Privacy policy

Plain English, because you should be able to understand what happens to your information. Last updated 11 September 2026.

Who we are

amacomplex is a service that helps housing societies in India run their gate, dues, notices and complaints. It is operated by Akash Ghosh (the "operator"), reachable at hello@amacomplex.com. Under India's Digital Personal Data Protection Act, 2023, each society's managing committee decides why your data is collected and is the "data fiduciary" for its residents; amacomplex processes that data on the committee's behalf and is the data fiduciary for account and login information.

What we collect

• Account: your name, email address, and, if you sign in with Google or Apple, the name and email those services share. We never see your Google or Apple password.
• Society membership: which society, block and flat you belong to, your role (resident, owner, tenant, family member, committee, guard, accountant), and the email the committee invited.
• Gate records: for each visitor, the name, phone (optional), purpose, vehicle number and a photo if the guard takes one, the flat visited, who approved or denied, and entry and exit times. Guest passes you create are stored with the guest's name and phone.
• Dues and payments: bills for your flat and payments recorded against them. When online payment is enabled, the payment itself is handled by a licensed payment gateway; we store only the reference number and amount, never card or bank details.
• Complaints and notices: what you write in complaints and updates, and which notices you have opened.
• Device: if you turn on alerts, a push-notification address for that browser or phone. Basic technical logs (IP address, browser type, timestamps) kept by our hosting providers for security.

We do not collect location, contacts, photos from your phone, or anything from your device without a deliberate action by you.

Why we use it

To run the gate (visitor approvals, passes), to bill and record maintenance dues, to publish notices and handle complaints, to send you the alerts you turned on, to keep the service secure, and to comply with law. Nothing else. We do not sell personal data and we do not use it for advertising.

Who can see what

• You see your own flat's visitors, passes, bills and complaints.
• Your society's committee and property manager see all records of that society, because they run it.
• Guards see the gate: visitor records and valid pass codes for that society, nothing else.
• An accountant invited by the committee sees billing only.
• Other societies can never see your society's data. Isolation is enforced inside the database, not just in the app.
• Visitors you approve are shown to the guard; visitors are not shown to other residents.

Service providers we rely on

We use a small number of reputable providers who process data only on our instructions: Supabase (database and login, hosted in Mumbai, India), Vercel (web hosting, application servers in Mumbai, with global content delivery), Google and Apple (only if you choose to sign in with them), and, once enabled, Razorpay (payments) and Meta (WhatsApp messages). Each is bound by its own privacy and security commitments.

How long we keep it

• Visitor photos: deleted automatically after 30 days.
• Visitor entry records: 12 months, then deleted, unless the committee needs them longer for a security incident.
• Bills and payment records: 8 years, as Indian accounting rules require societies to keep them.
• Account details: for as long as you have an account. Removed by the committee, or on your request, your name is detached from records within 30 days.

Your rights

You can ask to see the personal data we hold about you, correct it, or have it deleted. You can turn alerts off at any time from the app or your phone settings. To exercise any right, email hello@amacomplex.com from the address on your account, or see how to delete your data. We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Grievance officer

Akash Ghosh, hello@amacomplex.com.

Security

Data is encrypted in transit and at rest. Access inside the database is restricted by role and society. Nightly backups are kept for 90 days. Staff access to production data is limited to what is needed to run the service.

Cookies

We use only the cookie needed to keep you signed in and one to remember which society you last opened. No advertising or tracking cookies.

Children

Accounts are for adults. A committee may record a child's name as a family member only with the parent's consent.

Changes

If this policy changes in a way that matters, we will post a notice in the app before it takes effect.