Effective date: 1 August 2025 · Last updated: 25 August 2025
NivaHub ("we", "us", "our") provides a cloud-based apartment and housing society management platform ("Platform") at nivahub.com. This Privacy Policy explains how we collect, use, store, and share your personal data when you access or use our Platform, in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and rules made thereunder.
By registering on or using NivaHub, you consent to the data practices described in this policy. If you do not agree, please do not use the Platform.
1. Who This Policy Applies To
This policy applies to:
- Society / Apartment Administrators — persons registering a housing society or apartment complex on NivaHub.
- Committee Members — managing committee members of a registered society.
- Residents and Tenants — flat owners, tenants, and occupants added to a society account.
- Visitors — persons browsing nivahub.com without a registered account.
2. Information We Collect
2.1 Information You Provide
- Account information: name, email address, mobile number, designation, and password.
- Society information: society name, registered address, RERA number (if applicable), bank account details for society funds.
- Resident data: flat number, ownership or tenancy type, vehicle numbers, emergency contacts, and any other details entered by the society administrator.
- Financial records: invoices, maintenance charges, expenses, utility bills, and payment histories entered by society administrators.
- Communication content: notices, circulars, complaint tickets, event details, and messages sent through the Platform.
2.2 Information Collected Automatically
- IP address, browser type, device identifiers, and operating system.
- Pages visited, features used, session duration, and clickstream data.
- Login timestamps and activity logs for security and audit purposes.
2.3 Payment Information
Payments are processed by Razorpay Software Private Limited. We do not store card numbers, CVV codes, or net-banking credentials. We receive only the transaction reference number, amount, status, and last 4 digits of the instrument used, solely for record-keeping and support purposes.
3. Legal Basis for Processing (DPDP Act, 2023)
We process your personal data on the following lawful grounds:
- Consent: when you register and explicitly accept these terms.
- Contract performance: to deliver the subscription services you have paid for.
- Legal obligation: to comply with applicable Indian laws including GST, IT Act, and court orders.
- Legitimate interest: to maintain platform security, prevent fraud, and improve our services.
4. How We Use Your Information
- Provide, operate, and maintain the Platform and its features.
- Process payments and issue GST-compliant invoices for subscriptions.
- Send service notifications: payment reminders, maintenance alerts, and notice board updates as configured by your society administrator.
- Respond to support requests and resolve disputes.
- Detect, prevent, and address security incidents and fraudulent activity.
- Generate anonymised, aggregated analytics to improve platform features — no individual is identifiable in such reports.
- Comply with Indian legal and regulatory obligations.
5. Data Sharing and Disclosure
We do not sell your personal data. We share data only in the following limited circumstances:
- Razorpay: for payment processing. Razorpay's own privacy policy governs data it collects.
- Cloud infrastructure providers: for hosting, storage, and content delivery. Data is stored on servers located in India.
- Communication service providers: for sending emails, SMS, and WhatsApp notifications on behalf of your society, as enabled by your subscription plan.
- Within your society: society administrators can view only the data of residents belonging to their registered society. Data of one society is never accessible to another.
- Legal authorities: when required by a court order, government directive, or applicable Indian law.
6. Data Retention
We retain your personal data for as long as your account is active. Upon account closure:
- Your data remains available for 90 days to allow you to export all records.
- After 90 days, all personal data is permanently deleted from our systems, except where retention is required by law — for example, financial records are retained for 6 years as required under GST and income tax law.
7. Your Rights
Under the DPDP Act, 2023, you have the right to:
- Access: request a summary of the personal data we hold about you.
- Correction: request correction of inaccurate or incomplete data.
- Erasure: request deletion of your personal data, subject to legal retention requirements.
- Grievance redressal: raise a complaint with our Grievance Officer (see Section 11 below).
- Withdraw consent: you may withdraw consent at any time by writing to us; this does not affect the lawfulness of processing prior to withdrawal.
To exercise these rights, email our Grievance Officer at support@nivahub.com. We will respond within 30 days.
8. Cookies
We use only essential cookies required for platform functionality: session management, authentication tokens, and CSRF protection. We do not use third-party advertising or tracking cookies. Disabling cookies in your browser may affect platform functionality.
9. Security Measures
We implement the following security controls as required under the IT (Reasonable Security Practices and Procedures) Rules, 2011:
- TLS 1.2+ encryption for all data in transit.
- AES-256 encryption for sensitive data at rest.
- Strict logical data isolation between societies — no cross-tenant data access.
- Role-based access controls limiting data access to authorised personnel only.
- Daily automated backups with 30-day retention.
- Regular security assessments of the Platform.
While we take all reasonable precautions, no internet-based service can guarantee absolute security. In the event of a data breach materially affecting your data, we will notify you as required by applicable law.
10. Changes to This Policy
We will notify you of material changes to this policy with at least 14 days' advance notice via email or an in-app banner. Continued use of the Platform after the effective date constitutes acceptance of the revised policy.
11. Grievance Officer
In accordance with the Information Technology Act, 2000, Rule 5(9) of the IT (Intermediary Guidelines) Rules, 2011, and the DPDP Act, 2023, we have designated a Grievance Officer:
Grievance Officer, NivaHub
Email: support@nivahub.com
Address: Pune, Maharashtra, India
Response time: Within 30 days of receipt of complaint
12. Contact Us
For general privacy questions, write to us at support@nivahub.com or through our contact page.