1. Who we are
Flatbriz is web-based society management software made by Kujata Global Technologies Private Limited, trading as KGT Solutions, a company registered in India (CIN U72100AP2020PTC116611) with its registered office at 3-58, Raja Veedhi, Yalamanchili, Visakhapatnam, Andhra Pradesh, India 531082 ("KGT", "we", "us").
This policy explains what personal data Flatbriz handles, why, how long we keep it, who we share it with, and what rights you have. We have tried to keep it short and in plain words. If anything is unclear, write to us at [email protected].
2. Two different roles we play
This matters, so we explain it first.
When a society uses Flatbriz. The housing society or RWA decides what information about its residents, guards, staff and visitors goes into Flatbriz and what it is used for. Under the DPDP Act, the society is the Data Fiduciary for that information. We are the society's Data Processor. We only process that information on the society's instructions and under our agreement with the society. If you are a resident, guard or visitor and have a question about how your society uses your data, you can ask your society's committee, or write to us and we will pass it on and help.
When you deal with us directly. When you visit our website, fill in the “Enroll your society” form, write to us, or sign in to your account, we decide how that information is used. For that information, we are the Data Fiduciary.
3. What we collect
Information a society enters or its members add while using Flatbriz
- Resident details: name, flat or unit number, wing, phone number, email address, whether owner or tenant, family members or staff a resident chooses to add.
- Guard and staff details: name, phone number, shift, gate assigned.
- Visitor details recorded at the gate: name, phone number, flat being visited, purpose of visit, time in and time out, and a photo, if the society chooses to capture one.
- Society records: complaints and requests (including any photos attached), notices, facility bookings, maintenance dues records, votes, and the history of all of these.
- Committee details: names and roles of committee members.
Information you give us directly
- Enrollment form: your name, society name, city, number of flats, phone or WhatsApp number, and the reason you are contacting us.
- Messages, emails, calls and support requests.
Information collected automatically
- Sign-in details, device and browser type, IP address, pages used, and the date and time of actions in Flatbriz. We keep these as activity logs for security, for fixing problems and to meet legal requirements.
- Cookies on our website. See section 10.
What we do not collect. Flatbriz does not currently process card numbers, bank account details or UPI details. If online payment is added later, it will be handled by a licensed payment provider and this policy will be updated before it goes live.
We do not knowingly collect sensitive details such as health, religion, caste or financial account information, and we ask societies not to enter them into Flatbriz.
4. Why we use it
| Purpose | Whose data | Our basis under the DPDP Act |
|---|---|---|
| Running Flatbriz for a society: visitor entry, complaints, notices, dues records, bookings, records and handover | Residents, guards, staff, visitors, committee | On the society's instructions, as its Data Processor. The society is responsible for having a valid basis, such as consent or a legitimate use. |
| Creating and managing accounts, signing people in, keeping accounts secure | Anyone with a Flatbriz account | Consent, and to provide the service you signed up for |
| Replying to enrollment requests and setting up a society | People who fill in the enrollment form | Consent, given when you submit the form |
| Setup, training and support | Society members who contact us | Consent, and to provide the service |
| Security, fraud prevention, and keeping activity logs | All users | Legitimate uses permitted by law, and legal obligations |
| Meeting legal duties and responding to lawful requests from authorities | As required | Legal obligation |
| Improving Flatbriz using usage patterns | Usage data, in a form that does not identify individuals where possible | Consent, which you can withdraw |
We never sell personal data. We never rent it, and we never use residents' data for advertising. Societies pay us for software. Resident information is not our product.
5. Who can see what inside Flatbriz
The society's committee decides who sees what. By default:
- Residents see society notices, their own flat's dues and requests, facility bookings, and the visitors they approve. They do not see other flats' dues or committee-only records.
- Guards see what they need at the gate, such as expected visitors and flat numbers.
- Committee members see society-wide records according to the roles the society assigns.
