Legal
Privacy Policy
Last updated: 2 August 2026
1. Who we are
TenantsFlo ("we", "us", "our") operates tenantsflo.com, a property management platform for landlords, property managers, and hostel owners in India. This Privacy Policy explains how we collect, use, and protect your personal data when you use our website and services. It complies with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian laws.
2. Data we collect
We collect only what we need to run the service: (a) Account data — your name, email address, phone number, and password (stored as a secure hash). (b) Property data — building names, addresses, unit/bed details, tenant names and contact details, rent amounts, bills, payments, deposits, and expenses that you add. (c) Tenant communication — phone numbers and email addresses used to send rent reminders and receipts that you choose to send. (d) Payment data — when a tenant pays online, the transaction is processed by our payment provider, Cashfree Payments, in compliance with RBI guidelines. We do not store card numbers, UPI PINs, or bank account numbers on our servers. (e) Usage data — anonymous analytics (page views, device type, region) collected without cookies, used only to improve the product.
3. How we use your data
We use your data to: provide and operate the service (billing, reminders, reports, tenant management); send you service communications such as receipts, reminders, and support replies; process payments through our PCI-DSS compliant payment provider; detect and prevent fraud or abuse; comply with legal obligations in India; and improve our product using aggregated, non-identifying analytics. We do not sell your personal data to anyone.
4. How we store and protect your data
Data is stored on secure servers located in the cloud, encrypted in transit (TLS) and at rest. Passwords are hashed and never stored in plain text. Building passwords are AES-256 encrypted before storage. Access to your data is restricted to authorised staff on a need-to-know basis, and we use industry-standard safeguards such as firewalls, rate limiting, and role-based access controls.
5. Payments and financial data
Online rent and fee payments are processed by Cashfree Payments India Pvt. Ltd., a RBI-approved payment aggregator, through PCI-DSS compliant infrastructure. Payment instructions are handled directly between the payer and Cashfree. We only receive confirmation of whether a payment succeeded, the amount, and the date — we never see or store card numbers, UPI PINs, CVVs, or full bank account details. Your payout bank details (needed to receive collections) are held with Cashfree under their privacy policy and RBI norms.
6. Sharing your data
We share data only: (a) with our payment provider (Cashfree) to process transactions; (b) with our email/WhatsApp providers solely to deliver messages you have asked us to send; (c) when required by law, court order, or a government authority in India; or (d) with your consent. Tenant data is visible to the landlord and property managers of the building that the tenant belongs to — this is the purpose of the service. We never sell or rent personal data.
7. Your rights under the DPDP Act, 2023
Under the DPDP Act you have the right to: access a summary of your personal data we hold; seek correction of inaccurate or incomplete data; withdraw consent where processing is consent-based; and request erasure of your data, subject to legal obligations. You may also nominate a person to exercise your rights in the event of your death or incapacity. To exercise any of these rights, email us at the address below and we will respond within the timeframe prescribed by law.
8. Data retention
We keep your data for as long as your account is active or as needed to provide the service, comply with tax and legal obligations (Indian tax law requires financial records to be retained for 8 years), resolve disputes, and enforce our agreements. When you close your account, we delete or anonymise personal data unless we are legally required to keep it.
9. Children
Our services are intended for adults aged 18 and above. We do not knowingly collect data from children under 18. If you believe a child has provided us personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified on this page and, where appropriate, by email to the address on your account. Continued use of the service after changes take effect constitutes acceptance of the revised policy.
11. Contact us
For privacy questions, complaints, or to exercise your rights, email [email protected]. We aim to respond within 48 hours. If you are not satisfied with our response, you may also raise a concern with the Data Protection Board of India as provided under the DPDP Act.