Privacy Policy

1. Introduction

This Privacy Policy describes how TamilArasi Technologies ("RentEase", "we", "our", or "us") collects, uses, shares, protects, and otherwise processes your personal data when you use: (i) our public website at https://renteaseapp.com; (ii) the landlord and tenant web application at https://web.renteaseapp.com; (iii) our mobile applications for landlords and tenants on Android and iOS; and (iv) the housing association / RWA administrator web dashboard at https://rwa.renteaseapp.com (collectively, the "Platform"). This policy is compliant with the Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology Act, 2000.

We do not offer any product or service under this Platform outside India and your personal data will primarily be stored and processed in India. By using the Platform, you agree to the terms of this Privacy Policy. If you do not agree, please do not use or access the Platform.

We treat the privacy of every data principal — tenants, landlords, property managers, unit owners in societies, association administrators, and any other person whose personal data we process — with equal seriousness. The sections below explain what we collect, who can see what, and how we limit use of data to stated purposes.

2. User roles, data minimisation, and visibility

Different people use RentEase in different roles. The following describes our privacy expectations and what each category may typically see or receive. Detailed categories of data are listed in Section 3. This section does not reduce any right you have under the DPDP Act, 2023.

Tenants

Tenants provide personal data needed for rent, lease, and optional Know Your Tenant (KYT) verification. For KYC/KYT, we apply strict data minimisation: only the outcomes described in Section 3(b) are retained on RentEase servers; raw Aadhaar or full identity payloads are processed by Cashfree Identity as described in this policy. Tenants may see landlord or property contact information only where it is necessary to use tenancy-related features they have agreed to.

Landlords, co-owners, and property managers

These users provide account, property, and payout information. They may view tenant names, contact details, rent and lease records, and KYC verification outcomes (for example verified name and masked Aadhaar) for their own tenancies — not raw Aadhaar XML, full document images, or identity data beyond what this policy stores on RentEase. They must obtain appropriate consent from tenants before initiating verification, consistent with our Terms and applicable law.

Unit owners (housing societies / associations)

Where an association maintains a unit registry, unit owners may provide identifiers such as name and phone number for onboarding and invitations. We use this data only to operate association features (for example linking a unit to an account, invite status, and operational messages). We do not sell this information to third parties for marketing, and we do not disclose it to unrelated landlords or unrelated societies.

Association administrators (RWA / society committee)

Authorised administrators may access operational information for their enrolled society: unit identifiers, owner invite status, and KYC or KYT completion status (for example not started, in progress, or verified) as surfaced in the dashboard. They do notreceive access to tenants' raw Aadhaar or PAN documents, full KYC payloads, or other identity data beyond what this policy permits on RentEase. Which party (landlord or tenant) pays for a given KYT does not expand association access to raw identity data.

Other processors and recipients

Payment gateways, messaging providers, and cloud infrastructure process data only as described in Section 5. We may disclose personal data where required by law or to protect rights and safety. We do not sell or rent personal data for third-party advertising.

3. Information We Collect

We collect the following categories of personal data:

Unless stated otherwise, these categories apply whether you use our Android or iOS apps or the landlord and tenant web application at https://web.renteaseapp.com.

a) Account & Profile Information

• Phone number (mandatory, used for OTP-based authentication)
• Name, email address, city, address, and pincode (optional)
• Profile photo (optional)
• Language preference (English, Tamil, Hindi, or Kannada)
• User role (Owner, Co-Owner, Manager, or Tenant)

b) KYC / Identity Verification Data

• Aadhaar number (stored in masked form — only last 4 digits retained)
• PAN number and verification status
• Verified name (the only identity field stored on RentEase servers from Aadhaar eKYC)
• Date of birth, gender, and address from Aadhaar eKYC are processed in transit via Cashfree Identity under a UIDAI licence. These fields are not persistently stored on RentEase servers.
• Consent records (timestamp and status of explicit consent given during in-app KYC flow)

c) Payment & Financial Data

• Rent payment amounts, dates, and transaction references (UPI reference, UTR numbers)
• Payment method (UPI, NEFT, RTGS, IMPS, Cash)
• Bank account details and UPI IDs (stored securely for landlord payout configuration)
• Payment gateway order IDs and settlement status
• We do not store full credit/debit card numbers

d) Property & Lease Data

• Property name, address, city, pincode, and type
• Rent amount, deposit amount, lease duration, and due dates
• Agreement content, signatures, and signed PDF documents

e) Device & Technical Data

• Device type, operating system, and app version
• Firebase Cloud Messaging (FCM) tokens for push notifications
• Anonymous usage analytics

f) Communication Data

• WhatsApp and SMS message delivery status
• In-app notification records

g) Association-Facilitated KYC

Where a tenant belongs to a housing association or residential society enrolled with RentEase, RentEase and the association may agree transparent rules for which party (landlord or tenant) pays each KYT fee. The same data minimisation principles apply: only the verified name is stored on RentEase servers. The association is not granted access to the tenant's raw identity data.

h) Association administrator accounts

When you register or administer an association on rwa.renteaseapp.com, we collect identifiers needed to operate that product: for example mobile number (for OTP login), name, email address if provided, society or association name, address or location fields you enter, and session tokens for security. We use this data only to provide association features (unit registry, owner onboarding, KYC status visibility, reports, and settings) and for the same security and compliance purposes as other accounts.

