Kirayo Privacy Policy
Part II Privacy Policy Scope and Accountability
84. Scope. This Privacy Policy explains how Personal Data is collected, used, disclosed, retained and protected when a person uses Kirayo, is recorded in a Property workspace, submits a listing enquiry, contacts support or receives a Kirayo communication. It should be read with any just-in-time notice shown for a specific feature. It does not govern an Owner’s independent processing outside Kirayo or a third party’s independent website or service.
85. Allocation of roles. For Account administration, Platform security, diagnostics, Codepth billing, legal compliance and direct support, Codepth determines relevant purposes and means and ordinarily acts as Data Fiduciary. For Property records entered and controlled by an Owner—including Resident, guardian, rent, payment, expense, staff, notice, meal and enquiry information—the Owner ordinarily acts as Data Fiduciary and Codepth processes on documented instructions as Data Processor. Codepth may become an independent Data Fiduciary for a limited purpose required by law, security or its own service relationship. Actual classification depends on facts and Applicable Law.
86. Owner notice. An Owner must identify itself to Residents, staff and Enquirers; explain its purposes; identify any mandatory fields and consequences; establish a lawful ground; and provide a rights and grievance route. Codepth’s Policy does not replace that Owner notice. Where a request concerns Owner-controlled data, Codepth may authenticate and route it to the Owner while providing reasonable technical assistance.
87. Principles. We seek to process Personal Data lawfully, fairly and transparently; limit collection to specified purposes; keep information accurate where necessary; restrict retention; implement reasonable safeguards; and remain accountable for processing under our control. We do not sell Personal Data or use identity-verification data for advertising.
88. Sources. Data may come from the individual; an Owner or authorised Manager; a parent, guardian or emergency contact; another payer; the person’s device or browser; payment and verification providers; and system-generated records. A User providing another person’s data must have authority and deliver required notice.
89. Contact. Privacy and grievance questions may be sent to support@kirayo.in or the grievance channel published in the application or at kirayo.in. Postal correspondence may be addressed to Codepth IT Solutions Private Limited at its registered office stated in clause 1. The requester should avoid sending identity documents until secure verification instructions are provided.
Personal Data We Process
90. Account and profile data. We process name, email address, mobile number, role, Property association, invitation status, login and recovery events, password hash maintained by the authentication provider, consent version and timestamp, and support preferences. Business profiles may include legal name, tax or registration identifiers, address, contact number, authorised administrators, logo and billing details.
91. Resident and accommodation data. An Owner may record name, contact details, date of birth, room and bed, move-in and move-out dates, guardian or emergency contact, rent, deposit, notice and lock-in terms, service or food inclusions, status and change history. The Platform may hold agreements, receipts, notices, maintenance requests, Wi-Fi information, meal attendance or skips, and Resident communications relevant to the Property.
92. Payment and financial records. We process amounts due and paid, dates, methods, payer name, bank or UPI reference, limited transaction status, receipt or payment images, generated receipts, platform invoices and provider identifiers. We do not ask Users to store card PINs, CVV, net-banking passwords or UPI PINs. A payment provider independently processes credentials entered into its controlled interface.
93. Identity-verification data. Subject to the selected method, we may process name, date of birth, gender, address, photograph, selfie or liveness result, verification result and last four digits or masked identifier from a UIDAI-signed offline source, or limited identity results from an authorised provider. The original offline Aadhaar source file is intended to be deleted after validation. We do not request the full Aadhaar number or Aadhaar OTP for the described offline workflow.
94. Listings and enquiries. Public listings may include Owner-supplied Property information, photographs, availability and contact route. An Enquirer may provide name, phone number, message, preferred room type and intended move-in date. This is sent to the relevant Owner and authorised Managers to respond.
95. Device, usage and diagnostic data. After the applicable notice and consent or other lawful ground, we may process screens or features used, actions taken, timings, request performance, errors, crashes, code location, app version, device model, operating system, platform, pseudonymous Account or Property code, IP address, request time and request path. We do not use this telemetry to collect contacts, call logs, precise location, files outside the selected workflow, messages in other apps or unrelated device activity.
96. Communications. We process support correspondence, complaint records, notification destination, delivery events, communication preference and limited message contents or attachments necessary to send the selected service message. Calls or chats are not recorded unless separately disclosed and lawfully authorised.
