Welcome to MoveTara ("we", "us", or "our"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the MoveTara mobile application and web platform (collectively, the "Service"). By using MoveTara, you agree to the practices described in this policy.

1. Information We Collect

We collect the following categories of information:

Category	Examples	Who Provides It
Account Information	Name, phone number, OTP verification	You (at registration)
Profile & KYC Data	Date of birth, address, government ID details, profile photo	You (during onboarding)
Property Data	Hostel name, address, room/bed details, capacity settings	Property owners & wardens
Tenant Records	Stay dates, rent amounts, payment history, complaint records	Owners, wardens, and tenants
Financial Records	Payment amounts, dues, expense records, invoices	Owners & wardens
Device Information	Device ID, push notification token, OS version, app version	Automatically collected
Usage Data	Features used, session timestamps, error logs	Automatically collected

We do not collect: precise GPS location, phone contacts, microphone recordings, or any biometric data.

2. How We Use Your Information

• Provide and operate the MoveTara platform and its features
• Authenticate your identity via mobile OTP and manage your account session
• Send transactional notifications (payment reminders, complaint updates, announcements)
• Process and record tenant payments and financial transactions
• Generate reports and analytics for property owners and admins
• Respond to support requests and resolve complaints
• Improve our platform through anonymized usage analytics
• Comply with legal obligations and prevent fraud

3. Legal Basis for Processing (GDPR / Indian IT Act)

• Contract performance: Processing necessary to deliver the Service you subscribed to
• Legitimate interest: Security monitoring, fraud prevention, service improvement
• Consent: Push notifications and optional features (you can withdraw consent at any time)
• Legal obligation: Compliance with applicable Indian laws

4. Third-Party Services

MoveTara integrates with the following third-party services that may process your data:

Service	Purpose	Privacy Policy
Supabase	Database, authentication, and file storage	supabase.com/privacy
Firebase (Google)	Push notifications (FCM)	firebase.google.com/support/privacy
Razorpay	Subscription payment processing on movetara.com/upgrade (card / UPI / netbanking / wallets)	razorpay.com/privacy

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4.1 Subscription Payment Data

Subscription fees are collected exclusively through movetara.com/upgrade in a web browser, never inside the mobile app. When you pay for a MoveTara subscription:

• Card / UPI / netbanking / wallet details are collected directly by Razorpay (our payment processor) on a page hosted and secured by Razorpay. These details never touch MoveTara servers, are not stored in our database, and are not visible to MoveTara staff.
• What MoveTara stores: the Razorpay order ID, payment ID, amount paid in INR, billing cycle, GST invoice number, and receipt number — purely for accounting, GST compliance, and your invoice history. No card numbers, no CVVs, no UPI IDs.
• Payment method label: after a successful charge, Razorpay returns a non-sensitive descriptor (e.g. "card · Visa ****1234" or "UPI · paytm"). We store this descriptor so you can identify which method you used on a given invoice.
• Refunds: processed back to the original payment method via Razorpay. We do not have the ability to redirect refunds to a different account.
• Indian law compliance: all payment data handling complies with RBI's Tokenisation of Card Transactions guidelines and the Payment and Settlement Systems Act, 2007. Razorpay is a PCI-DSS Level 1 certified processor.

5. Data Storage and Security

• All data is stored on Supabase infrastructure with encrypted databases
• All data in transit is protected using TLS 1.2+ encryption
• Access to production data is restricted to authorized MoveTara personnel only
• We perform regular security reviews of our infrastructure
• Passwords and sensitive credentials are hashed and never stored in plaintext
• MPIN codes are stored as cryptographic hashes

6. Data Retention

• Active accounts: Data retained for the duration of your account
• Cancelled subscriptions: Data retained for 90 days post-cancellation, then deleted
• Deleted accounts: Data permanently deleted within 30 days of deletion request
• Legal holds: Some data may be retained longer if required by law
• Anonymized analytics: May be retained indefinitely in non-identifiable form

7. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of all personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and all associated data
• Portability: Request your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Notification opt-out: Disable push notifications via app Settings at any time

To exercise any of these rights, email us at privacy@movetara.com. We will respond within 30 days.

8. Push Notifications

MoveTara requests permission to send push notifications for: payment reminders, complaint updates, hostel announcements, and security alerts. You can enable or disable notifications at any time from your device Settings or from within the MoveTara app under Settings → Notifications. Disabling notifications does not affect your ability to use the app.

9. Children's Privacy

MoveTara is a business management platform intended for users aged 18 years and above. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal information, please contact us immediately at privacy@movetara.com and we will delete it promptly.

10. Account Deletion

You can delete your MoveTara account at any time from within the app: go to Settings → Account → Delete Account. Upon deletion:

• Your personal profile, authentication credentials, and preferences are deleted immediately
• Operational records (payment history, complaints) may be retained for 90 days for legal compliance
• You will receive a confirmation email when deletion is complete

To request account deletion via email: privacy@movetara.com

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via a push notification or an in-app banner. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes constitutes your acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023. Any disputes shall be subject to the exclusive jurisdiction of courts in India.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, we have appointed the following Grievance Officer to address your concerns regarding data processing:

Name	Pradhudas Avanigadda
Designation	Founder & Grievance Officer
Email	privacy@movetara.com
Address	MoveTara, Hyderabad, Telangana 500019, India
Response Time	Within 30 days of receipt of complaint

If you are not satisfied with the resolution provided by the Grievance Officer, you may file a complaint with the Data Protection Board of India as established under the Digital Personal Data Protection Act, 2023.