Privacy notice

The part most notices bury

For everything inside a society's account — the member register, the ledger, gate entries, vehicle records, visitor photographs — your society is the Data Fiduciary and Zwangu is the Data Processor. The society decides what is collected and why. We hold and process it on the society's written instructions, under a signed agreement, and for nothing else.

That matters for a practical reason: if you are a resident and you want to know what is held about you, corrected, or erased, the decision is your committee's, and the fastest route is through them or through the app. We cannot act on your data against your society's instructions, and we would not want the power to. What the DPDP Act asks of the committee →

There is a second, smaller category: the data we collect for ourselves, as a company — when you fill in the pilot form on this website, email us, or use the referral programme. For that, we are the Data Fiduciary, and this notice is our own. Both are covered below, marked as such.

What we collect

From this website — we are the fiduciary

• The pilot enquiry form. Society name, city, number of flats, entity type, your role, your phone number and, if you give one, your email. We ask for these to call you back about a pilot and to size the import.
• Basic request data. Your IP address, browser and the pages you opened, in ordinary server logs. We do not run advertising trackers, cross-site pixels or behavioural profiling on this site.
• Anything you write to us. Email, and whatever you choose to put in it.

Inside a society's account — the society is the fiduciary

• Members and residents. Name, flat, ownership or tenancy, contact numbers, email, family members and domestic staff a resident chooses to register, vehicle registrations.
• Financial records. Bills, receipts, arrears, vouchers, attachments and the ledger. Payment references and status, never card numbers or bank credentials.
• The gate. Visitor entries, gate passes, deliveries, and visitor photographs where the committee has turned them on.
• Operational records. Complaints, approvals, notices, meeting and election records, amenity bookings.
• Access records. An append-only audit log of who did what, when, and from where.

Why we hold it

• To run the service the society asked for — billing, collections, the gate, the books. This is processing on the fiduciary's instructions.
• To answer you when you contact us or ask for a pilot.
• To keep the service secure and working — logs, backups, abuse and fraud prevention.
• To meet a legal obligation, including the retention that co-operative law imposes on a society's books.

We do not sell personal data. We do not share it between societies. We do not use one society's data to build a directory, a lead list or a marketing product, and we do not use it to train models.

Who else sees it

Inside your society, access is role-based and scoped: a guard sees today's gate, not the ledger; a resident sees their own flat, not a neighbour's arrears; an auditor sees books, not resident phone numbers. External roles are granted by the committee and revocable in one tap. How the committee grants and revokes →

Outside your society, personal data reaches only:

• Sub-processors we have contracted — cloud hosting, communications delivery and payment partners, each under a written agreement, each restricted to processing for your society, and each named in your processing agreement before you sign it.
• RBI-regulated payment partners, for the reference and status of a transaction. Zwangu never stores card numbers or bank credentials.
• Zwangu support staff, only when your committee raises a support request, only for its duration, and every access logged and shown to you in your own audit log. Nobody here has standing access to a society's ledger.
• A lawful authority, where we are compelled by Indian law. Where we are permitted to tell you, we will.

Where it is held

Indian regions only. Primary in Mumbai, replica in Hyderabad. No society data, backup or log leaves the country — that includes residents' phone numbers, gate photographs and vehicle records.

TLS 1.3 in transit, AES-256 at rest including database backups and gate photographs. Attachments are served through short-lived signed links, never public URLs. Queries are scoped row by row so one society's data cannot be reached from another's session. The ciphers, and row-level security →

How long we keep it

• Gate photographs — the period your committee sets, 90 days by default, then deleted automatically.
• Financial records — for as long as co-operative law requires the society to keep its books. The Act permits retention where another law compels it, and the app separates statutory records from personal data so an erasure request can be honoured without breaking the audit trail.
• Backups — 30 days of point-in-time recovery, then rolled off.
• Pilot enquiries — 24 months from your last contact with us, unless you ask us to delete them sooner.
• After termination — your data stays available in read-only mode for 90 days with export enabled, then we delete it within 30 days and confirm it in writing.

Your rights

Under the DPDP Act 2023 a Data Principal may withdraw consent (§ 6(4)), access a summary of what is held and who it reached (§ 11), have data corrected, completed and updated (§ 12(2)), request erasure (§ 12(3)), raise a grievance and have it answered (§ 13), and nominate someone to exercise these rights on their behalf (§ 14).

For data inside a society's account, exercise these in the Zwangu app, or with your committee. Each right has a screen behind it rather than an email address to write to. Every right, and the screen behind it →

For data we hold as fiduciary — a pilot enquiry, an email, a referral account — write to contact@kuery.in and we will act on it.

When something goes wrong

If a personal data breach affects your society we tell you what we know and what we are doing, inside the timeline the Rules prescribe, so that you can notify the Data Protection Board and your residents as the fiduciary. You will not learn about it from a status page.

Grievances

Write to our Grievance Officer at contact@kuery.in, with Grievance in the subject line. We acknowledge within 48 hours and respond inside the period the Rules prescribe. If a complaint concerns data held inside your society's account, we will tell you so and route it to your committee, because that is who can decide it.

A telephone and WhatsApp channel is being published shortly; until then email reaches us fastest.

Changes

When this notice changes materially we will say so on this page and date it, and where the change affects a society's account we will tell the committee directly rather than relying on you to re-read a web page.