Privacy Policy

myRentKhata is a property management dashboard that helps Indian landlords manage tenants, rent collection, lease records, and electric meter readings. This policy explains what personal data we handle and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDPA).

For the purposes of the DPDPA, the property owner using this app is the Data Fiduciary for their tenants' data. myRentKhata acts as a Data Processor on the owner's behalf.

Owner (landlord) data: email, password (hashed), display name, phone, legal name, PAN number, properties and apartments you own.

Tenant data (entered by the landlord): name, phone number, email, occupation, employer, age, identity document type and number (Aadhaar / PAN / Passport / Driving Licence), lease dates, rent and deposit amounts, emergency contact details, vehicle details, payment records, electric meter readings, and free-text notes added by the landlord.

Technical data: session cookies for authentication, basic request logs (IP address, timestamps) maintained by our hosting providers for security and abuse prevention.

• To let the landlord track tenants, rent payments, deposits, and meter readings.
• To generate rent receipts (required by tenants for income-tax HRA claims).
• To remind the landlord about lease renewals and overdue payments.
• To secure your account against unauthorised access.

We do not sell, rent, or trade tenant data to any third party for marketing.

We process tenant data under the lawful ground that it is necessary for the landlord (Data Fiduciary) to fulfil the rental contract and comply with related legal obligations (police verification, tax filings, etc.). Landlords are responsible for informing their tenants that this data is stored in myRentKhata and obtaining the consent required under DPDPA.

Data is stored in a PostgreSQL database hosted on Supabase. The current region is eu-west-1 (Dublin, Ireland). We plan to migrate to ap-south-1 (Mumbai) to reduce latency for Indian users and align with data-localisation best practices. The application itself is served by Vercel from edge locations including Mumbai.

All data is encrypted at rest by the hosting provider and in transit using HTTPS/TLS.

We retain data for as long as you maintain an active myRentKhata account.

Account deletion: Signed-in landlords can permanently delete their account and all associated data (buildings, tenants, payments, receipts) from Account → Data & privacy → Delete account. Deletion is immediate; there is no 30-day grace period after you confirm. Supabase automated backups are purged within 7 days of the deletion date.

Individual tenant PII erasure: Landlords can anonymise a specific tenant's personal data at any time from the apartment detail page (Apartment → Overview → Data protection (DPDPA) → Erase tenant PII). This nulls out the tenant's name, phone, email, identity document, emergency contact, and vehicle details while preserving payment history for accounting purposes.

You (or any data principal whose data is processed via myRentKhata) have the right to:

• Access & portability — signed-in landlords can download a full export of their data (buildings, apartments, tenants, payments, meter readings) as an Excel file from Account → Data & privacy → Download your data.
• Correction — edit any record directly in the app at any time.
• Erasure — use the in-app controls described in §6 above, or contact our grievance officer. Accounting records (payments) may be retained to satisfy legal obligations under the Income-tax Act and GST rules.
• Grievance redressal — escalate any complaint to our grievance officer (§11).
• Nomination — nominate another person to exercise your rights in case of incapacity or death by contacting our grievance officer.

Tenants whose data is stored by a landlord should first contact the landlord directly. If unresolved within 30 days, contact our grievance officer.

We apply industry-standard safeguards:

• Passwords are hashed; we never store plaintext passwords.
• Session cookies are HTTP-only and Secure.
• All connections use TLS 1.2+.
• Database access is restricted via Supabase Row-Level Security so each owner can read only their own data.
• Identity document numbers (Aadhaar, PAN) are masked in the UI by default.

No system is 100% secure. If we become aware of a data breach affecting your data, we will notify you within 72 hours as required by DPDPA.

myRentKhata is not intended for use by anyone under 18. We do not knowingly process children's personal data. If you believe a child's data has been entered into the system, please contact us so we can remove it.

We may update this policy from time to time. When we make material changes, we will notify the email associated with your account and update the "Last updated" date at the top of this page.

Questions, access requests, or grievances regarding your personal data? Write to privacy@myrentkhata.in.

We will acknowledge within 7 days and substantively respond within 30 days.