Privacy policy

Ekvasa is a product of Colligo Infotech ("we", "us"), a sole proprietorship in Ahmedabad, Gujarat. This policy covers the Ekvasa app (for residents, their families, guards and the society office), the web console and this website.

1. Who this covers and who decides

Ekvasa is used by housing societies, RWAs and associations ("the society") to run the gate, billing, notices and helpdesk for residents, guards and the society office. The society decides who joins and what the office records. For the society’s own records (residents’ details, homes, bills, the gate log, complaints, notices and the like) the society decides why and how they are used, and we act for it, only to provide the service. For accounts themselves (signing in, account security, stopping fraud and misuse of the service) Ekvasa decides why and how the data is used. Both are under the Digital Personal Data Protection Act, 2023 and its Rules.

The society is our customer: its committee chose Ekvasa and agreed the terms with us in writing. Residents, their families, tenants, guards and staff use Ekvasa because their society chose it, and pay us nothing. When the society office adds people (for example from the society’s list of homes), or a resident adds family members, a tenant or daily staff, the society or that resident is responsible for having the right to share their details for the society’s use. Requests about the society’s records go to the society office first; when one reaches us, we pass it on and help the society answer (section 7).

2. What we collect

• Account: name, mobile number, email, the language you choose, and a sign-in PIN for people without email (stored only as a secure hash).
• Your place in the society: home, whether you are an owner, tenant or family, your role, the history of moves in and out kept by the society, and, for a child a home adds, their name and age (kept for a child with their own sign-in too). An owner or tenant can add and remove the family members of their home with their name, mobile number and email; the society office is told.
• Pets: a home can list its pets: name, kind, breed, a photo and vaccination dates, so the home is reminded when a vaccination is due.
• Gate: visitors’ names, numbers, purpose, photos taken at the gate, entry and exit times, who answered for the home (in the app, or on a call the guard marked, with the guard’s name and the time), daily staff, guest passes and vehicle numbers; parcels, with their photos and hand-over codes; SOS alerts and vehicle alerts. A visitor who uses a resident’s invite link on this website also types their name, mobile number, expected time and an optional note (section 11).
• Residents going in and out: if the society uses it, each time a resident passes the gate: who, the time, in or out, how the guard recorded it (the resident’s gate QR, a vehicle number or by hand) and which guard. The society’s own service vehicles (such as a water tanker) are logged in the same way.
• Material passes and moves: a pass for goods or for moving in or out, with the mover’s name, phone number and vehicle, the items, a note, photos, and the society’s no-objection certificate.
• Guard attendance and patrol: when a guard marks in and out of a shift: the time, the phone used, the gate’s checkpoint scan and a selfie taken live with the front camera, stamped with the society, the guard’s name, the date, the time and the location; and each checkpoint a guard scans on a patrol round, with the time and the location. The society’s office uses them to see that the gate was covered.
• Staff profiles: for daily staff and regulars (such as a cook, driver or tutor) that a home or the office adds: their name, phone number and photo, the days they came, and the ratings (1 to 5) and notes that homes give them.
• Billing and payments: bills, payments, receipts, UPI or cheque references, and dues. A society’s subscription to Ekvasa is paid through Razorpay, which handles the card or UPI details; we never see card numbers or UPI PINs. Residents can still pay the society by UPI, cheque or cash outside the app.
• Paying dues in the app: a resident can pay dues inside the app on a payment page of the society’s own Razorpay account, which is given the payer’s name and email. The money goes to the society’s bank account, not to us. For each payment we keep the bill and the home, the amount, the time, the result (and the reason if it failed), the payer’s name, how it was paid (such as UPI, card or net banking), Razorpay’s fee and the tax on it, Razorpay’s payment reference, the receipt number, the settlement’s reference and date once Razorpay pays the society out, and any refund the society makes (its amount, its reason and who asked for it).
• Auto-pay of dues: where the society switches it on, the owner or tenant of a home can set up auto-pay for its bills: a mandate on the society’s own Razorpay account, by UPI AutoPay, a bank e-mandate or a card, with a cap on each debit. The cap is shown before the person approves, and a bill above it is not taken. The person approves once on Razorpay’s page inside the app, where they enter their UPI, bank or card details, which we never see; the society’s Razorpay account is given their name, email and mobile number to set it up. Each bill is then debited, up to the cap, starting a number of days before its due date that the society sets (0 to 10), and recorded like a payment above. For each mandate we keep the home, the name of the person who set it up, the method, the cap, its status, when it was approved or stopped, the number of failed debits and the reason, and Razorpay’s customer, token and registration references; for each debit, the bill, the amount, the result, the reason if it was refused or failed, and Razorpay’s payment reference. The home can stop auto-pay from the bill at any time, and so can the society office. The money goes to the society’s bank account, not to us: Ekvasa holds no money, and the mandate is held by Razorpay and the person’s bank, not by us.
