Privacy Policy

1. Who this policy covers

This policy covers Haven’s website at havensociety.in, its society-management web application, its Android and iOS applications, and the APIs supporting those services. It applies to society administrators, owners, tenants and people visiting our website.

Haven provides the technology. Your society or residents association decides which flats and residents to register, what maintenance to publish and how its accounting records are managed. We handle those society records to provide the service; we also handle account, security and support information for operating Haven. Contact your society for questions about its decisions, and Haven for questions about the platform’s handling of personal information.

2. Information we handle

Information can come from you, an authorised society administrator or an owner managing their own flat. A resident record may exist before the resident accepts an invitation or creates a Haven account.

• Account and contact information: name, email address, phone number where provided, password hash, invitation and email-verification status, authorised societies, flats and roles.
• Society and resident records: society address and contact details, flat number and area, occupancy, owner/tenant contact details, move-in and move-out dates, lease status and residency history.
• Maintenance and accounting information: contribution inputs, water-meter readings, published bills, dues, payment status, amount and date received, transaction references, expense entries, corpus ledger entries and correction/audit records.
• Attachments and reports: receipt images, payment screenshots, uploaded documents and file metadata, and generated maintenance PDFs. Upload only relevant evidence and obscure unrelated financial or personal details.
• Notification and device information: device installation identifiers, push tokens or browser subscription addresses, notification permission, delivery/read status, last registration activity and supplied app version, device/OS details, language and time-zone information.
• Callback enquiries: your name, phone number, verified email address, optional notes, society name, city, flat count, permission to contact you and follow-up status. Email verification uses short-lived codes and anti-abuse attempt records. These requests are visible to Haven platform administrators and emailed to the Haven team for follow-up.
• Operational and support information: requests, timestamps, error/security logs, network information such as IP address supplied to our hosting systems, and information you send when seeking help.

3. Why we use this information

We use information to provide the services you and your society request, manage authorised access, maintain reliable financial records, and meet applicable obligations. Permissions for optional features are requested separately where required.

• Create and verify invited accounts, sign you in and allow switching between your authorised societies and flats.
• Calculate and publish monthly maintenance, display bills, record and review payments, manage actual expenses and maintain corpus and resident history.
• Store receipts and reports, provide exports, and send service emails and relevant in-app or device notifications.
• Investigate errors and misuse, protect accounts, support users and retain an audit trail for corrections and administrative actions.

4. Who can access your records

Society administrators can access resident, expense, billing and accounting records for their society. Owners can access their authorised flat records and tenant details, published bills, permitted society expenses and corpus information. Tenants receive a restricted view of their own authorised flat’s published bills and payment submissions, not the society’s expense register, corpus or other residents’ directory.

Platform administrators manage society onboarding, administrator assignments, support and platform operations. Authorised technical personnel may access underlying systems when needed for maintenance, security, support or a lawful request. Role restrictions in the application do not mean data is inaccessible to every system operator.

Society administrators can export and share reports outside Haven. Copies downloaded, emailed or otherwise shared by your society are under its control and cannot be recalled by deleting a record in Haven.

5. Service providers and other disclosures

Haven uses Amazon Web Services for hosting/storage, including private S3 attachments and report backups; Google Firebase Cloud Messaging and browser push services for device alerts; and Resend for transactional email. Some deployments can use Amazon SES or Gmail SMTP instead of Resend. These providers receive the information needed for their function, such as an email recipient and invitation content, or a device token and notification payload.

The website currently loads fonts from Google Fonts; your browser connects to Google to retrieve them. Infrastructure and delivery providers may process technical information under their own service terms. Depending on the provider and deployment, information may be processed outside your country.

We do not sell resident/account information or use the core Haven service for targeted advertising. We may disclose relevant information when necessary to comply with applicable law, respond to a valid legal request, protect users or investigate fraud. Any material change to these uses will be reflected in this policy and, where required, a separate notice or consent.