Purposes Grounds Consent and Children
97. Service purposes. We process data to create and secure Accounts; provide role-based Property workspaces; maintain Resident and Property records; calculate configured schedules; report and confirm payments; generate receipts and documents; perform identity workflows; deliver notices; manage requests, meals, expenses, listings and enquiries; provide support; invoice Codepth fees; prevent abuse; diagnose faults; back up and restore systems; enforce terms; and comply with law.
98. Grounds. Processing will rely on consent where consent is required and valid; performance of a contract or steps requested by the person where recognised; specified legitimate uses or other grounds provided by Applicable Law; compliance with legal obligations; protection of legal claims, safety and security; and an Owner’s documented instructions where Codepth acts as Data Processor. The exact ground depends on the purpose and relationship.
99. Consent standards. A consent request should be presented independently in clear language, identify the itemised data and specified purpose, and require affirmative action. Consent may be withdrawn through the stated Account, preference or grievance route with comparable ease, subject to authentication. Withdrawal applies prospectively and may make the relevant optional feature unavailable. Data may still be retained or processed where another legal duty or ground applies.
100. Diagnostics. Where diagnostics require consent, the request must be separate from unrelated contractual acceptance and explain the data, purpose, retention and any processor sharing before collection begins. Refusal or withdrawal should not prevent unrelated core use unless the diagnostic processing is demonstrably necessary for security or provision of that core service and the consequence is prominently explained.
101. Children. We do not knowingly permit a child to create an independent Account. Before processing a child’s Personal Data on consent, the relevant Data Fiduciary must obtain verifiable consent of an identifiable adult parent or lawful guardian using reliable age and identity details or an authorised token or service. The Platform must not undertake tracking, behavioural monitoring or targeted advertising directed at a child except an applicable statutory exemption. A parent or guardian may exercise available rights for the child, subject to verification.
102. Automated processing. Kirayo may automatically calculate due dates, charges, statuses, reminders, matches or technical alerts based on configured rules. These outputs assist administration and do not by themselves make a legal, credit, eviction, eligibility or similarly significant decision about a person. Owners must review consequential decisions and provide a human contact for correction or dispute.
Disclosure Processors and International Transfers
103. Within a Property. Data is disclosed according to role and permissions. Owners and authorised Managers may see Property records; Managers may have restricted financial or administrative access; Residents ordinarily see records relating to themselves and shared Property notices; and duty contact information may be shown to Residents. Owners are responsible for access design and must apply least privilege.
104. Service Providers. We may engage vetted providers for cloud hosting, storage, authentication, email, support, monitoring, payments, identity verification, messaging, document delivery, app distribution and device functionality. Depending on use, these may include Amazon Web Services, Microsoft, Razorpay, Cashfree, Meta or WhatsApp, and Google. They receive only data reasonably required for their function and process it under contract, their independent terms, Applicable Law, or a combination of these.
105. Transactional disclosures. A payment or identity provider receives the data displayed at initiation, such as name, phone number, amount, transaction identifier, verification request or Owner settlement details. A messaging provider may receive name, phone number, Property name, amount and a selected receipt or agreement. The point-of-use notice and provider interface should identify material sharing before initiation.
106. Legal and corporate disclosures. We may disclose information to advisers, auditors, insurers, regulators, courts, law-enforcement bodies or other persons where reasonably necessary for compliance, legal claims, fraud prevention, safety or enforcement. In a merger, financing, reorganisation or transfer of business, information may be shared under confidentiality and transferred subject to continued protection and required notice.
107. International processing. Personal Data may be hosted or processed in India, the United Kingdom, the United States and other locations used by our disclosed providers, subject to restrictions or requirements notified by the Government of India and Applicable Law. We use contractual, organisational and technical measures appropriate to the transfer and remain accountable where required. A provider’s infrastructure location may change; material changes will be reflected in the Policy or a notice.
108. No sale and no indiscriminate disclosure. We do not sell Personal Data, publish Resident identity records, or disclose them to unrelated advertisers. De-identified or aggregated information that cannot reasonably identify a person may be used for service quality, capacity, security and business analysis, provided it is not re-identified.
109. Public features. Information intentionally placed on a public listing is visible to the public. Users must not publish Resident contact, identity, payment or occupancy information. A public enquiry is shared with the selected Owner, not posted publicly.
Retention Security Accuracy and Breach Response
110. Retention standard. We retain Personal Data only for the specified purpose, an Owner’s lawful instructions, establishment or defence of claims, fraud and security prevention, backup integrity, and mandatory legal, tax, accounting or tenancy requirements. When retention is no longer justified, data is erased, anonymised or placed beyond ordinary use until secure deletion from rotating backups.
