# Nivaas Privacy Notice for Owners

**Version 1.0 — effective 18 September 2026**

This is Part E of the Nivaas Terms of Service, published on its own.

## Part E: Privacy notice for owners

This notice is shown on its own screen, has its own version and fingerprint, and is published at nivaas.proarcai.in/privacy. It can be read without the Terms of Service.

**E1. Who we are.**
- ProArc AI: Prostil Jain, sole proprietor.
  - Address: 6-A-17 Mahaveer Nagar Extension, Kota, Rajasthan 324009
  - GSTIN: 08CBHPJ7575H2Z6
  - Email: contact@proarcai.in
  - Phone: +91 86909 84608
- ProArc AI collects and keeps the information this notice describes.
- Our Grievance Officer is Prostil Jain, at the same address, email and phone.

**E2. What this notice covers.** It covers:
- information about you as an owner of a Nivaas account;
- the security records we keep about you.

It does not cover what you and your staff enter about residents, visitors and staff. You are responsible for that information, and we handle it for you under the Terms of Service.

**E3. What we collect.**
- At sign-up:
  - your name, email address and business name;
  - your browser's time zone;
  - your password, which we keep only as a one-way hash.
- When you accept our terms:
  - the Customer's legal name, type of business and GSTIN;
  - your confirmations that you are 18 or older and authorised.
- In Nivaas settings: the UPI ID and payee name your residents pay to.
- Outside Nivaas, when you deal with us:
  - your phone number;
  - your WhatsApp and email messages with us;
  - your billing address and GSTIN;
  - quotes and invoices;
  - your payments to us, including the payer name and the UPI ID or bank account details they show.
- Security records:
  - your sign-in email;
  - how and when your password was set;
  - your sessions and sign-in times;
  - each sign-in attempt: the email typed, the time and the network address;
  - password-reset requests: the email, network address and browser;
  - network addresses, and browser and device details;
  - what you do in Nivaas (the change history);
  - our staff's access to your account;
  - your acceptances of terms.
- The size of your account: properties, rooms, beds, residents and staff.

**E4. Why we use it.** We use this information to:
- create and run your account, and keep it secure;
- run trials, the extension and paid terms, and lock or reopen accounts;
- quote prices and set price bands;
- issue tax invoices and meet our tax and other legal duties;
- give support;
- show who did what, and prove acceptance of terms;
- detect, investigate and report security incidents;
- send you messages about your account, your term, and changes to Nivaas or its terms.

We do not sell it or use it for advertising. We send you promotional messages only if you separately agree.

**E5. Sensitive personal data, and your consent.** Under the 2011 rules made under the Information Technology Act, these count as sensitive personal data:
- your password;
- the UPI ID you enter to receive payments;
- the payment details shown on payments you make to us.

By ticking the box on this notice, you consent to our collecting and using them for the purposes in E4.
- You do not have to enter a UPI ID. Without one, Nivaas cannot create payment links for your residents.
- An account cannot work without a password.
- We cannot accept a payment from you without receiving its payment details.

**E6. Who receives it.** We share this information only with:
- our providers:
  - Supabase and Amazon Web Services, for storage in Mumbai;
  - Cloudflare, for running Nivaas;
  - Hostinger, for our administration server in Mumbai;
  - Anthropic, for the AI assistant we use to build and maintain Nivaas, which can see data during maintenance;
  - Google, for our email;
  - WhatsApp (Meta), if you message us there;
- our bank and UPI provider, for payments you make to us;
- authorities, when the law requires;
- anyone who takes over our business, after notice to you.

**E7. Where it is kept.**
- Your information is stored in Mumbai, India. Until 15 September 2026 it was stored in Singapore.
- It passes through Cloudflare's worldwide network.
- Several of our providers are foreign companies that may access it from outside India for support and security. We require them by contract to protect it.
- We do not promise that it never leaves India.

**E8. How long we keep it.**

| Information | How long we keep it |
|---|---|
| Account details | While your account exists. After it closes, for the export period of up to 60 days; then deleted within a further 60 days |
| Sign-in attempts, sessions and password-reset requests | At least 1 year, and deleted no later than 2 years after they were made |
| Change history, and records of our staff's access to your account | While your account exists, then deleted with it |
| Request logs kept by Cloudflare | A short period set by Cloudflare |
| Records of your acceptance of terms | While your account exists, and then for 7 years after it closes or until any dispute is finally resolved, whichever is later. After that, the personal details in the record are erased and only its fingerprint is kept |
| Tax invoices, billing records and the payment details on them | As long as GST law requires; currently until 72 months after the due date of the annual return for the year concerned |
| The Customer's name, address, contact details, GSTIN and subscription dates | 5 years after your account closes, to meet CERT-In's directions on customer records |

Anything we keep only for a legal reason is restricted, used only for that reason, and deleted when the period ends. Deleted data may remain in backups for up to 30 days.

**E9. Your rights.** You can:
- ask us to show you your information;
- ask us to correct or update it;
- ask us to erase it, subject to E8;
- withdraw your consent under E5:
  - for your password, that means closing your account;
  - for your UPI ID, remove it from your settings;
  - payment details on payments you have already made stay in our tax records for the period in E8;
- once the law provides for it, nominate someone to act for you if you die or become unable to act;
- complain to our Grievance Officer. We acknowledge within 24 hours and send a reasoned reply within 7 days;
- once the law provides for it, complain to the Data Protection Board of India.

To use these rights, write to contact@proarcai.in from your registered email address. Give:
- your name;
- your business or account name;
- your registered email or phone number.

We may confirm your identity through contact details we already hold.

**E10. Changes to this notice.**
- If we change this notice so that we collect more, share more or use your information in a new way, Nivaas will ask you to accept the new version.
- We tell you about other changes by email at least 7 days before they take effect.

**E11. The law.** We give this notice under these laws:
- the Information Technology Act, 2000 and its 2011 rules;
- as and when they come into force, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.