• Helpdesk, notices, bookings and parking you or the office create, with any photos added. If you have said yes to AI sorting (the app asks once; the switch is under Account), a complaint’s title and description are also sent for sorting (section 4, TypeSafe).
• Polls, surveys, elections, meetings and documents: votes and answers (a secret survey or election shows the office who answered, not what), comments on meetings, and the documents the office shares (such as bye-laws, minutes, or a home’s own papers like an NOC or share certificate).
• The society’s accounts and assets: its vendors (with their phone number, GSTIN, PAN and bank details) and its expenses, with photos of the bills; its assets and service contracts with their documents; its budget and fixed deposits; and the lines of a bank statement the office imports to match payments.
• Nearby businesses (only if the society switches it on): a business that lists itself gives its name, photos, location and service area, hours and contact details. When you ask a business for a visit, it receives your first name, your home and, only if you tick "Share my number", your mobile number, for that visit only.
• Chats: messages and photos you send; the words are stored encrypted. Anyone can report a message, comment or note that breaks the rules; the report keeps what was reported so that it can be reviewed, and before you send a report the app tells you that what you report will also be shared with Ekvasa to review it (section 4).
• Support: what you write to Ekvasa Support (our helpdesk) by email, chat or its help centre’s form, with your name, email and mobile number; when you open it signed in to the web console or the app, also your society and role there, so you need not explain who you are.
• Device and crash reports: a push-notification token for your phone, the app version, the phone model and system version (sent with a support request, and shown to the society’s office on the list of gate phones), and security logs (sign-ins, failed attempts). If the app crashes, Firebase Crashlytics (Google) receives a crash report: what failed, the app version, the phone model and system version and a random installation code; never your name, number, society or messages. We do not use advertising identifiers.
• Location, only at the moment something needs it: a guard’s phone adds the date, time and the gate’s location (coordinates) to each photo it takes, and keeps the location with a shift mark-in and a patrol scan, where the society’s office can see it. A business owner who taps "Use my location" keeps the shop’s coordinates with the listing. In the web console, the office can place a pin on a map for the society. The phone’s own permission is asked first, location is never read in the background, and residents’ phones do not send their location. We do not otherwise track location.
• Guard live talk: guards can hold Talk to speak live to the other guards of the same society, like a walkie-talkie. Only that society’s gate staff can hear it, and the voice is not recorded or stored: it is passed on live and gone.
• Calls in the app: between members, from the gate to a home and from the office: who called whom, when, whether it was answered and how long it lasted; never the sound and never a phone number. The voice is passed on live through our own call server (it runs LiveKit software), and is not recorded or stored.
• Emails from a society: when the society’s office sends a campaign by email, the email carries a tiny image that tells the office whether you opened it, and when. Other emails from Ekvasa do not.
• If we block an account for fraud or misuse: a keyed hash of its email and mobile (a scrambled code made with a secret key, not the address or number itself), so the same person cannot simply open a new account, and the times that account tried to sign in afterwards.
• Phone permissions, asked only when a feature needs them: the camera (photos at the gate, of parcels and complaints, QR codes, and a guard’s shift selfie); your photos (to attach or save a picture); the microphone (calls in the app and guards’ live talk); location, only as the location point above says; and notifications (alerts, calls and SOS). Saying no turns off only that feature. The app does not ask for your contacts or for permission to read your text messages; on Android it can fill in the sign-in code from the text we send you.
• Vehicle numbers are used only inside the society: at the gate, for parking, for vehicle alerts and, in the members directory (unless a person switches it off), where a home’s vehicles show on the cards of its people and the end of a vehicle number (at least its last four letters and digits) finds those people (section 4). We never look them up in any outside register.
• Sensitive details: the sign-in PIN (kept only as a secure hash); bank details the society office enters (such as its vendors’) and payment references (never card numbers or UPI PINs); and the reason given for an SOS, such as a medical one. Attendance selfies are only photos: Ekvasa does no face recognition and keeps no fingerprints or other biometrics.

