Privacy Policy

This Privacy Policy explains how EZ Codes (“we”, “us”, “our”) processes personal data when you use Apna Awaas — the Android and iOS apps (bundle ID com.ezcodes.nivaas), the resident web app, and this website. It is written to meet the EU General Data Protection Regulation (GDPR), India’s Digital Personal Data Protection Act, 2023 (DPDP), Google Play, and Apple App Store disclosure rules.

If you created an account, you can request erasure (deletion or irreversible redaction) at any time on the Delete or redact account page. That request is free of charge.

1. Who is responsible

EZ Codes is the data controller for Apna Awaas user accounts, device tokens, support messages, and this website. For records a housing society keeps in the product (visitor logs, maintenance, expenses, complaints, gate duty), the society is the controller and we act as its processor under GDPR Article 28 and as a data processor under DPDP.

• Privacy and erasure requests: [email protected]
• General questions: the contact form
• Product: Apna Awaas · Android, iOS, and web

2. Personal data we process

We only collect what the product needs. Depending on how you use Apna Awaas, this may include:

• Account: name, mobile number (your login identifier), optional email, password hash, account status.
• Society membership: societies you join or create, role, house assignment, invitations you send or accept.
• Household: family member names, relationship, date of birth, and contact details you add.
• Gate and visitors: visitor name, mobile, vehicle, purpose, timestamps, and any photo the committee or guard captures.
• Maintenance and payments: dues, adjustments, payment proofs and images, paid-on dates, and settlement notes.
• Society expenses: amounts, categories, notes, dates, and supporting files the committee records.
• Complaints: title, description, status, and attached photos.
• Security duty: shift assignments, duty dates, and GPS coordinates submitted when a guard starts or proves duty inside a geofence.
• Devices and sessions: device id, platform (Android or iOS), optional Firebase Cloud Messaging token, and session metadata. After you allow notifications on the device, we send service alerts (invitations, join requests, duty, broadcasts, and similar inbox items) to that token. The web app has an in-app inbox only; it does not receive OS push.
• Website: name, email, mobile, society name, and message if you use the contact or deletion forms; technical logs (IP address, user agent) for security.

We do not sell personal data. We do not use it for advertising networks or cross-app tracking.

3. Why we process it (GDPR legal bases)

Under GDPR Article 6 we rely on:

• Contract (Art. 6(1)(b)): creating and running your account, society membership, visitors, dues, expenses, complaints, and duty tools you ask us to provide.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, debugging, and retaining society operational records the committee still needs after a member leaves, where those interests are not overridden by your rights.
• Consent (Art. 6(1)(a)): optional precise location for GPS-verified security duty, optional photos, optional contact email, and optional OS notifications (you can refuse the system permission and still use the in-app inbox). You can refuse location and still use other parts of the app; duty features that require a geofence will not work without it.
• Legal obligation (Art. 6(1)(c)): where we must keep records for tax, accounting, or a lawful request.

Under DPDP we process personal data for the lawful purpose of providing Apna Awaas and related support, with consent where the law requires it, and we honour withdrawal of consent for optional processing.

4. Location, photos, and other sensitive access

Precise location is used only for security attendance: to check that a guard is within the society geofence when starting or proving duty. It is not used for advertising, not shared with other apps, and not collected in the background for tracking. Camera, photo library, and file access are used only when you attach a visitor photo, complaint image, or payment proof. Notification permission is requested after you sign in so we can deliver the same alerts that appear in the in-app inbox; you can deny it and keep using the app.

Google Play Data safety and Apple privacy nutrition labels should list: account info, contact info, user content (photos and texts you upload), location (approximate/precise for duty), identifiers (device and account), and diagnostics. We do not collect financial account numbers; payment proofs are images or notes you upload, not card processing by us.

