access to your device contacts, a contact picker lets you add a resident without typing their number manually. The contact you select is used for that purpose. We do not upload, scan, store or index your contact list. This permission is entirely optional and the Platform works without it.
Where a society subscribes to FlatConnect, we keep a commercial record of that subscription. This is our own record, kept for our own business, accounting and legal purposes.
Subscription and billing records are kept for as long as required for accounting, tax, audit and limitation purposes — see section 15. We do not delete a financial record simply because an account was closed, because we are required to be able to account for money we received.
Residents do not see their society’s FlatConnect subscription or billing records, and societies do not see ours. Subscription records are accessible to our authorised administrators only.
Subscription Fees may be paid by UPI, bank transfer, cheque, cash or an online payment gateway. Where you pay online, the payment is processed by a third-party payment provider — Razorpay Software Private Limited — under its own terms and privacy policy. We receive a transaction record (amount, date, status, order and payment identifiers, and the payer’s name or masked instrument details where the provider shares them). We do not receive or store your card number, CVV, bank credentials or UPI PIN.
Where a society enables in-app maintenance collection, a resident’s payment may be made through a UPI intent or link that pays the society’s own account directly, or through a payment gateway. Where a gateway is used:
Payment provider privacy terms apply in addition to this policy for those transactions. See Razorpay’s privacy policy.
Where a society has enabled visitor management, the Platform records visitors at the gate, lets residents pre-approve expected visitors, and lets managers review their society’s visitor activity.
| Data | Why |
|---|---|
| Visitor name | To identify who entered, and to match a visitor to the resident expecting them. |
| Visitor mobile number (where provided) | To contact the visitor, to verify an expected visit, and to link a pre-approval to the person who arrives. |
| Destination flat or unit, and tower or block | To notify the right resident and to record who the visit was for. |
| Visitor category or type — guest, delivery, cab, service provider, house help, staff, other | To apply the right approval workflow. A delivery and a guest are not handled the same way. |
| Purpose of visit, service type, or venue (where recorded) | To give the resident and the society context for the entry. |
| Vehicle or cab number (where recorded) | Premises security and parking records. |
| Visitor photograph (where captured) | Premises security, and to help a resident confirm who is at the gate before approving entry. |
| Check-in and check-out time, entry and exit records, expected arrival time | The society’s record of who was on the premises and when — the digital equivalent of the gate register. |
| Approval or rejection status, and who approved or rejected | Accountability for entry decisions. |
| Invite code, group invite details, expected and actual head count, validity window | To let a resident pre-approve a visitor or a group, and to let the gate verify an expected arrival. |
| The guard or staff member who recorded the entry | Accountability for what was recorded at the gate. |
Purpose: premises security, access control, resident notification, and the society’s own record of entry and exit. Visitor information is not used for marketing, advertising, profiling, or any purpose unconnected with society security, and it is not sold or shared with anyone outside the society and our service providers.
If you visited a society that uses FlatConnect, the society recorded your visit — it is the society’s gate register, kept in our software.
The visitor module is not designed to collect identity-document numbers, biometrics, health information or other sensitive categories, and societies should not use free-text fields to record them. Where a society nevertheless records such information, it does so on its own responsibility, and we do not require or encourage it.
Visitor management is a record-keeping and notification tool. It is not a security service, identity-verification service or surveillance system. We do not verify a visitor’s identity, and entry decisions are made by the society, its staff and its residents.
Authorised users may upload and store documents, images, profile photographs, agreements, identity documents, property records and other content relating to the management of a society, property, resident, tenant, worker, visitor or service provider. Examples include profile photographs, identity documents, sale deeds, rental agreements, property records, utility documents, society records and other documents a society chooses to keep.
The user uploading such content is responsible for ensuring that they have the necessary authority, permission and consent required to upload, store and manage that information within FlatConnect, and for not uploading more than is necessary.
We store and process uploaded content on behalf of the society and its authorised users, for the purpose of providing society management services. We do not review, verify, validate, endorse or guarantee the authenticity, ownership, legality, completeness or accuracy of user-uploaded content, and we do not use it for any purpose other than providing the Service.
Profile photographs of residents, tenants, workers, visitors and other individuals may be uploaded and displayed to authorised users within the society, subject to applicable permissions and visibility settings.
Uploaded content is accessible only to users authorised through the society’s configured access controls and role-based permissions.
Any information, photo, document, ID proof, agreement, record or content uploaded to FlatConnect is uploaded under the responsibility of the user or society that submitted it. FlatConnect provides storage and management functionality but does not verify authenticity, ownership, legality or consent.
We use your mobile number, email address and device notification token to send you messages. There are two kinds, and we treat them differently.
These are necessary to operate the Service and to deliver what your society has configured. They include:
These are sent through in-app and push notifications, email and WhatsApp, depending on what your society has enabled and what the message is. You cannot opt out of all service messages while using the Service — a one-time passcode or a security notice is part of how the Service works. You can turn off device push notifications in your device settings, and your society’s managers control which notification types and channels are switched on for the society. If you no longer want service messages at all, you can delete your account (section 16).
