Privacy policy

1. Who we are and what this covers

Property360 (“we”, “us”) provides rental and property-management software at property360.cloud. This policy covers the website, the web application, and the optional Telegram and WhatsApp assistant.

Two roles under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) apply. For your own account — your name, email, sign-in and how you use the service — we decide how the data is used and are the Data Fiduciary. For the records you enter about other people — tenants, co-owners, vendors, staff — you (the landlord or organisation using Property360) decide why that data is processed, and we process it on your behalf as a Data Processor. You are responsible for having a lawful basis to enter it and for giving those people any notice the law requires.

2. What we collect

Account data

• Name, email address and, if you add it, phone number.
• Your password, stored only as a salted bcrypt hash — we cannot read it.
• If you sign in with Google: your name, email address and profile picture from your Google account (the “email” and “profile” scopes only).

Records you enter

• Properties, units, ownership percentages, leases, rent, deposits, invoices, payments and expenses.
• Details of tenants, co-owners, vendors and other people — which can include contact details, PAN, GSTIN, bank account details used for rent deposits, and identity or KYC documents you upload.
• Documents you upload, such as lease deeds, tax receipts and bills.
• If you use them: digital signature certificates for signing invoices, and GST portal session credentials for GST reconciliation. Both are stored encrypted.

Messages to us

• What you send through the support form — your name, email, subject, message and the page you were on — is stored so it cannot be lost, and emailed to our support inbox.

Technical and usage data

• An audit trail of significant actions in the application, which can include your IP address and browser user-agent, kept for security and accountability.
• Server logs from our hosting provider.
• Help Center feedback, suggestions, search terms and article views. These are linked to your account only if you are signed in; your IP address is used briefly in memory to limit abuse and is not stored with them.
• Website analytics through Google Analytics 4 (see section 8).

The assistant

• If you link Telegram or WhatsApp, your phone number or Telegram account, and the messages you exchange with the assistant, are stored to answer you and to keep an activity log.

3. How we use it

• To provide the service: generate and email invoices, notices and reminders; compute rent, GST, TDS and owner shares; show reports.
• To secure it: authenticate you, enforce role-based access, detect abuse and keep the audit trail.
• To support you and to tell you about changes to the service or this policy.
• To understand, in aggregate, how the website and Help Center are used, so we can improve them.
• To meet legal obligations.

We do not sell personal data, and we do not use it for advertising.

4. AI features

Some features are optional AI features: reading details out of an uploaded lease, KYC or tax document; summarising or answering questions about a document; and the Telegram/WhatsApp assistant. When you use one, the content needed for that request — the document text or image, or your question and the relevant records — is sent to a third-party AI model provider (currently including Google Gemini, Groq, Cerebras, OpenRouter, Mistral, GitHub Models, SambaNova, NVIDIA, Cloudflare, OpenAI and Anthropic, depending on availability) to produce the result. Each provider processes it under its own terms; for some services used on free tiers, those terms may allow the provider to use submitted content to improve its models. If that is not acceptable for a document, enter its details by hand instead of using the AI feature. Every AI call is logged (provider, model, timing and token counts) so its use can be audited.

5. Who else handles your data

We use these service providers (processors) to run Property360. Each receives only what it needs for its function:

• Google Cloud — application hosting (Cloud Run) and private document storage; secrets in Secret Manager.
• Neon — the PostgreSQL database.
• Our email provider — sending invoices, notices, password resets and support mail.
• Google — Google sign-in (if you choose it), Google Analytics, and Google Sheets for backup exports.
• AI model providers — as described in section 4, only when you use an AI feature.
• Telegram and Meta (WhatsApp) — only if the assistant or WhatsApp messaging is enabled for you.
• A GST Suvidha Provider — only if you connect a GSTIN for GST reconciliation, to fetch your returns and ledgers from the GST portal.

Within Property360, people see data according to their role: for example, a co-owner sees their share, a chartered accountant the financial records of the landlords they are assigned to, and a tenant their own lease and invoices. We may disclose data where required by law or to protect the rights and safety of users or the service.

6. Where it is stored

Our servers and the providers above operate outside India, including in the United States. The DPDP Act permits this except to countries the Government of India restricts by notification; we will follow any such restriction.

7. How long we keep it

• Account and portfolio data: for as long as your account is active, and afterwards for as long as needed to meet legal obligations — for example, GST law requires invoices and accounts to be kept for 72 months from the due date of the annual return for the year they relate to.
• Support messages and audit records: as long as needed for support, security and accountability.
• When data is no longer needed, it is deleted or anonymised.

8. Cookies, local storage and analytics

• When you sign in, a session token is kept in your browser’s local storage so you stay signed in. Signing out removes it.
• On property360.cloud, Google Analytics 4 sets first-party cookies (such as _ga) to count visits and see which pages and steps are used. It runs only on our production domain. You can block or delete these cookies in your browser, or use Google’s Analytics opt-out browser add-on.
• We do not use advertising cookies or cross-site tracking for advertising.

9. How we protect it

Traffic is encrypted in transit (HTTPS with HSTS). Passwords are hashed with bcrypt; password-reset links are single-use, expire in 30 minutes and are stored only as hashes. Access is role-based and enforced on the server. Digital signature keys and GST portal sessions are encrypted at rest, documents are kept in private storage, and credentials are held in a secrets manager rather than in code. Significant actions are written to an audit trail. No system is perfectly secure; if a personal data breach occurs we will notify affected users and the Data Protection Board of India as the law requires.

10. Your rights

Under the DPDP Act you can ask us to:

• give you a summary of the personal data we process about you and how;
• correct, complete or update it;
• erase it, where we no longer need it for the purpose or a legal obligation;
• withdraw consent you have given, which stops further processing that depends on it (it does not undo processing already done);
• nominate someone to exercise these rights if you die or become unable to.

If a landlord using Property360 holds your data — for example, you are their tenant — please contact that landlord first, as they decide how it is used; we will help them respond. You can also write to us and we will pass your request on.

11. Children

Property360 is a business service for adults. It is not intended for anyone under 18, and we do not knowingly collect their data as users.

12. Changes to this policy

We will update this page when our practices change and change the date at the top. Significant changes will also be notified in the application or by email.

13. Contact and grievances

For any privacy question, request or complaint, email support@property360.cloud with “Privacy” in the subject, or use the contact page. We will acknowledge your request and respond within the period the law requires. If you are not satisfied with our response, you may complain to the Data Protection Board of India.