6. UPI and payment evidence

Haven generates a UPI link or QR containing the society’s UPI ID, payee name, bill amount and maintenance description. Your chosen UPI app and payment provider complete the transfer directly to the society. Haven does not receive or hold maintenance funds and does not request your UPI PIN, bank password or card security code.

We do store the payment reference, date, amount, verification status and any evidence you submit. A screenshot may contain bank or account information, so crop or redact anything not needed to verify the payment. Payment providers handle their own transaction data under their policies.

7. Device permissions and local storage

Device notifications are optional. You can deny or revoke notification permission in browser or device settings; the in-app notification inbox remains available. Enabled notifications may appear on your lock screen, so adjust device previews if you do not want others to see them.

When you choose to attach a receipt or payment proof, the app uses the relevant file/photo selection feature, or camera feature if offered by your app version. The selected file is uploaded for that purpose. Review the permission prompt for the version you install; the maintenance workflow does not require your contacts, microphone or precise location.

The web application uses browser session/local storage for sign-in tokens, selected account context, invitation handling and notification settings. Service workers support browser notifications. These are functional features, not advertising trackers. Shared devices should be signed out after use; clearing site storage may sign you out or reset notification preferences.

8. Retention, resident history and backups

Records are retained while needed to provide the society’s service. Moving out, changing a tenant or removing an administrator’s access does not automatically erase historical resident, payment or audit records. Ending access and deleting a Haven account are different actions.

Our policy is to retain closed-account or closed-society records for six months from closure, unless an authorised deletion request removes them sooner. At the end of that period, personal information is deleted or de-identified, except records that must be retained longer for a specific legal obligation, unresolved dispute or security investigation. Any exception must be limited to the information and period necessary for that purpose.

On an account/data deletion request, we assess which information can be deleted or de-identified and which must be retained for a specific legal obligation, unresolved transaction/dispute or security purpose. Retention must be limited to that purpose; accounting history is not a reason to keep every account detail indefinitely. We explain relevant exceptions when handling your request.

Authorised platform operations can clear a society’s operational data or delete the society, including its society-scoped files and file versions, sooner than the six-month period. This is not a resident account-deletion feature and does not automatically delete shared login accounts. Haven-controlled backups must follow the same six-month closed-record retention limit, subject to the specific exceptions above; any restored data must remain subject to approved deletion requests. We cannot erase exports kept independently by your society.

9. Access, correction and deletion requests

You may request access to your information, correction of inaccurate details, deletion of your Haven account and associated personal information, or withdrawal of optional permissions. Additional rights and exceptions depend on applicable law. You do not need to keep notifications enabled to use Haven.

For a privacy or account-deletion request, use the contact details below and identify the email registered with Haven and the relevant society/flat. We may verify your identity before acting. Never send your password, UPI PIN or a full bank statement. We will explain any necessary retained records and provide the outcome of your request.

Your society administrator can correct society-entered resident details and end a flat assignment. Removing one assignment does not remove your access to other authorised societies or flats. Uninstalling the app alone does not delete your Haven account or society records.

10. Security

The service uses authenticated, role-scoped API access, hashed passwords, private object storage with time-limited file links, and audit records for sensitive accounting and administrative actions. Public deployments use HTTPS. These measures reduce risk, but no system or transmission can be guaranteed completely secure.

Keep passwords and invitation links private. Only upload documents you are authorised to share. Report suspected unauthorised access promptly using the contact details below and notify your society administrator where its records are affected.

11. Children

Haven is intended for adult society administrators, owners and tenants and is not designed for children under 18. Do not create an account for a child or upload children’s personal information as part of a resident record. If you believe such information was submitted, contact us so we can assess and address it.

12. Updates and privacy contact

We may update this policy when the service or our handling of information changes. The updated date identifies the current version. Material changes will be communicated through an appropriate service notice; any additional consent required by law will be requested separately. Questions, complaints and privacy requests can be directed to the contact below.