3. Why we use it

We use personal data only to provide the service agreed with the society, for these purposes:

• The society’s records, for the society: the gate and visitors, bills and dues, complaints, notices, polls and elections, bookings, parking, staff, attendance and patrols, as the society instructs (section 1).
• Your account and its safety: signing in, sign-in codes, and stopping fraud and misuse of the service.
• Messages about the service: notifications, texts, emails and WhatsApp messages (when switched on). You can switch most notification groups off in the app; SOS and security alerts always reach you.
• Emergencies: an SOS goes to the people your society set up to answer it, by its reason.
• Your own choices: AI sorting of your complaints, how you appear in the members directory, sharing your number with a business you ask for a visit, and a child’s exit alert. Each is your choice, and you can change it (section 7).
• The law: keeping the records the law requires, answering lawful orders, and reporting security incidents.
• Support, and keeping the service working: answering you, fixing faults from crash reports, and counts (never the content of what you write) to plan the service.

We do not use your data for advertising or profiling, and we never sell it.

4. Who sees it

• Your home sees its own visitors from the day you joined it, and on each of their entries who answered and the gate’s calls to the home about that visitor (never another home’s calls, and never calls between residents), and its bills, receipts, auto-pay and complaints.
• Guards see what the gate needs: today’s visitors, with who answered and the gate’s calls about each, passes, codes and staff; when a home does not answer in the app, its names and numbers to call. A number-plate look-up shows the home, slot and sticker, never a name or number.
• The society office sees what its role allows (for example, a treasurer sees billing, and the gate log, with each visitor’s details, needs its own permission; so do residents’ gate movements and guards’ attendance); every role is listed in the app. The office does not read private chats; it sees a chat message only when someone in that chat reports it, and when a report is not dealt with in time, Ekvasa is told and can remove the reported message. An urgent report (an intimate image, nudity or someone pretending to be another person) reaches Ekvasa at once, and Ekvasa decides it. In both cases Ekvasa sees where and when it was posted, the reason, who posted it and the office’s decision (on an urgent chat report, also the office’s note); it sees the words only as the next point says.
• Ekvasa, for a report. When you report a chat message, a meeting comment or a note, the app tells you before you send it that it will be shared with Ekvasa to review your report: the comment or note itself, or the chat message with up to 2 messages before it in the same chat (who wrote each, when, its words and any photo). Ekvasa keeps this copy apart from the society office’s, sealed like chat words. Only an Ekvasa Super Admin can open it, in Ekvasa’s console with a fresh authenticator code, and its photos stay blurred until they choose to show one; every opening and every photo shown is recorded, with who and when, in the report’s history. It is deleted 30 days after Ekvasa decides the report or the report is closed, and never kept longer than the report itself. A report sent before the app told you this gives Ekvasa no words at all. Nothing else from a chat reaches Ekvasa this way.
• Other members see you in the members directory only as you choose; you can hide your number or not be listed. Your card in the members directory also shows your home’s vehicles (number, kind, make and model, colour; never the sticker, the parking slot or the office’s notes) to any member of your society who opens it. A member finds the people of a home by a vehicle number only by typing the end of that number: at least its last four letters and digits, such as 1234 or AB1234 for MH 12 AB 1234 (spaces, dashes and capital letters do not matter). The start or the middle of a number, or fewer than four letters and digits, finds nobody. The number leads only to the people who live in that home, whom the member can then message or call in the app. In a home that is let out, its vehicles show only on the cards of the tenant’s household and lead only to them, never to the owner or the owner’s family. A child is never found this way, and neither is a person who is not listed in the members directory. A member you blocked, or who blocked you, does not find you by a vehicle and does not see your vehicles on your card, but can still find you by name. This is on to begin with. You can switch it off for yourself (Account, then Privacy); that stops both being found by your home’s vehicle numbers and the vehicles on your card. The choice is yours alone: the other people of your home choose for themselves.
• A business you ask for a visit sees what section 2 says, for that visit only, and may use it for nothing else. Otherwise a business sees only its own listing and counts of views and calls.
