Privacy Policy

1. Who we are

OneRoof is a platform that helps the people of a residential community stay connected: notices, discussions, complaints, visitors, payments tracking and more. In this policy, "OneRoof", "we" and "us" mean the team that operates OneRoof and decides why and how your personal data is handled. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) that makes us the data fiduciary.

Your society or association runs its own community inside OneRoof. Its officers decide who may join and what is published there, and they are responsible for the content they post. Contact us at business@ouroneroof.com or +91 8095 111 911.

2. What we collect

• Account: your mobile number (your login), your name, and an optional profile photo.
• Your home and community: the society you belong to, your flat, whether you are an owner, tenant or household member, any role you hold in the association, and the invitations you send or receive. If you add family members to your household, we store the names you enter for them. Invitations store the phone number and name of the person invited.
• What you post: notices, discussion posts and comments, complaints, association chat messages, gallery pictures and videos, documents and attachments.
• Visitors: when a visitor is logged, the guest's name, optional phone number, optional photo, vehicle numbers, the purpose of the visit and the flat visited.
• Payments tracking: the payment details your society chooses to show (such as a UPI ID, payee name or bank details) and any proof of payment you upload, such as a screenshot or receipt. Money does not move through OneRoof: you pay your society in your own UPI or banking app, and we only record the status.
• Your device: a push notification token for your phone, a label for each signed-in device, the type of device and app version, and crash and error reports. Crash reports identify you by an internal ID only, never by name, phone number or email.
• Technical logs: our servers record requests, including your IP address, for security and to fix problems.
• Website forms: if you apply to bring a society to OneRoof, we store the names, email addresses and phone numbers of the applicant and a contact person, the society's address and any note you add. If you send feedback, we store your name, email, optional phone number and any picture you attach.

The app asks for permission to use your photos (to attach a picture), your camera (to take a visitor's photo) and notifications. It does not use your microphone, contacts or location. You can withdraw any permission in your phone's settings.

The website does not use advertising or analytics trackers. Our hosting and security provider may set technical cookies needed to deliver and protect the site.

3. Why we use it

• To sign you in and check your number with a one-time code.
• To run the community features you use and show you what is relevant to your home and role.
• To send you notifications about your community. You can turn types of notification off in Settings.
• To keep your society's records: notices, complaints, visitor logs and payment status.
• To keep the service secure, prevent abuse, give support and fix faults.
• To handle society applications, agreements and billing with associations.
• To meet legal obligations.

We do not sell personal data, we do not run advertising, and we do not use your data to profile you for advertisers.

4. Who can see your data

• Members of your society, according to role. Residents see community content such as notices and discussions. Payment status is private to your flat and to the officers who verify payments, and payment proofs are visible only to the people in your flat and those verifiers. Officers can see what their role needs to run the association.
• The OneRoof team. Our admin tools show operational information about societies, not residents' personal details by default, and access to personal data is recorded in an audit log.
• Service providers that process data on our behalf, listed in the next section.
• Authorities, where the law requires it.

5. Service providers

• Google Cloud (data centre in Mumbai, India): hosting, database and file storage.
• Meta (WhatsApp Business Platform): delivers your login code to your phone number. We may also use an SMS provider for this purpose, which receives your number and the code.
• Resend: sends email, such as replies to society applications and feedback.
• Expo, Google Firebase Cloud Messaging and Apple's notification service: deliver push notifications, which carry the notification text and your device's token.
• Sentry: receives crash and error reports from the app.
• Cloudflare: delivers and protects the website and our admin tools.

We choose providers carefully and give them only what they need to do their job. Some of them may process limited data outside India.

6. Visitors and other people's data

Some data in OneRoof is about people who are not users, such as guests recorded in the visitor log or family members added to a household. It is entered by the resident or by gate staff at the society, who should only record what the society genuinely needs for security and should tell the person concerned. If you are a guest or family member and want your details corrected or removed, write to business@ouroneroof.com and we will act on it with the society.

7. How long we keep data

• Your account data is kept while your account is active.
• Login codes expire within minutes and sign-in sessions end when you sign out.
• Society records, such as notices, discussions, complaints, chat messages, gallery items and visitor entries, are kept as part of the society's record. Other residents rely on them.
• Society applications and feedback are kept while we need them to respond and keep our records.
• Backups and security logs keep copies for a limited period and then age out.

When you delete your account, your name, number, photo, sign-in sessions, notifications and place in the community are erased. What you posted stays with your name shown as "Deleted user", so society records stay whole. You can read exactly what is erased and what is kept at /delete-account.

8. Your rights

Under the DPDP Act you have the right to:

• ask for a summary of the personal data we hold about you and how it is used;
• have inaccurate data corrected and incomplete data completed (you can edit your name and photo in your profile);
• have your data erased (you can delete your account in Settings, then Account);
• withdraw consent you have given;
• have your grievance heard; and
• nominate another person to exercise these rights for you if you die or cannot act.

To use any of these, email business@ouroneroof.com from the address you used with us, or call +91 8095 111 911, and tell us the mobile number on your account. We may need to confirm it is you. We aim to respond within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

9. Children

OneRoof is for adults. We do not knowingly create accounts for anyone under 18. A household list may include the names of children entered by a parent or guardian; we use those names only to show who lives in a home and do not contact children.

10. Security

Data travels over encrypted connections and is encrypted when stored. Certain personal fields get additional encryption before they reach the database. Login codes and session tokens are stored only in hashed form. Files are never public: each is served only to people allowed to see it. Access to production systems is restricted and logged.

No system is perfectly secure. If a breach affecting your personal data occurs, we will tell you and the authorities as the law requires.

11. Where your data is kept

Our primary servers and database are in India. A few of the providers above may handle limited data, such as crash reports or notification delivery, in other countries. We rely on them only where the law allows and require them to protect it.

12. Changes to this policy

We may update this policy as the product grows or the law changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app before it applies.

13. Contact and grievances

Questions, requests and complaints about personal data: business@ouroneroof.com, or +91 8095 111 911. Please put "Privacy" in the subject so it reaches the right person.