Privacy Policy

1. Two kinds of data

Account data — the details of people who sign up or are invited (owners, managers, staff). For this data we decide how it is used.

Hostel data — what a hostel's team records about its residents, guardians, rooms, charges, payments and expenses. The hostel owner decides what is collected and why; we process it only on the owner's instructions, to provide NIVASA. Residents should contact their hostel first about their data; we will help the hostel respond.

2. What we collect

• Account: name, email address, mobile number (not verified), password (stored only as a secure hash by our authentication provider), your hostels and roles.
• Hostel data entered by the hostel: resident name, mobile, date of birth, occupation, permanent address, guardian name and mobile, admission and stay details, photo and identity document images, rent, charges, payments, deposits and receipts, expenses.
• Technical: sign-in session cookies, IP address and device/browser details in security and error logs, and a record of changes made in each hostel (audit history).

3. Why we use it

• to create and secure your account and let you sign in;
• to provide NIVASA's features to your hostel and its team;
• to send service emails — email confirmation, password reset, invitations and important notices (no marketing without your consent);
• to prevent abuse and keep the service secure, including a bot check at sign-in and sign-up;
• to meet legal obligations.

4. Who can see it

A hostel's data is visible only to the people its owner has given access, according to their role. Other hostels and other NIVASA users cannot see it; this is enforced in the database itself.

We do not sell personal data or use it for advertising. We share it only with the service providers that run NIVASA for us, under their data protection terms:

• Supabase — database, authentication and private file storage;
• Vercel — application hosting;
• Cloudflare (Turnstile) — the bot check;
• our email delivery provider — sending service emails (confirmation, password reset, invitations).

5. Where it is stored

These providers may store and process data on servers outside India. We use them only where they protect data to standards consistent with Indian law, and we will follow any restrictions the Government of India notifies.

6. How we protect it

Data is encrypted in transit and stored with providers that encrypt it at rest. Photos and identity documents are kept in private storage and shown only to signed-in members of that hostel. Access is limited by role, and changes are recorded. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

7. How long we keep it

We keep account data while your account is open. Hostel data is kept while the hostel uses NIVASA, because owners need their financial history. When an account or hostel is closed we delete or anonymise its data within 90 days, except what we must keep by law or to resolve disputes. Backups are overwritten on their normal cycle.

8. Your rights

You may ask to access, correct, complete or erase your personal data, to withdraw consent, and to nominate someone to act for you. You may also raise a grievance with us, and if you are not satisfied, with the Data Protection Board of India. Residents should send requests about hostel data to their hostel; we will support the hostel in answering.

9. Cookies

NIVASA uses only cookies needed to keep you signed in, remember your language and hostel choice, and protect against bots. We do not use advertising or tracking cookies.

10. Children

Accounts are for adults only. A hostel that records residents under 18 must have verifiable consent from a parent or guardian.

11. Grievance officer and contact

Grievance Officer: [Name], [Operator legal name], [postal address]. Write to the support email below. We will acknowledge within 24 hours and resolve within 30 days.

12. Changes

We will post any change here with a new date and tell account holders about material changes in advance.