• The Ekvasa team, for accounts. It runs and supports the service and protects it from fraud and misuse. It can find any account and see its name, email, mobile, how it signs in, when it last signed in, and the societies, homes, roles and family links it has; every look is recorded with its purpose. It can correct a name, email or mobile, reset a gate login’s PIN, sign an account out, switch off one of its logins or block it, each with a recorded reason, and it tells the person in the app, and by email where the account has one. An email address changes only when the person confirms, or after 72 hours’ notice to them. A PIN it resets can only be used to choose a new one, and that account’s chats stay closed for 72 hours.
• The Ekvasa team, for a society’s records. The society’s day-to-day records (residents’ details, children’s entries, bills, complaints, the gate log, visitor photos and notices), its members directory (exactly as its members see it; the team never changes anyone’s choices there) and its documents shelf (each document it opens is recorded) only in a support session: recorded, time-limited, and told to the society’s admins at once. A session that only looks cannot change anything. A session that makes changes needs no one’s approval, but it is limited to the areas the team chose, it records every change, and the society’s admins are told every time it starts. The admins can report a session; they cannot end it. A report goes to every Ekvasa Super Admin and to a separate Ekvasa mailbox, and another Super Admin can end any session. A session that makes changes can be extended once, by up to an hour, and never past two hours in all. Where a society has no admin who can be told (a new society before its first admin, or one whose admins have all gone), its sessions are flagged and every Super Admin is told; the first admin of a new society sees the set-up sessions on first signing in. To appoint an admin where none is left, the team needs the proof of a committee resolution or an authority’s letter, and it tells the society’s role holders and former admins. In a session the team sees chat figures (how many groups and messages there are), never the words of a private chat.
• The Ekvasa team, in an emergency (people at risk, or a society that cannot use the service). It can also let a visitor in or out at the gate and answer an SOS. Emergency access lasts 60 minutes, the admins also get a text message, and Ekvasa explains it to the society within 72 hours.
• The Ekvasa team, outside a session. It can also step an admin down, change a society’s name, address, language and joining code, and suspend a society. It can remove a suspended society only after sending its admins a copy of its data and giving 30 days’ notice (72 hours if the society confirms in writing that it has its copy); an open legal request stops a removal. People’s own accounts stay. It also sees figures such as how many homes a society has, and its text-message log shows the numbers Ekvasa’s own texts went to (such as sign-in codes). Each step is recorded.
• What the Ekvasa team never does: use someone’s login or post as them, approve a society’s spending, or read a private chat, except what someone reports to Ekvasa (above) or under a lawful written order (the last point below), a separate process.
• Service providers run parts of the service for us, under contract and only for that purpose. The next bullets name each one.
• Supabase: our database, file storage and sign-in service, in India (Mumbai).
• Hostinger: the servers that run this website, the web console, our call server and Ekvasa Support (our own helpdesk, which we run ourselves); support emails reach the helpdesk through our Hostinger mailbox.
• Google Firebase: push notifications to phones (iPhone notifications pass through Apple’s notification service) and crash reports (Crashlytics).
• Razorpay: payments of a society’s subscription to Ekvasa, and, where the society sets it up, residents’ online payment of dues and auto-pay of dues (a mandate) on the society’s own Razorpay account.
• Amazon Web Services (Amazon SES, Mumbai): sending our emails, such as sign-in codes, welcomes, bills, receipts, notices and society campaigns.
• MSG91 and JioCX: sending SMS (sign-in codes and notices). Meta Platforms: WhatsApp messages, when switched on.
• TypeSafe: an AI service that sorts helpdesk complaints. It receives a complaint’s title and description, only if the person raising the complaint has said yes (the app asks once, and the switch under Account changes the answer); if not, the society’s office sorts the complaint by hand.
• The AI assistant in Ekvasa Support (when it is switched on) reads a support chat or email and our help articles to answer or to draft a reply, through Anthropic (Claude), or OpenAI or Google Gemini when we choose them instead, with Google Gemini also used to search our help articles for the question asked; it receives support messages with names, email addresses and mobile numbers replaced by placeholders, which we put back only on our own server.
• OpenStreetMap: the map pictures and the address search in the web console’s society location setting (it sees the address and pin code typed there, and the network address of the office’s browser).
• Outside India: some providers may process data outside India, for example push notifications and crash reports through Google Firebase, WhatsApp messages through Meta, and the AI services through TypeSafe, Anthropic, OpenAI or Google.
• If the business changes hands (for example, to a company the owner forms), the data moves with it under this policy, and we tell societies first.
• Police, courts and authorities only on a lawful written order, or a written request from an agency the law authorises that states its purpose, through a recorded process, for what it names.

