Dwarjo Privacy Policy

Version 0.3, 22 October 2026

Effective date: 22 October 2026

Dwarjo ("Dwarjo", "we", "us") is a community management platform for residential societies in India, operated by Deepak Kumar, sole proprietor, A8 Madhurima, Conron Smith Road, Gopalapuram, Chennai 600086, Tamil Nadu, India ("the Operator"). This policy explains what personal data we collect when you use the Dwarjo resident app, the society admin console, the guard console, or our website (together, "the Service"), why we collect it, who we share it with, and the choices you have.

We process personal data in accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and the rules under them.

1. Who is responsible for your data

Two parties handle your data:

Your society (its managing committee or resident welfare association) decides which residents, units, visitors, bills and notices exist on Dwarjo. For that society data, the society is the data fiduciary and Dwarjo processes it on the society's instructions.
Dwarjo is the data fiduciary for your account itself: your phone number, sign-in identities, email verification, device tokens, and the security and operational records of the Service.

2. What we collect

Account and identity

Mobile number (required; it is how you sign in and how a society identifies you as a resident).
Name and email address, if you provide them. Email is used only after you verify it by clicking a link we send.
If you choose to link a Google account, we store only Google's stable account identifier and the email Google reports. We never receive your Google password and we do not read your Google data.

Society membership and residence

The society, building, floor and unit you claim, your role (owner, tenant, household member, committee member), household members you add, and vehicle and pet details you or your society record.
A guard can point the camera at a vehicle's number plate instead of typing it. The reading happens entirely on the phone and the photograph is never uploaded or stored — only the number the guard confirms is recorded.

Visitors and gate activity

Visitor names, phone numbers and expected arrival times you pre-approve, visitor passes, and gate scan records (time, gate, guard decision). Guards' names and duty records are collected from the society.
Guards may photograph a visitor at check-in, a parcel left at the gate, and goods being taken out on a material pass. These photographs are stored against the visit or the pass they belong to. A guard or committee member can view one only where a record grants that access, with a stated reason and an expiry.

Approximate location

When you tap "find my society" while joining, the app asks for a single coarse location fix and sends it to us to list the societies nearest you. We use it for that one search and do not store it: it is not written to any record, and our access logs keep the address of the request without its coordinates. You can refuse — the join flow then falls back to choosing a country and city, or searching by name.

Bills and payments

Maintenance and other bills issued by your society, payment claims you submit (amount, date, mode, and any receipt you attach), and the society's confirmation. Dwarjo does not move money. Payments are made through your society's own bank or UPI arrangements; we record what you and the society tell us.

Community content

Notices, events, records, complaints and help-desk tickets, amenity bookings, marketplace listings, comments and reactions, and images you attach to any of these.

Technical and security data

Device push-notification tokens, IP address, browser type, timestamps of requests, and application logs. We use these to deliver notifications, prevent abuse (for example, limiting how many sign-in codes a number or network may request), and diagnose faults.

3. Why we use it

To create and secure your account and sign you in (one-time codes by SMS, optional Google sign-in).
To let your society manage residence, visitors, bills, amenities and communication with you.
To help you find your society when you join, if you choose to share a coarse location.
To record who came to the gate and what was taken out, which is the purpose a society keeps a gate register for.
To send you notifications you have enabled: push notifications in the app, and email to a verified address (welcome, verification, society notices).
To keep the Service reliable and safe: rate limiting, fraud and abuse detection, audit trails of administrative actions, monitoring.
To meet legal obligations and respond to lawful requests.

We do not sell personal data and we do not use it for third-party advertising.

4. Who we share it with

Your society. Committee members and society staff see the resident, unit, visitor, billing and content data relevant to their society. Guards see only what a gate needs: expected visitors, passes, and the unit to call.

Other residents. Your name and unit may be visible to other residents of the same society in directories, notices, marketplace listings and comments you post. Your phone number is shown only where your society's settings allow it.

Service providers, who process data on our behalf under contract and only for the purposes above:

SMS one-time-code delivery: Message Central (Bangalore) and Twilio (USA). They receive your mobile number to deliver a code.
Email delivery: Oracle Cloud Infrastructure Email Delivery (Mumbai region).
Hosting and storage: Oracle Cloud Infrastructure, Mumbai region, India.
Google, only if you use Google sign-in, and only for the identifiers described above.

Legal. We may disclose data where required by law, court order, or a lawful government request, or to protect the safety of residents and the integrity of the Service.

5. Where your data is kept

Your data is stored in Oracle Cloud's Mumbai region in India. SMS delivery through Twilio may route your mobile number through Twilio's systems outside India for the moment it takes to send the code.

6. How long we keep it

Account and society data: while your account or your society's account is active, and for up to 12 months after closure unless the law requires longer (for example, financial records).
Sign-in codes: at most 10 minutes; they are stored only as one-way hashes.
Email verification links: 24 hours, purged a week after expiry.
Photographs taken at the gate: kept with the visit or the pass they belong to, and permission to view one expires with the grant that allows it.
Request logs and access logs: 90 days. Application logs: 90 days. Aggregated usage events: 400 days.
Backups: rolling, deleted on a fixed schedule of 30 days.

7. Security

All traffic is encrypted in transit. One-time codes, sign-in tokens and verification links are stored only as hashes. Access to production systems is limited to named operators, and administrative actions are recorded in an audit log. No system is perfectly secure; if we learn of a breach affecting you, we will notify you and the Data Protection Board as the law requires.

8. Your rights and choices

You may, at any time:

View and correct your name and email in the app, and change your mobile number after verifying the new one.
Link or unlink Google sign-in from your profile.
Refuse the location permission. The app asks once, when you choose "find my society", and works without it.
Ask us to delete your account and the personal data linked to it. How to do that, what is removed and what your society keeps, is set out at dwarjo.com/delete-account.
Ask us for a copy of your personal data, or for its correction or erasure, by writing to the contact below. Society data (for example, a bill or a visitor record) is controlled by your society, and we will forward such requests to it and act on its instructions.
Withdraw consent for optional processing, such as email notifications, by removing or not verifying your email. Withdrawing consent does not affect processing already done.
Nominate a person to exercise these rights on your behalf, as the DPDP Act allows.

9. Children

The Service is for adults managing a residence. We do not knowingly collect data from anyone under 18 except as a household member recorded by an adult resident.

10. Cookies and local storage

The apps store your sign-in session and preferences in your browser's local storage. We use no advertising cookies. Our website uses only functional cookies and basic analytics from its hosting provider.

11. Changes

We will post changes here with a new effective date and, for material changes, notify you in the app or by email.

12. Contact and grievances

Grievance Officer: Deepak Kumar
A8 Madhurima, Conron Smith Road, Gopalapuram, Chennai 600086, Tamil Nadu, India
Email: hello@dwarjo.com

We aim to acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.