This Privacy Policy explains what personal data Mythri Applications Pvt Ltd (“MythriApp”, “we”, “us”) processes when you use our platform, why we process it, who we share it with, and the choices and rights available to you. It applies to our website, web application and mobile apps. It forms part of, and should be read alongside, our Terms & Conditions.
1 Who we are, and our role
MythriApp is provided by Mythri Applications Pvt Ltd, a company incorporated in India. We provide software that residents’ associations, societies, clubs, trusts and similar organisations (each a “Society”) use to manage membership, communication, events and collections.
Our role depends on whose data it is. For data a Society records about its own members, the Society is the data controller and decides what is collected and why; we act as a processor, handling that data on the Society’s instructions. For data we collect directly — such as the account you create with us, or your use of our public website — we are the controller. If you want data held by a Society corrected or removed, contact that Society first; we will support them in acting on your request.
2 What we collect
| Category | Examples | Why |
|---|---|---|
| Account & identity | Name, email address, mobile number, password (stored hashed), profile photo, role within the Society | Create and secure your account; determine what you may access |
| Membership records | Household or unit details, family members, committee position, membership plan and validity | Provide the Society’s management functions |
| Payments | Amount, currency, date, purpose, status, and the gateway’s transaction reference | Process and reconcile collections; produce receipts and reports |
| Communications | Email, SMS, WhatsApp and push notifications we send you, and their delivery status | Deliver Society announcements and transactional messages |
| Content you upload | Event photos, documents, notices, and files shared to galleries or the document store | Store and display the content you or your Society choose to share |
| Technical | IP address, device and browser type, timezone, log and error data | Operate the service, diagnose faults, detect abuse |
We do not knowingly collect data from children directly. Where a Society records a minor as part of a household, that record is entered and controlled by the Society.
3 Payment and KYC data
This section matters most, so we state it plainly.
- Payment credentials are not stored on our systems. Card details, UPI PIN, net-banking and wallet credentials are entered on the payment gateway’s own hosted page or SDK. They are not transmitted to, processed by, or stored by us. We receive only the outcome of a payment — success or failure, an amount, and a transaction reference.
- A Society’s KYC details are not stored on our systems. When a Society sets up online collections, the PAN, GSTIN, CIN, bank account number, IFSC or UPI ID it enters is transmitted to the payment gateway, which is the system of record. We retain only the gateway’s account reference and the verification status it reports.
- Verification documents are not retained on our systems. Where a gateway requires a supporting document, it is forwarded to that gateway and is not stored by us.
- Payment gateways are independent controllers for the data they collect. Their handling of it is governed by their own privacy policies.
4 How we use data
- To provide the service — authenticate you, show you what your role permits, and run the features your Society has enabled.
- To communicate — send transactional messages such as payment receipts, event confirmations, password resets, and Society announcements you are subscribed to.
- To take payments — initiate a payment with the gateway, reconcile the result, and produce records for the Society’s accounts.
- To keep the platform safe — detect and prevent fraud, abuse and unauthorised access, and maintain audit records.
- To improve the product — diagnose errors and understand which features are used. We do not sell personal data, and we do not use your data to build advertising profiles.
- To meet legal obligations — including tax, accounting and lawful requests from authorities.
6 How we protect data
Encryption
Data is encrypted in transit using TLS/HTTPS. Sensitive stored values, such as integration credentials, are encrypted at rest.
Access control
Role-based permissions mean members, administrators and staff see only what their role allows. Private files are served only after an authorisation check.
Audit & monitoring
Records carry created and modified stamps, and we monitor for errors and unusual activity.
Data minimisation
We avoid holding what we do not need — payment credentials and KYC documents are passed through rather than stored.
No system can be guaranteed completely secure. If a breach affects your personal data, we will notify you and the relevant authority as required by law.
7 How long we keep it
We keep personal data for as long as your Society uses MythriApp and your account remains active, and afterwards only as long as needed for the purposes it was collected for.
- Account and membership records — retained while the Society’s subscription is active, and deleted or returned on request after it ends, except where we are required or permitted by law to retain them for longer.
- Payment and financial records — retained for the period required by Indian tax and accounting law, even after an account closes.
- Communication logs — retained for a limited period to evidence delivery and to diagnose failures.
- Backups — deleted data may persist in encrypted backups for a short period before being overwritten on the normal cycle.
8 Your rights
Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you may:
- Ask what personal data we hold about you, and obtain a copy.
- Ask us to correct data that is inaccurate, or complete data that is incomplete.
- Ask us to erase data we no longer need to keep.
- Withdraw consent where our processing relies on it — this does not affect processing already carried out.
- Nominate another person to exercise your rights in the event of death or incapacity.
- Raise a grievance with us, and escalate to the relevant data protection authority if unresolved.
Where the data is held by a Society as controller, we will pass your request to them and support them in responding.
10 Where data is processed
Our services are operated primarily from India. Some providers we rely on — for messaging, content delivery and cloud storage — may process data on servers outside India. Where that happens, we use providers offering appropriate safeguards and contractual protections for the data concerned.
11 Changes to this policy
We may update this policy as the platform develops or the law changes. The “last updated” date at the top always reflects the current version. Where a change materially affects how we handle your data, we will give notice through the platform or by email before it takes effect.
12 Contact us
For any privacy question, request or complaint, write to us at the address or email below. We will acknowledge your request promptly and endeavour to respond within the period required under applicable law.