We never sell your data or share it with advertisers, delivery apps, brokers or businesses listed in the app. The one exception is yours to make: when you ask a listed business for a visit, it gets your first name, your home and, only if you tick it, your number, for that visit alone. Nothing from outside businesses appears unless your society switches it on, and never in notifications or chats.

5. Where and how it is kept safe

Data is stored in India (Mumbai) on encrypted disks and sent only over encrypted connections. Chat words, and Ekvasa’s copy of a reported message, are encrypted again inside the database. Access is limited by role, office actions are recorded, and Ekvasa’s own team signs in with an email code and an authenticator app, and enters a fresh authenticator code for every support session and every change to an account or a society. Every support session is recorded and kept for a year: the database records the session, the files opened through the console and the changes; the console records the pages opened. Everything else the team does to an account or a society goes into a separate record that cannot be edited, kept for three years.

6. How long we keep it

• Visitor photos: 30 days.
• Parcel photos: 30 days after hand-over.
• Complaint photos: 90 days after the complaint closes.
• Chat photos: 90 days. Chat messages: one year. A deleted chat message’s hidden copy: 180 days.
• Notification history: 90 days, unless Ekvasa sets otherwise.
• Vehicle alerts: 90 days.
• Residents going in and out at the gate: 90 days, unless Ekvasa sets otherwise.
• Guard attendance (with the selfies) and patrol scans: while the society uses Ekvasa.
• Calls in the app (who called whom, when and for how long): 90 days. This includes a call the gate makes from a visitor’s entry, which shows in that entry for the same 90 days.
• Texts and emails we send (sign-in codes, welcomes and notices by SMS, WhatsApp or email): the mobile number or address, the message and whether it arrived, 180 days, as CERT-In’s directions ask. Who a society’s campaign email reached, and whether it was opened: 180 days.
• Bank statement lines the office imports: 400 days.
• A visitor’s request through an invite link: until the link is removed, at least 90 days after it was made; an approved request goes on as the visitor’s pass and entry.
• A visit you ask a nearby business for: 180 days after the visit’s time.
• Crash reports: Google Firebase keeps them for 90 days.
• Records of Ekvasa support sessions: one year.
• Reports of a message, comment or note, and how each was decided: one year. Ekvasa’s copy of what was reported (section 4): 30 days after Ekvasa decides the report or the report is closed, never longer than the report itself.
• Which rules notice you were last sent, when, and whether by email: while you have the account.
• Records of what the Ekvasa team does to accounts and societies: three years.
• Blocks and switched-off logins, with their keyed hashes (section 2): while in force and three years after, also after the account is deleted. Records of PIN resets and of changes to an email or mobile number: three years. Sign-in attempts refused for a blocked or switched-off account: 180 days.
• A society Ekvasa has removed: its summary (name, code and counts, with no personal details), eight years; its data export, 30 days; its chat messages are kept hidden and sealed for 180 days, like any deleted chat message.
• Onboarding requests sent from this website: as section 11 says.
• Support conversations (emails and chats with Ekvasa Support): while we need them to support you and your society.
• Bills, receipts, online payments and auto-pay records, and the society’s financial records: as long as the society needs them and the law the society is under requires. Ekvasa’s own invoices and receipts to societies: as long as GST law requires (CGST Act, section 36).
• Your account: while you use it. Delete it any time in the app (Account, then Delete my account) or at /delete-account. With a PIN or in the app, it is closed at once; with an emailed code on the website, it is locked at once and deleted after 7 days unless you keep it. Your profile, sign-ins, notifications, choices, chat messages and meeting comments go; so do the child entries you listed in a home, and the family invites you made that nobody has used yet; records your society keeps (bills, receipts, the home’s history, the visitor log, with the gate’s calls about each visitor for their 90 days, residents’ gate movements for their 90 days, a guard’s attendance and patrol records, complaints) stay with the society without your account; records of admin and role changes, and of your choices in the members directory, keep your name; names printed on bills and receipts or kept with online payments and auto-pay, and in the home’s history and the visitor log (the gate’s calls about a visitor included, for their 90 days), stay as written. Deleting your account stops every auto-pay you set up, as the account is deleted (at once in the app or with a PIN, at the end of the 7 days on the website): no bill is debited on it again, and we ask the society’s Razorpay account to delete the mandate too (a debit already sent to your bank before you deleted may still go through, and is then recorded on the home’s bill as usual). We keep your name, mobile, email and homes, and your deleted chat messages, sealed for 180 days (longer only under a legal order), as Indian law asks, then erase them. Under a legal order we may also keep, sealed, other data we would otherwise erase, for as long as the order lasts. We also keep a record that the account was deleted (when, how and which societies, with no name, email or number). Backup copies are erased within 30 days. Texts we sent you stay in our message log for their 180 days (above). Our service providers (section 4) keep their own logs for their own periods: delivery logs, the website host’s logs, the sign-in service’s log (your email and the address you signed in from), and the complaint text TypeSafe sorted.
• Everything else (the visitor log, staff profiles and their photos, complaints, notices, polls, meetings, documents, and the society’s vendors): while the society uses Ekvasa; after that, as section 9 of our terms says.

