Privacy Policy

1. Who We Are

Ele8 is a property management software platform operated by Veltrix Solutions LLP, a Limited Liability Partnership registered in India.

Registered Office: SBC Road Karkala, Varnabettu, Karkala, Udupi, Karnataka – 574104
GSTIN: 29AAZFV1028N1Z9
Email: support@ele8.in

By using Ele8, you consent to the practices described in this policy. If you do not agree, please discontinue use of the platform.

2. Information We Collect

2.1 Information you provide

• Account registration: name, email address, phone number, password
• Business details: PG property name, address, GSTIN (if applicable)
• Billing information: name, address, GSTIN for GST invoices — payment processing is handled by Razorpay and we do not store card details
• Tenant and staff records: personal details you enter on behalf of your tenants and staff members
• Support communications: emails or messages you send us

2.2 Information collected automatically

• IP address, browser type, device type, operating system
• Pages visited, features used, session duration, referring URLs
• Error logs and crash reports for debugging purposes

3. How We Use Your Information

• To create and manage your account
• To provide and operate the Ele8 platform
• To process subscription payments and generate GST invoices
• To send transactional communications — OTP, payment receipts, account notices
• To send service updates and feature announcements (you may opt out at any time)
• To detect and prevent fraud, abuse and security incidents
• To analyse usage patterns and improve the product
• To comply with applicable Indian law and legal obligations

4. Tenant and Staff Data — Your Responsibility

When you enter tenant or staff personal data into Ele8, you are the Data Fiduciary for that data under the Digital Personal Data Protection Act (DPDPA) 2023. Ele8 processes it solely as your Data Processor, on your instructions.

You are responsible for obtaining any consents required from your tenants and staff before entering their data into the platform, and for using the platform in compliance with applicable Indian law.

5. Sharing of Information

We do not sell your personal data. We share it only as follows:

• Service providers: third-party vendors who help us deliver the platform — payment processing, email delivery, SMS/OTP services, cloud hosting. Each is contractually bound to protect your data
• Legal compliance: when required by Indian law, a court order, or a lawful request from a government authority
• Business transfers: in the event of a merger, acquisition or sale of assets, your data may transfer to the successor entity — we will notify you beforehand

6. Data Storage and Security

Your data is stored on secure cloud infrastructure (MongoDB Atlas). We implement reasonable technical and organisational security measures in accordance with Section 43A of the Information Technology Act, 2000 and the applicable Rules, including:

• Encryption of all data in transit over HTTPS/TLS
• Application-layer AES-256-GCM encryption for sensitive third-party integration credentials (payment gateway keys, SMS API keys) stored in our database
• Secure credential storage — passwords are hashed using bcrypt and never stored in plaintext
• Storage-level encryption provided by our cloud database provider (MongoDB Atlas)
• Role-based access controls limiting data access to authorised personnel only
• Audit logs retained for a minimum of 3 years
• Regular backups to prevent data loss

Note on tenant personal data: Personal information such as name, phone number, and address submitted through the PG operator's registration form is stored in our database and is accessible to the PG operator (Data Fiduciary). Visitor ID proof numbers are restricted to owner and admin roles only.

While we take reasonable precautions, no system is completely secure. In the event of a data breach affecting your personal data, we will notify you as required by applicable law.

7. Cookies

We use only essential cookies necessary for authentication and session management. We do not use advertising cookies or third-party tracking cookies. You can control cookies through your browser settings, though disabling essential cookies will prevent you from logging in.

8. Your Rights

Under the Digital Personal Data Protection Act (DPDPA) 2023, you have the right to:

• Access — request information about what personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data (subject to legal retention obligations)
• Withdrawal of consent — opt out of marketing communications at any time
• Grievance redressal — raise a complaint with our Grievance Officer
• Nomination — designate a nominee to exercise your rights in case of death or incapacity

If you are a PG operator (account holder): Email support@ele8.in with subject line "Data Rights Request" from your registered email address. We will respond within 30 days.

If you are a tenant whose data is held by a PG operator: Log in to the tenant portal and navigate to Profile → Data Rights to submit a formal request. Your request will be forwarded to the PG operator (Data Fiduciary), who is required to respond within 30 days under DPDP Act 2023. For unresolved issues, contact support@ele8.in.

9. Data Processing Agreement and Sub-Processors

Under the Digital Personal Data Protection Act, 2023 (Section 8), Ele8 acts as a Data Processor on behalf of PG operators (Data Fiduciaries) with respect to tenant and visitor data collected through the platform. PG operators retain legal responsibility for the lawfulness of data collection and must obtain valid consent from their tenants as required by law.

By subscribing to Ele8, PG operators agree that Ele8 will process personal data strictly for the purpose of providing the platform services, and that Ele8 may engage the following categories of sub-processors:

• Cloud database: MongoDB Atlas (data storage)
• Cloud hosting: Vercel (application hosting, India/US regions)
• File storage: Wasabi Cloud Storage (document uploads)
• Email delivery: Resend (transactional emails)
• SMS/WhatsApp: MSG91 (if enabled by operator)
• Payments: Razorpay (if enabled by operator)

Ele8's obligations as Data Processor include: processing data only on documented instructions from the operator, implementing appropriate security measures, assisting operators in responding to data subject rights requests, notifying operators without undue delay upon becoming aware of a personal data breach, and deleting or returning data upon termination of services.

PG operators who require a formal signed Data Processing Agreement (DPA) may request one by emailing support@ele8.in with subject line "DPA Request".

10. Data Retention

• Account data: retained while your account is active
• Deleted account data: anonymised within 30 days of account deletion, except where legal retention is required
• Billing and payment records: retained for 7 years as required under the Income Tax Act, 1961 and GST law
• Audit and security logs: retained for a minimum of 3 years as required under IT Rules 2011

11. Cross-Border Transfers

Your primary data is stored in India. Certain service providers we use to deliver the platform (such as email delivery) may process data outside India. Where this occurs, we ensure appropriate contractual safeguards are in place consistent with DPDPA 2023 and applicable Central Government rules.

12. Children's Privacy

Ele8 is a business management platform intended for use by adults (18 years and above). We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our platform, please contact our Grievance Officer immediately.

13. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer:

Grievance Officer — Veltrix Solutions LLP
Email: support@ele8.in
Address: SBC Road Karkala, Varnabettu, Karkala, Udupi, Karnataka – 574104
Acknowledgement: within 48 hours  |  Resolution: within 30 days

If you are not satisfied with our response, you may approach the Data Protection Board of India once it becomes operational under DPDPA 2023.

14. Changes to This Policy

We may update this policy from time to time. For material changes, we will provide at least 30 days' advance notice by email or prominent in-app notice before the change takes effect. For minor changes, the updated policy will be posted at this URL with a revised “last updated” date.

Continued use of Ele8 after the effective date of a change constitutes your acceptance of the updated policy.