6. Who we share it with
We share personal data only with:
- Service providers who help us run Flatbriz, such as cloud hosting, email and SMS delivery, and customer support tools. They act on our instructions under written contracts and must protect the data. The current list is published at [flatbriz.com/subprocessors] and we update it when it changes.
- Your own society, for information you add to that society's Flatbriz account.
- Authorities, when the law requires it, such as a valid court order or a request from a government agency authorised by law.
- A buyer or successor, if our business or Flatbriz is sold or merged. The same protections in this policy would continue to apply, and we would tell affected societies in advance.
7. Where your data is stored
Flatbriz data is stored on servers located in [India / region of your cloud provider]. If any data is processed outside India, we will only do so where the DPDP Act and any government notification allow it.
8. How long we keep it
| Data | How long |
|---|---|
| Society records (visitors, complaints, notices, bookings, dues records) | For as long as the society uses Flatbriz, so records carry over when the committee changes. When a society leaves, see section 11. |
| Resident and guard accounts | Until the society removes the person or the person asks for deletion through their society, subject to legal retention needs |
| Enrollment form details, if the society does not sign up | 12 months from your last contact with us, then deleted |
| Support messages | 24 months from the last message |
| Activity and security logs | At least one year, as required under the DPDP Rules, and no longer than 3 years |
| Backups | Up to 30 days. Deleted data drops out of backups within this period. |
Once a purpose is complete and no law requires us to keep the data, we erase it. Where the DPDP Rules require it, we will tell a person at least 48 hours before erasing their data for inactivity.
9. How we protect it
- Data is encrypted in transit and at rest.
- Access is limited by role, both inside each society and within our own team.
- Every sign-in and important action is logged.
- Our team members who handle personal data are bound by confidentiality.
- We regularly review our security safeguards.
No system is perfectly secure. If a personal data breach happens, we will inform the affected society and the Data Protection Board of India, and help the society inform the affected people. We will do this without delay and within the timelines set by the DPDP Rules. Where we are the Data Fiduciary, we will inform affected people ourselves.
10. Cookies
Our website uses:
- Essential cookies to keep you signed in and keep Flatbriz secure. These cannot be switched off.
- Analytics cookies to understand how the website is used. We only set these if you agree, and you can change your choice at any time using the cookie settings link in the website footer.
We do not use advertising cookies.
11. When a society stops using Flatbriz
- The committee can export the society's records in standard file formats at any time, including before leaving.
- After the society's account ends, we keep the data for 30 days so the society can still export it, then delete it, apart from anything the law requires us to keep, such as logs.
12. Your rights
Under the DPDP Act you have the right to:
- Get a summary of the personal data being processed about you and how it is being used.
- Correct, complete or update your personal data.
- Have your personal data erased when it is no longer needed, unless the law requires it to be kept.
- Withdraw consent where processing is based on consent. Withdrawing is as easy as giving it. It does not affect processing already done.
- Nominate someone to exercise your rights if you die or become unable to do so.
- Raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.
How to use these rights. For data held for a society, you can ask your society's committee, or write to us and we will help. For data we hold as Data Fiduciary, write to [email protected]. We may need to confirm your identity first. We will respond within 30 days and no later than the time limits set by the DPDP Rules.
13. Children
Flatbriz is meant for adults. A resident may add family members, including children under 18, to their flat. When they do, the adult resident confirms they are the parent or lawful guardian and consents on the child's behalf. We do not track children's behaviour, profile them or show them targeted content.
14. Grievance Officer and data contact
If you have a question, a complaint or a request about your personal data, contact:
[Aditya Kaul], Grievance OfficerKujata Global Technologies Private Limited (KGT Solutions), 3-58, Raja Veedhi, Yalamanchili, Visakhapatnam, Andhra Pradesh, India 531082
Email: [email protected]
Phone: +91 87968 47991
We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
15. Changes to this policy
If we make an important change, we will tell societies by email or in Flatbriz before it takes effect, and update the date at the top of this page. Earlier versions are available on request.