Privacy Policy

NiwasNest (operated under the brand “NestPayment”) is a property management platform for PG/hostel owners and hotel operators. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.

In this policy, “we” refers to NiwasNest (the Data Fiduciary), and “you” refers to property owners, tenants, hotel guests, and any other users of our platform (the Data Principals).

We collect personal data that you provide directly. Here is an itemised list:

We process your personal data only for the following specific purposes:

1. Account Management: To create, maintain, and secure your NiwasNest account.
2. Tenant/Guest Onboarding: To register tenants and hotel guests as required by property owners and applicable regulations.
3. Rent Collection & Payments: To facilitate rent payments, generate receipts, and maintain financial records.
4. Communication: To send rent reminders, payment receipts, and property-related notifications via WhatsApp, SMS, and email.
5. Identity Verification: To verify tenant/guest identity through Aadhaar OTP, DigiLocker, or ID document upload as required by property regulations.
6. Legal Compliance: To maintain records required by tax, financial, and property regulations.
7. Service Improvement: To monitor platform performance and improve our services.

We do not sell your personal data or use it for marketing by third parties.

Under the DPDP Act, we obtain your free, specific, informed, and unambiguous consent before processing your personal data. Consent is obtained through:

• Owner signup: A clear consent checkbox with a data processing notice before account creation.
• Tenant onboarding: A data processing notice and consent checkbox during the onboarding agreement.
• Hotel guest check-in: A data processing notice and consent checkbox during the check-in process.
• Aadhaar verification: Explicit, separate consent with UIDAI-compliant language before each verification.

Withdrawal of consent is as easy as giving it. You can withdraw consent at any time from your Profile → My Data & Privacy section, or by emailing us. Withdrawal does not affect the lawfulness of processing done before withdrawal.

We retain your data only as long as needed for the purpose it was collected:

• Identity documents (photos, Aadhaar, govt ID): Automatically deleted 30 days after a tenant vacates or a guest checks out.
• Aadhaar number: Never stored after OTP/DigiLocker verification — only the verification status and masked reference are kept.
• Payment and financial records: Retained for 7 years as required by Indian tax and financial regulations.
• Owner account data: Retained while your account is active. Deleted upon account deletion request.
• Soft-deleted tenant records: Permanently purged 30 days after deletion.
• Consent records: Retained for 7 years as required by the DPDP Act.

Under the DPDP Act, you have the following rights:

• Right to Access: Request a summary of your personal data and how it is being processed.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data when it is no longer needed or when you withdraw consent.
• Right to Withdraw Consent: Withdraw your consent at any time, as easily as you gave it.
• Right to Grievance Redress: File a grievance about how your data is handled.
• Right to Nominate: Nominate a person to exercise your rights in case of death or incapacity.

We share personal data only with the following service providers (Data Processors) who process data on our behalf:

• Supabase: Database hosting and authentication (data stored in secure cloud infrastructure).
• Razorpay: Payment processing for subscriptions.
• WhatsApp Business API: Sending rent reminders and receipts.
• MSG91: SMS delivery for OTP and notifications.
• Resend: Email delivery for account notifications.
• Cashfree SecureID: Aadhaar identity verification via DigiLocker.
• Firebase Cloud Messaging: Push notification delivery.

We do not share your data with any other third parties for marketing or advertising purposes.

We implement reasonable security safeguards as required by the DPDP Act:

• All data is encrypted in transit (HTTPS/TLS) and at rest.
• Identity documents are stored in a private, access-controlled vault with signed URLs.
• Every access to identity documents is logged with IP address and timestamp.
• Aadhaar document viewing requires OTP verification.
• Row-Level Security ensures owners can only access their own data.
• Rate limiting on authentication and sensitive operations.

NiwasNest integrates with the WhatsApp Business API for automated property communications:

• Tenant phone numbers are used solely for rent reminders, payment receipts, and property alerts.
• Message content uses pre-approved Meta templates.
• Property owners can pause automated messages at any time from their profile.
• Contact information is never shared with third parties for marketing.

You have the right to delete your account and all associated data:

1. Log in to your dashboard.
2. Go to Profile → My Data & Privacy.
3. Click Delete Account and confirm.
4. Alternatively, email your deletion request to the address below.

Some payment-related records may be retained for the legally required audit period (up to 7 years) as mandated by Indian tax and financial regulations.

If you have any questions, concerns, or grievances about your personal data, contact our Data Protection Officer:

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date and notify active users via email or in-app notification. Continued use of the platform after changes constitutes acceptance of the updated policy.