Privacy Policy

Last updated 21 September 2026

1. Who is responsible for your information

SUDHA SOFTWARE runs Rental Book. For the details of the people who use it (landlords, managers and viewers) we decide how the information is used, and we are responsible for it under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). For the information you enter about your tenants and others, you decide what is kept and why; we store and process it on your behalf and only as you instruct.

2. What we hold

• About you: your name, email address, phone number (if you or we have added one), a password (kept only as a one-way hash), your Google account identifier and profile picture if you sign in with Google, your language, your role in each book, when you agreed to our Terms and which version, whether and when you confirmed your mobile number with a one-time code, and whether you want the monthly summary.
• What you enter about your business: buildings, rooms and photos; tenants' names, phone numbers, addresses and photos; ID type and number (the number is stored encrypted, and only the last four digits are shown on screens); scanned ID and address proof; workplace or college and emergency contact; police-verification status; agreement details and signatures; rent, payments, bills, expenses, property tax and receipts; photos of meter readings; and, for a room you advertise, the number to call and a line about the place.
• Payment and billing details of your book: the UPI address you give for collecting rent (shown to a tenant who opens a payment link), and the business name, address, GSTIN and PAN you give for our receipts.
• Messages: a log of the WhatsApp messages sent through Rental Book — recipient, message template, time and delivery status — and a note each time you open a rent reminder for a tenant in your own WhatsApp (which tenant, the amount owed, who and when). That reminder is sent from your phone, and we never see it.
• Subscription payments: plan, amount, date and Razorpay's payment reference. We do not receive or store card, bank or UPI credentials.
• Technical data: IP address and browser details in security logs, a record of each time our staff open a customer's book (who and when), and the cookies described below.
• Invitations: your book's invite code, and, if your book was opened from another owner's invite link, which book that was and the free time given to both.
• Notifications on your phone: if you use the Android app and allow notifications, the address Google's Firebase gives your phone for them. It moves to whoever signs in on that phone next, and is forgotten when you sign out in the app or delete your account.

Some of it is shown to anybody, only where you choose to. A To-Let poster you print for an empty room carries a QR code to a page that anybody can open: the room, its rent, its photos, your line about the place and the number to call — your own mobile unless you give another. It names no tenant and is kept out of search engines, and once somebody lives in the room it says only that it is let, without the number. A UPI sticker you print for a door carries your UPI ID and the room.

3. Why we use it

• To provide the service you asked for: keep your records, work out what is owed, prepare receipts and forms, and send the reminders you switch on.
• To bill you, to keep the service secure, to prevent misuse and to fix problems.
• To contact you about your account, the service and changes to these documents.
• To send you, on the 1st of each month, a summary of your book — what came in, who still owes the most and how many rooms are empty — unless you switch it off in Settings.
• To give the free time an invitation earns, and to tell both owners, each of them by the other book's name.
• To see how many people get started and where they get stuck — for example, whether a new book has a room, a tenant or a payment yet — and to get in touch with people who may need help getting going. This uses what you have entered only as counts and dates.

We do not sell your information or your tenants' information, and we do not use it for advertising.

4. Your tenants' information

Tenants are not users of Rental Book, so the landlord is responsible for telling them what is kept and for having their agreement. Rental Book asks the landlord to confirm this before ID or address proof is saved. WhatsApp messages are sent only to tenants for whom the landlord has recorded that they agreed to receive them. A tenant who opens the payment link in a reminder sees only their own name, room, the amount owed and the landlord's UPI address; the money goes from them straight to the landlord and never through Rental Book. Once they have paid, they can tell the landlord on the same page — the amount, the date and the UPI reference (UTR) — which the landlord checks against their own bank before anything is recorded. A tenant who wants to see, correct or delete what is held about them should ask the landlord first; they may also write to us.

A landlord can also send a tenant a link to fill in their own details: name, phone, photo, ID and address proof, permanent address, workplace or college, emergency contact and household members. On that form the tenant reads the terms and ticks that they agree to them and to their ID being kept, and may also agree to WhatsApp messages; each tick is recorded with its time. Their written details are kept encrypted until the landlord approves the form, and are used for nothing else until then. A form the landlord rejects is deleted at once, an unopened link 30 days after it closes, and a form nobody reviews after 90 days.

A photo the landlord takes of a meter as they read it is shown to the tenant on their bill, beside the charge it explains.