7. Your rights

You can ask us to tell you what we hold about you, why, and who it was shared with (other organisations, and the service providers in section 4); to correct, complete or update it; to delete it where the law allows; and to accept someone you nominate to use these rights for you if you die or cannot act yourself.

• Yourself, in the app: see and correct your profile (Account); choose how you appear in the members directory, and whether your home’s vehicle numbers can find you; switch notification groups on or off; turn AI sorting of your complaints on or off (Account); remove family members you added; switch a child’s exit alert off; and delete your account (Account, then Delete my account, or /delete-account).
• By writing to us: write to privacy@ekvasa.com, from the email on your account if you can, with the mobile number you sign in with, your society and your home, so that we can find your data and check that it is you. To nominate someone, give their name and how to reach them. We reply within 30 days.
• The society’s records (such as bills, the gate log, complaints and notices) belong to the society: ask the society office first. If you write to us about them, we pass the request to the society and help it answer.
• Withdrawing consent is as easy as giving it: switch the choice off in the app, or write to us. It stops what it covers from then on; what was done before stays as it was, and a feature that needs that data may stop working for you.
• If you are not satisfied with our answer, write to the grievance officer (section 10). After that, from 13 May 2027, you may complain to the Data Protection Board of India.

8. Children

A parent or guardian living in a home may list their child by name and age. They tick, in the app, that they are the child’s parent or guardian and agree to listing them; we record who confirmed and when. A child with their own mobile and email can have their own sign-in, added the same way; like other residents, their name and mobile are on the gate’s call list, they can answer visitors at the gate, and they are in the society’s group chats, but they are not listed in the members directory unless they choose to be. A child’s details are seen by the people of that home, the society office and, in a support session, the Ekvasa team; in a let home, the children its tenant lists without a sign-in are seen only by the tenant’s household, not by the owner or the owner’s family. A child listed without a sign-in never appears in the members directory or in chats, and appears at the gate only when the parent who listed them switches on the exit alert for that child; the gate then sees the child’s name, age and home, the adults of the home who can see the child’s entry are told each time the child leaves or comes back, and the parent who listed the child can switch it off at any time. These exit records are kept for the same days as other gate movements, then deleted. A child’s entry is deleted when it is removed; when the parent or guardian who listed it deletes their Ekvasa account, or, as a tenant, moves out, or sells the home; and when no owner or tenant is left in the home. When the parent or guardian who added a child with their own sign-in deletes their account, the child keeps their own account and place in the home, and the age and the parent’s or guardian’s confirmation are deleted. We never use a child’s data for advertising, for profiling or for Nearby businesses. Apart from children added by a parent or guardian as this section says, Ekvasa is for people aged 18 or over (terms, section 2).

9. If something goes wrong

If a security incident affects personal data:

• we report it to CERT-In, the national team for computer security incidents, within 6 hours of noticing it, as its directions require;
• we tell the society at once when its records are affected, so that it can act too;
• we tell the people affected without delay, in the app and by email or text: what happened and when, what it may mean for them, what we are doing about it, what they can do to protect themselves, and whom to contact;
• from 13 May 2027, we also report it to the Data Protection Board of India, as the Digital Personal Data Protection Rules require.