Marketing is separate, and we treat it separately. We may send product announcements, feature updates, offers or other promotional messages — typically to a society’s managers and to people who enquired about FlatConnect.
Email is delivered through Brevo, WhatsApp messages through the Meta WhatsApp Business Platform, and push notifications through Google Firebase Cloud Messaging. Delivering a message requires sharing the recipient’s contact detail and the message content with that provider. Delivery depends on those networks and on your own settings, and we cannot guarantee that any particular message is delivered or seen.
We process personal data on the following bases:
Where consent is the basis for processing, you may withdraw it at any time — by changing the relevant setting in the App, by revoking a device permission, by opting out of marketing, by deleting your account, or by writing to [email protected]. We will stop the relevant processing within a reasonable time.
Withdrawal is not retrospective: it does not undo processing already carried out lawfully. We may continue to process information where we have another lawful basis for doing so — for example to keep a financial record, to meet a legal obligation, or to resolve a dispute. Withdrawing consent may limit or end your ability to use some or all of the Service, and we will tell you where that is the case.
Access to society and resident data by our own personnel is restricted to authorised individuals and only where necessary to operate, support, secure, repair or administer the Platform, to administer a subscription, or where required by law. Material administrative actions are logged.
See section 11.
We may disclose information where we are required to do so by law, by a court, or by a competent authority acting lawfully, or where disclosure is necessary to establish, exercise or defend a legal claim, to investigate fraud or a security incident, or to protect the rights, safety or property of any person. Where we are permitted to tell you about such a request, we will.
We do not sell personal data, we do not rent or trade contact lists, and we do not share your information with third parties for their own marketing or advertising.
If FlatConnect is involved in a merger, acquisition, incorporation of the business, financing, reorganisation, sale of assets or insolvency, information may be transferred as part of that transaction. We will take reasonable steps to ensure any recipient continues to handle personal data consistently with this policy, and we will notify you of a change in ownership or of any use of your personal data that materially affects your rights.
We use the following providers to operate the Service. They process personal data on our behalf, only to the extent needed to provide their service to us, and under their own terms and privacy policies.
| Provider | What it does for us | What it processes |
|---|---|---|
| Google Firebase / Google Cloud | Authentication, database, file storage, hosting, push notifications, crash and error reporting | Account and authentication data, all society and resident records stored in the Platform, uploaded files, device and diagnostic data |
| Brevo | Email delivery — transactional and account email | Recipient name and email address, and the content of the email sent |
| Meta WhatsApp Business Platform | WhatsApp delivery of transactional notifications | Recipient mobile number and the content of the message sent |
| Razorpay | Online payment processing for maintenance collection and, where used, subscription payments; bank account verification and settlement to societies | Payer name and contact details, amount, transaction and order identifiers, and society bank account details for settlement. Card, bank and UPI credentials are handled by Razorpay, not by us. |
| Cloudflare | Website delivery, DNS and protection against attacks and abuse, where used | Technical request data such as IP address and request metadata |
| App distribution platforms (Google Play, and app stores where applicable) | Distribution and updates of the mobile app | Data governed by the store’s own policy; we receive aggregate install and crash statistics |
We may add or change providers as the Service develops. Where we do, we will update this policy. If you would like the current list in writing, ask us at [email protected].
We apply reasonable technical and organisational safeguards appropriate to the nature of the data we hold. These include:
No system is perfectly secure. We do not claim that your data is completely or absolutely secure, and we cannot guarantee that the Platform will never suffer unauthorised access. Security also depends on you — keep your device secure, do not share your passcodes or guard credentials, and tell us promptly if you suspect unauthorised access.
We do not publish detailed information about our infrastructure configuration, because doing so would itself create a security risk. If you are a society evaluating FlatConnect and need more detail for your own due diligence, contact us.
We maintain an internal process for handling security incidents: detecting and triaging the issue, investigating it, containing it, determining what data and which users are affected, recording what happened and what we did, taking corrective action, and making the notifications required by applicable law.
Where we become aware of a personal data breach, we will act promptly to contain and remedy it, and we will notify affected users and the relevant authority where and to the extent required by applicable law, including under the Digital Personal Data Protection Act, 2023 and the rules made under it. Our notification will describe, as far as we then know, what happened, what data was involved, what we are doing about it, and what you can do.