A landlord can add tenants by photographing their own rent notebook. Those photos go to Google's Gemini only to be read; the names, rooms, phone numbers and amounts on them come back for the landlord to check before anything is saved, and our copies of the photos are deleted as soon as they have been read.

Where the landlord has switched it on, a tenant can also tell them from their payment link that something needs repair: what is wrong and, if they choose, a photo. It is kept with the landlord's book, and deleted with it.

5. Who else handles it

We use service providers to run Rental Book, and they may process information on our behalf: our hosting and backup storage provider (Oracle Cloud Infrastructure), Backblaze (the United States: a second, encrypted copy of the database only, never the uploaded ID or address documents), Google (sign-in; Firebase for notifications in the Android app; and Gemini, which reads the photos of a rent notebook that a landlord chooses to scan and sends back what is written on them), Razorpay (subscription payments), Meta (WhatsApp Business messages, and one-time codes to confirm a mobile number, once switched on), Sentry (reports of errors in the app, so we can fix them; they carry technical details, not the records in your book) and an email delivery provider. We do not share information with anybody else except where the law requires it.

6. How we protect it

Each customer's book is kept apart from every other. ID numbers are encrypted in the database; identity and address documents are kept in private storage and shown only to signed-in members of that book. Connections use HTTPS, and backups are kept in access-controlled storage. Our staff can open a customer's book to help with a problem; each time is recorded with who and when, and that record is kept. No system is perfectly secure: if a breach affects you, we will tell you and the authorities as the law requires.

7. How long we keep it

For as long as your book exists. A book whose plan has ended stays available to view and export until you ask us to erase it. When you ask us to erase your book we delete it from our live systems within 30 days, apart from records we must keep by law or to show what we did: our own payment records, the record of when our staff opened your book or changed its plan, and which book's invitation opened which, with the free time it gave.

An owner can also do it without writing to us: in Settings, Delete this book asks for the password and schedules the deletion 7 days ahead, and it can be cancelled until then. Everything in the book and its uploaded documents is deleted, and the name, email address, phone number and Google identity of logins that belonged only to that book are erased.

The photos and scanned ID and address proofs of a tenant or of somebody living with them are deleted 6 months after they leave: when their tenancy ends, or when they are marked as having moved out. So are the photos a landlord took of the room when the tenant moved in and when they left, which the landlord may send the tenant to compare. Their name, the kind of ID and its last four digits, and the rent record stay with the book.

Backups are deleted on a fixed schedule: none is kept longer than 21 days. A copy of your book taken before it was erased therefore leaves our backups within 21 days of the erasure. If we ever have to restore from a backup, we first erase again whatever had already been erased.

A sheet you upload to load your tenants all at once is read to do that and is not kept with your book; the copy the upload leaves behind is deleted automatically.

You can export your book as spreadsheets from Settings at any time. Uploaded documents are not part of that export.

Anybody can delete their own login the same way, with Delete Account in Settings; a book nobody else belongs to goes with it. How deleting works, step by step, including how to ask us without signing in.

8. Your rights

Under the DPDP Act you can ask to see what we hold about you, to have it corrected or erased, and to make a complaint. Write to us using the contact details below — to the grievance officer, where one is named there — and we will reply within a reasonable time. If you are not satisfied, you may approach the Data Protection Board of India.

9. Cookies and offline storage

Rental Book uses only the cookies it needs: a session cookie, a security (CSRF) cookie, one that remembers the language you chose, and, if you choose to stay signed in, a "remember me" cookie. If you arrive through another owner's invite link, a cookie remembers that link for up to 30 days, until you open your own book. The Android app also sets a cookie that tells the site it is the app. The app stores pages on your device so that it can work without signal. We use no advertising or tracking cookies and no analytics services.

The Android app shows this same service and collects nothing the website does not. It asks for no access to your contacts, location or files; when you add a photo or a document, Android lets you choose a file or take a photo for that one upload, and nothing else is read.

10. Children

Rental Book is for adults. Do not record a child's identity documents.

11. Changes

If we change this policy in a way that matters, we will ask you to agree to the new version.

Contact

SUDHA SOFTWARE
3/306, Kesavan Maligai, Near Periyamariamman Temple, Chinnasiragapadi, Salem, Tamil Nadu 636308
Grievance officer: Gopinath Govintharajan
Phone: +919965834442
Email: admin@rentalbook.in