4. How We Use Your Data

• To authenticate your identity via OTP (WhatsApp or SMS)
• To provide property management, rent tracking, and lease management features
• To facilitate online rent collection and payment processing via Razorpay
• To perform tenant verification (Aadhaar eKYC and PAN) with your explicit consent
• To generate state-compliant rental agreements and facilitate OTP-based e-signatures
• To send automated WhatsApp and SMS notifications — rent reminders, payment receipts, KYC invitations, agreement requests, and expiry alerts
• To deliver push notifications about payment and property updates
• To generate payment receipts and financial reports
• To detect and prevent fraud, errors, and unauthorised access
• To improve the Platform through anonymous, aggregated analytics
• To comply with legal and regulatory obligations
• To provide housing association / RWA features on the association dashboard, including unit lists, invite and KYC status at an aggregate or per-unit level consistent with Section 2

5. Data Sharing

We share your data only with the following third-party service providers, strictly for the purposes described:

• Razorpay: For UPI/card payment processing and settlement to landlord bank accounts.
• Cashfree Identity:For Aadhaar eKYC and PAN verification during tenant verification. Cashfree Identity retains raw verification data (including Aadhaar XML response, date of birth, gender, and address) on their systems under a UIDAI-mandated licence. RentEase receives and stores only the verified name. Cashfree's data handling is governed by their own privacy policy and applicable UIDAI regulations.
• MSG91: For WhatsApp message and SMS delivery (OTPs, rent reminders, receipts, notifications).
• Google Firebase: For cloud infrastructure, push notifications, and data storage.

We do not sell, trade, or rent your personal data to third parties for marketing purposes. We may disclose personal data to government agencies or law enforcement if required by law, court order, or to protect the rights, property, or safety of our users or the public.

6. Data Storage & Security

• Your data is stored on Google Cloud / Firebase infrastructure with enterprise-grade security.
• All data is encrypted in transit (TLS) and at rest.
• Aadhaar numbers are stored in masked form — full Aadhaar numbers are never retained on our servers.
• OTP codes are time-limited (5–10 minutes validity) and rate-limited (maximum 5 per hour per phone number).
• Webhook communications are verified using HMAC-SHA256 signature validation.
• Access to production data is restricted to authorised personnel only.
• In the event of a personal data breach likely to result in harm to data principals, RentEase will notify the Data Protection Board of India within 72 hours (or as required under applicable DPDP Rules) of becoming aware of the breach, as required under the DPDP Act, 2023. Affected users will be informed through the Platform and/or via WhatsApp/SMS without undue delay.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. Users are responsible for keeping their login credentials confidential.

7. Data Retention & Deletion

• Personal data is retained for as long as your account is active or as needed to provide services.
• Financial and payment records are retained for 7 years as required by Indian tax laws.
• KYC verification records are retained for 5 years.
• You may delete your account through the Platform settings. Upon deletion, personal data is permanently erased within 90 days, except where retention is required by law.
• Account deletion may be delayed if there are pending transactions, disputes, or grievances.
• We may retain anonymised data for analytical and research purposes.

8. Your Rights (DPDP Act 2023)

Under the DPDP Act, 2023, you have the right to:

• Access your personal data and know how it is being processed.
• Correct inaccurate or incomplete personal data through the Platform settings.
• Erase your personal data (right to be forgotten) by deleting your account.
• Withdraw consent for data processing at any time.
• Nominate a person to exercise your rights in case of death or incapacity.
• Lodge a grievance with our Grievance Officer or the Data Protection Board of India.

9. Consent

By using the Platform or providing your information, you consent to the collection, use, storage, and processing of your data as described in this Privacy Policy. You consent to receive transactional communications via SMS, WhatsApp, push notifications, and email for the purposes specified in this policy. You may withdraw consent at any time by writing to our Grievance Officer with the subject line "Withdrawal of consent for processing personal data". Withdrawal of consent will not be retrospective and may limit your ability to use certain features of the Platform.

10. Cookies & Tracking

The Platform may use cookies and similar technologies for session management and anonymous analytics. You may disable cookies through your browser settings, but this may affect the functionality of the Platform.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Significant changes will be notified via the Platform or through WhatsApp/SMS. Please review this policy periodically. Continued use of the Platform after changes constitutes acceptance of the updated policy.

12. Grievance Officer