We keep personal data only for as long as it is needed for the purposes described in this policy, or for as long as we are required or permitted to keep it by law. In practice:
| Data | How long | Why |
|---|---|---|
| Account and profile data | While your account is active. Removed on account deletion, except as set out in section 16. | To give you access to the Service. |
| Society records — residency history, dues, payments, expenses, income entries, accounting records | Retained by the society for as long as it uses FlatConnect, and for a reasonable period afterwards. Financial entries are retained for the period required for accounting, tax and audit purposes. | These are the society’s own records. Deleting them would break its accounts and history. |
| Visitor records and gate logs | Retained for the society’s security and record-keeping purposes for as long as its account is active and for a reasonable period afterwards. Visitor records are not kept indefinitely where there is no longer a security, record-keeping or legal reason to keep them, and can be removed on request under section 6.3. | Premises security and the society’s entry record. |
| Subscription, billing, payment and refund records | Retained for as long as required for accounting, tax, audit, fraud-prevention and limitation purposes, which may extend beyond the end of the subscription. | We must be able to account for money we received, and defend or resolve a dispute about it. |
| Support and grievance correspondence | Retained for a reasonable period after the matter is closed. | To maintain a record of what was raised and how it was resolved. |
| Security, authentication and administrative logs | Retained for a limited period appropriate to security and audit needs. | To detect and investigate unauthorised access and misuse. |
| Backups | Retained on a rolling basis for a limited period. Deleted data may persist in a backup until that backup cycles out. | Disaster recovery. |
When data is no longer needed, we delete it from our active systems or anonymise it so that it no longer identifies anyone. Anonymised or aggregated statistics — for example counts of societies or feature usage — may be retained indefinitely, because they are no longer personal data.
You may request deletion of your FlatConnect account at any time, either from within the App (Profile → Delete Account) or by submitting the form at flatconnect.in/delete-account.html. Both routes raise the same request.
When your request is processed:
Requests are typically processed within 30 days of submission. Deleting your account removes your access to the App; it does not cancel or waive any dues or other obligations you may owe your society. Documents you shared with your flat or with your society remain available to that flat or society.
If you are the only active manager of a society, you will be asked to add another manager before your deletion request can be submitted. This ensures the society is not left without anyone able to administer it.
If you sign in again later using the same phone number, your account is reopened and your society records remain linked to it. The personal information removed during deletion is not restored, and any management role you held is not reinstated.
Deleting an individual account does not end a society’s subscription. A society that wants to close its account should contact us — see section 15.1 and the Refund & Cancellation Policy.
Subject to applicable law, you have the following rights in relation to your personal data:
Write to [email protected] from the email address or using the mobile number registered to your account, or contact the Grievance Officer in section 24. Tell us what you want and enough detail to identify your record — your name, your society, and your flat.
We will acknowledge within 48 hours and respond within 30 days, or sooner where a shorter period is prescribed by applicable law. We may need to verify your identity before acting, which protects you. We will tell you if we cannot fully meet a request, and why.
Some information about you is part of your society’s records — your residency history, your dues, payments against your flat, and visitor entries at your society’s gate. Where a request relates to those, we may need to route it to your society’s authorised managers, because the society decides what its own records say. We will tell you when we do that, and we will not use it as a way of avoiding your request. If the society refuses something you are entitled to under applicable law, tell us and we will look at it again.
You can revoke any of these permissions in your device settings at any time. Revoking an optional permission disables the related convenience feature but does not stop the Service working.
FlatConnect accounts are for adults. You must be at least 18 years old to create an account, and we do not knowingly create accounts for, or knowingly collect personal data directly from, children.
Societies should not record information about children in the Platform except where it is genuinely necessary for society management, and should not use the Platform to track children. If you believe we hold personal data of a child that should not be there, write to [email protected] and we will review and delete it where appropriate.
We do not use personal data for behavioural advertising or tracking, and we do not target advertising at anyone, including children.
Our website uses only what it needs to function and to understand, in aggregate, how visitors find and use it. We do not use cookies to build advertising profiles, and we do not sell website visitor data. The web app uses local storage on your device to keep you signed in and to remember your preferences — that is necessary for it to work. You can clear it from your browser at any time, which will sign you out.
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date and version at the top of this page, post the updated policy here and in the App, and notify you of material changes through the Platform or by email or WhatsApp. Where a change requires your consent under applicable law, we will ask for it.
FlatConnect is designed for use in India. If you are in the European Union and the GDPR applies to our processing of your data, you additionally have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with your local data protection authority. Write to [email protected] to exercise them.
This Privacy Policy is governed by and construed in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and the rules made thereunder. Disputes in relation to this policy are subject to section 24 of our Terms of Service, without affecting any statutory right you have to approach the Data Protection Board of India, a consumer commission, or another forum having jurisdiction.
FlatConnect is intended for use within India. If you access the Platform from outside India, you do so at your own initiative and are responsible for compliance with your local laws.
In accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the rules made thereunder, the contact details of our Grievance Officer are set out below. The Grievance Officer can be contacted about any complaint or concern regarding the processing of your personal data, the exercise of your rights under section 17, or any breach of this Privacy Policy.
We will acknowledge your grievance within 48 hours and respond within 30 days, or sooner where a shorter period is prescribed by applicable law. Please include your name, your society, and enough detail for us to identify the issue.
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023 and the rules made under it.
If you have questions about this Privacy Policy or our data practices:
Related documents: Terms of Service · Refund & Cancellation Policy · Delete your account
By using FlatConnect, you confirm that you have read this Privacy Policy and consent to the collection and use of your personal data as described in it. You may withdraw your consent as set out in section 9.1.