5. Cookies and similar technology

This marketing website and the API use a session cookie so forms (contact, password reset, account deletion) stay secure. The Flutter web app authenticates with a bearer token, not a tracking cookie. We do not set advertising cookies or third-party analytics pixels on this site. You can block cookies in your browser; some forms may then fail.

6. Who we share data with

• Your society: committee, staff, and guards see the records their role allows (for example a president sees members; a guard sees the visitor desk).
• Processors we use to host the app, send email, deliver Android/iOS push via Google Firebase Cloud Messaging, and (if enabled) send invitation SMS. They may process data only on our instructions.
• Authorities when the law requires it.

We do not share data with data brokers, advertisers, or social networks.

7. International transfers

Servers and subprocessors may be in India or another country. If we transfer personal data out of the European Economic Area, we use GDPR Chapter V safeguards such as the European Commission’s Standard Contractual Clauses, plus appropriate technical measures (HTTPS, access control, hashed passwords).

8. How long we keep it

• Account and profile: while the account is active.
• After a verified deletion/redact request: we complete erasure or irreversible redaction within 30 days, then remove remaining copies from routine backups within 90 days.
• Society operational records (visitor events, maintenance invoices, expenses, complaints, duty logs): kept for the society while it uses Apna Awaas, and for up to seven years after where accounting or dispute needs apply. Personal identifiers of a deleted user are redacted from those records unless a legal hold applies.
• Support and deletion request emails: up to two years.
• Security logs: typically 90 days.

9. Your rights (GDPR and DPDP)

You may:

• access the personal data we hold about you;
• rectify inaccurate data (you can update your display name in the app; ask us to correct other fields);
• erase or redact your account and personal data (GDPR Article 17 — right to erasure);
• restrict or object to certain processing;
• receive a portable copy of account data you provided (GDPR Article 20);
• withdraw consent for optional processing (location, photos, email, OS notifications) without affecting processing already done;
• lodge a complaint with a supervisory authority. In the EU/EEA that is your local data protection authority. In India you may approach the Data Protection Board of India.

To exercise these rights, email [email protected] from a reachable address and include the registered mobile number, or use the deletion / redact form. We may ask you to confirm the mobile number so we do not delete the wrong account. We will respond within 30 days (GDPR Article 12(3)).

10. Account deletion and redaction

Google Play and the App Store require a way to delete an account created in the app, without extra payment, and a public web page that explains the steps. In the app, open Profile, then Delete account. You can also use the Delete or redact account page if you cannot sign in. Enter a registered mobile number or email. We send a one-time code only to the email already on that account. The form always continues so we do not confirm whether the contact is registered. After the code, choose what to redact and submit. There is no fee.

When a request is verified we:

• delete the user account, password, sessions, and device tokens;
• remove or redact your name, mobile, and email from profiles and memberships;
• delete family members you added that are not needed as society records;
• redact your identity from visitor, complaint, expense, and payment records the society must keep.

If you are the last head of a society, we may ask you to appoint another head or confirm that the society should be closed before the account is removed, so remaining residents are not locked out. Deletion is not complete until that step is finished, and we will tell you if we need it.

11. Children

Apna Awaas is for adult residents, committee members, and security staff. It is not directed at children under 16 (GDPR) or under 13 (COPPA). Family-member records may include a child’s date of birth only when a responsible adult in the household adds it. Do not create a login for a child.

12. Automated decisions

We do not make solely automated decisions that produce legal or similarly significant effects (GDPR Article 22). Geofence checks only confirm whether a duty start is inside the society boundary.

13. Security

Passwords are hashed. API access uses short-lived personal tokens. Data is stored in UTC and transmitted over HTTPS. No method of transmission or storage is perfectly secure; we work to prevent unauthorised access, alteration, and loss.

14. Changes

We will update this page when our practices change and revise the effective date above. Material changes that affect GDPR rights will be highlighted on this website. Continued use after the new date means the updated policy applies, except where consent is required.

15. Contact

Data protection requests: [email protected]. Product questions: the contact form. Related: Terms & Conditions.