VIDUTHI policies
Privacy policy
What we collect, why, where it lives, and how to get it back or have it destroyed.
Last updated 15 October 2026
The short version
- Your data is stored in Mumbai, India (AWS ap-south-1).
- We do not sell it, and we do not advertise on it.
- We never see your card details — Cashfree Payments India Pvt. Ltd. handles payments.
- Data about your residents belongs to you. We hold it on your instructions.
- You can export everything, or have it deleted.
This policy is not legal advice and has not been drafted by a lawyer. Have it reviewed before relying on it.
Two kinds of people in this policy
The distinction matters, so it is worth being precise:
- You, the hostel owner or staff member. You signed up. We are responsible for your data.
- Your residents. They did not sign up with us — you entered their details, or their hostel gave them a login. For their data you are the Data Fiduciary under the Digital Personal Data Protection Act 2023, and we are the Data Processor acting on your instructions. Getting their consent is your responsibility, not ours.
What we collect about you
| What | Why |
|---|---|
| Name, email, phone | To create and secure your account, and to contact you |
| Business and property details | To run the product you signed up for |
| Plan, bills and usage records | Your plan, your bills and payments, any credit, and the daily count of residents, staff and properties, so you can see what you were charged and so we can bill you correctly |
| Payment reference and status | To know what you have paid. We receive a reference and a result from Cashfree Payments India Pvt. Ltd. — never the card or UPI credentials themselves |
| Login and audit records | Security, and so you can see who changed what. Deliberately not deletable from inside the app |
| Technical logs (IP, browser, timestamps) | Diagnosing faults and detecting abuse |
What you put in about your residents and staff
Typically: name, phone, bed, joining date, deposit, rent, payments, leave, complaints, visitors, and any documents you choose to upload — including identity documents such as an ID card or Aadhaar copy. Staff details you add (name, phone, role, permissions) are held the same way. Residents and staff also sign in to the mobile apps, so their login details and app notification tokens are stored.
Purposes. We use this data only to provide VIDUTHI to you: running your property records, raising and recording rent, sending the notifications you switch on, securing accounts, preventing abuse, billing you for your plan, and meeting legal obligations.
We hold it so the product works. We do not:
- sell it, rent it or share it with advertisers
- use it to build any profile of a resident
- contact your residents for our own purposes
- read it, except when you ask us to help with a fault
Every organisation’s data is isolated at the database level, so one hostel cannot read another’s — that rule is enforced by the database itself and not only by the app.
Where it is stored
On Supabase infrastructure in Mumbai, India (AWS ap-south-1). Data is encrypted in transit and at rest.
Who else touches it
| Who | What for |
|---|---|
| Supabase | Database, authentication and file storage |
| Vercel | Serving this website and the web app |
| Firebase / Google | Sign-in (Google authentication) and push notifications |
| Resend | Sending email such as sign-in codes and receipts |
| WhatsApp / Meta | Delivering WhatsApp messages, only if you turn WhatsApp on; the recipient’s phone number and message text are sent to them |
| Cashfree Payments India Pvt. Ltd. | Taking payments for VIDUTHI. They handle card and UPI details under their own policy and RBI rules; we never receive them |
We may also disclose data where the law requires it. If we can lawfully tell you first, we will.
These providers act as our processors, or as independent controllers for their own service, under their own privacy terms.
How long we keep it
- While your account is open — as long as you need it.
- After you close it — 90 days, so an account closed by mistake can be recovered. Then it is deleted.
- Financial records — including bills, payments and credit (and the earlier billing wallet ledger), retained where tax or accounting law requires, typically eight years, even after deletion of the rest.
- Audit and payment records — kept for the statutory period. These are the records that protect you as much as us.
Your rights
Under the DPDP Act 2023 you may:
- ask what we hold about you and get a copy
- have inaccurate details corrected
- have your data erased, subject to what the law requires us to keep
- nominate someone to exercise these rights if you cannot
- complain, first to us and then to the Data Protection Board
Export is built into the product — residents, invoices, payments and reports, at any time, without asking us. For anything else, reach us by email at viduthi@rekoodu.in. We reply within 30 days.
If you are a resident and want your data corrected or removed, ask your hostel first — it is their record and they decide. If they do not respond, write to us and we will put it to them.
Cookies
We use essential cookies: those that keep you signed in and the session secure, and a language cookie that remembers the language you chose. On our public pages, sign-up and activation only, we also use advertising and analytics cookies from Google Ads and Google Analytics, to learn which of our ads bring people who sign up. They see that you visited and whether you signed up or activated; never anything inside your account. Inside the app there are no advertising or analytics cookies.
Security
- Encrypted in transit (HTTPS) and at rest.
- Access separated by role, so a warden cannot see collection figures unless you allow it.
- Row-level isolation enforced in the database, not just in the interface.
- Passwords are stored hashed. Nobody at Rekoodu Technology can read yours.
No system is perfectly secure. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.
Children
VIDUTHI is for businesses and is not directed at children. If a resident is under 18, you are responsible for having the consent their guardian must give under the DPDP Act before entering their details.
Grievance officer
As required by the Information Technology Rules 2021 and the DPDP Act 2023:
- Name
- Surendran
- Reach
- viduthi@rekoodu.in
- Address
- Rekoodu Technology, GJS Excellence, Panangulam, Panangulam Tamil Nadu 614624, India
- Response
- Acknowledged in 48 hours, resolved within 15 days
Changes
If we change this policy in a way that materially affects you, we will tell you inside VIDUTHI before it takes effect. The date at the top always shows when it last changed.
Contact
Rekoodu Technology — reach us by email at viduthi@rekoodu.in. The registered postal address is on the contact page.