10. Grievance officer

Harshida Nerikar, Grievance officer, Colligo Infotech, A-606, Prahlad Nagar Trade Center, Vejalpur, Ahmedabad, Gujarat 380051. Email privacy@ekvasa.com.

Write to the grievance officer about this policy or the terms, about your data, or about something posted in Ekvasa (in the app, you can also tap Report on a message, comment or note). Say who you are and what the complaint is about; for something posted, say where and when. Orders from courts and government agencies are received at the same address.

The IT Rules, 2021 set these times for the grievance officer:

• a complaint is acknowledged within 24 hours and resolved within 7 days;
• a complaint asking us to remove something that breaks the rules in section 6 of the terms is acted on within 36 hours;
• something that shows you, or the person you complain for, nude, partly nude or in a sexual act, or that impersonates you (a changed photo included): in the app, tap Report on it and choose "Intimate image, nudity or someone pretending to be another person", which reaches Ekvasa at once, or write "Urgent" at the start of the subject; the IT Rules give us 2 hours to act on it.

If you are not satisfied with the grievance officer’s decision, you may appeal within 30 days to the Grievance Appellate Committee of the Government of India (gac.gov.in). About your personal data, from 13 May 2027, you may also go to the Data Protection Board of India (section 7).

11. This website and onboarding requests

This website sets no cookies and uses no analytics, advertising or trackers; its fonts and images are served from this site, and it has no chat window. Your browser remembers, on your device only, the language and the appearance (light or dark) you choose here. If you arrived by a link with campaign tags (such as one from an expo or a post), the tags are kept in this browser tab only and sent with the onboarding request form if you send it, so that we know where the request came from. The web console sets only its own cookies, none for tracking or advertising: one that keeps you signed in, and others that remember the display choices you make there (appearance, layout, and whether its side menu is open). Your browser also keeps, on your device only, small console choices such as how many rows a list shows.

Live chat with Ekvasa Support (support.ekvasa.com), our own helpdesk, is for people signed in to Ekvasa: in the app (Account, then Help centre and chat) or in the web console. Opening it from there signs you in to Ekvasa Support with your name, email, mobile number, society and role, so you need not sign in again or explain who you are. Ekvasa Support keeps its own session cookie, and while chat is open in the web console it notes the console pages you open, so we can see where you needed help. All of Ekvasa Support, its help articles included, opens only after signing in this way (the Ekvasa Support team signs in separately, with a second step); anyone can write to support@ekvasa.com. There are no other trackers.

When you send the onboarding request form, we keep what you give us: the society’s name, city, state and number of homes; your name, role, mobile number and email if you give one; the best time and language for a call; what the society uses today; your message; the campaign tags of the link you came by, if any; and your consent. We use these details only to talk with your society about Ekvasa.

To stop abuse, we keep for 30 days the time of each send and the mobile number it gave (including some sends we refused), and your network address only in a scrambled form (a keyed hash). The companies that host this website and the form see the address itself in their own access logs, for a short time.

If your society does not go ahead, we erase your request within six months of closing it (within 30 days if it was a duplicate or spam), and any request left untouched for a year. A request that becomes a society is erased a year after the society comes on board, when the society’s own records hold its admins. After erasing a request we keep only a note that it existed, with no personal details.

When a resident shares an invite link and you open it, the page asks for your name, mobile number, the expected day and time and an optional note, and sends them to that resident’s home, which decides whether to let you in. We keep, for rate limits, your network address only in a scrambled form (a keyed hash). The request is kept as section 6 says.

12. Changes

We update this page when the service or the law changes; the date of the last change is at the top. We tell societies’ admins of important changes before they apply. Every user is also told in the app when this policy changes. Ask us at privacy@ekvasa.com for an earlier version.

13. The law this policy follows

This policy follows India’s Information Technology Act, 2000, with its rules on reasonable security practices and sensitive personal data (2011) and on intermediaries (2021), which apply now. It is also written for the Digital Personal Data Protection Act, 2023 and its Rules, 2025, whose duties for services like Ekvasa apply from 13 May 2027; until then, we follow them where this policy says so. If this English version and a translation differ, the English version applies.