111. Indicative periods. Account and Property operational records are generally retained while the relevant service or relationship remains active. Payment, receipt, tax and accommodation records may be retained for up to eight years after the relevant stay or transaction where reasonably required. Diagnostic telemetry is ordinarily retained for up to forty-five days; request and security logs for up to ninety days or a longer minimum required by law; and ordinary backup copies for up to ninety days. A legal hold, dispute, security investigation or statutory direction may extend a period. The original Aadhaar offline source file is deleted after verification as described above.
112. Exit and erasure. A Resident’s access may end at move-out while the Owner retains records for lawful purposes. Account deletion does not automatically erase information another Data Fiduciary must retain. Where erasure is required, we will erase active copies and allow backup copies to expire through controlled rotation, unless immediate deletion is technically and legally required. We may retain a minimal suppression, consent or transaction record to demonstrate compliance.
113. Security. Measures include appropriate encryption, access controls, short-lived sessions or links, separation of Property workspaces, audit logging, protected backups, monitoring, recovery procedures and personnel controls. Service Providers are selected and contracted with regard to relevant safeguards. Users should recognise that transmission and storage carry residual risk and follow the Account-security duties in these Terms.
114. Accuracy. Users may review and correct many fields through the Platform. An Owner shall correct data it controls when informed of a supported error and notify Codepth where processor assistance is required. We may preserve an amendment history where necessary for integrity, audit or legal claims rather than silently rewriting a historical record.
115. Breach response. On becoming aware of a personal data breach, the responsible Data Fiduciary will take reasonable containment and assessment measures and provide notices to affected persons and the Data Protection Board of India in the form and time required by then-applicable law. Independently, reportable cyber incidents will be notified to CERT-In within the applicable statutory period. Notices may be issued in stages as reliable facts become available and will not disclose information that creates additional security risk.
Data Principal Rights Grievances and Requests
116. Available rights. Subject to Applicable Law, a Data Principal may request information about processing, a summary of Personal Data and sharing, correction, completion, updating, erasure, withdrawal of consent, grievance redressal and nomination of another person to exercise rights in the event of death or incapacity. A person may also use an authorised Consent Manager where applicable.
117. How to request. Requests may be submitted through available Account controls, the public account-deletion page, or support@kirayo.in. The requester should state the relevant Account or Property and requested action but should not email Aadhaar, passwords or financial credentials. We may request proportionate information to authenticate identity, authority and scope and may use a secure channel for supporting material.
118. Owner-controlled data. If Codepth processes the relevant data on an Owner’s instructions, Codepth may forward the request to that Owner and assist technically. The Owner remains responsible for the substantive decision and response unless law assigns responsibility differently. A requester may contact both the Owner and Codepth where roles are unclear.
119. Response and limitations. We will acknowledge and respond within the period published in the Platform and required by Applicable Law. A request may be limited or refused only on a lawful ground, such as inability to authenticate, another person’s rights, legal privilege, fraud prevention, a legal hold or mandatory retention. Where appropriate, the response will explain the reason and escalation route. Manifestly abusive repetition may be managed as permitted by law.
120. Grievance escalation. First contact the grievance channel at support@kirayo.in or the current contact published in the Platform. The grievance should identify the person, Account or Property, relevant dates, issue and requested resolution. We aim to resolve grievances promptly and, in all events, within the maximum period required by applicable rules. After exhausting the internal process where required, a Data Principal may approach the Data Protection Board of India or another competent forum.
121. Complaints about accommodation. Privacy requests are distinct from rent, deposit, eviction, maintenance or service disputes with an Owner. Codepth may route a Property complaint but cannot adjudicate the underlying accommodation contract. This does not prevent a User from approaching a consumer forum, court, regulator, police or other authority with jurisdiction.
122. Duties of Data Principals. A requester shall not impersonate another person, suppress material information, make a false or frivolous complaint, or furnish inauthentic information. These duties do not limit good-faith complaints or statutory rights.
Acceptance Language Feature Consents and Contact
127. Notices to Codepth. Legal, privacy and grievance communications may be sent to support@kirayo.in or to Codepth IT Solutions Private Limited, Bhukhand No. C-46, Sector CS, Aliganj Yojna, Aliganj, Lucknow, Uttar Pradesh 226024. Current support telephone or WhatsApp details may be published in the Platform. Sensitive supporting documents should be transmitted only through a secure channel provided after contact.