1. In short
We collect what we need to introduce you to a room or a resident, verify who you are, take rent safely, and meet Indian law. We never see your card or bank details. Your identity documents are the most sensitive thing we hold, so they are stored outside the public website, released to an owner only after you have physically checked in, and every single time one is opened we record who opened it.
This policy covers roomzy.in, owner.roomzy.in and admin.roomzy.in. It is written to be read, not to be survived — if anything here is unclear, write to us and we will explain it.
2. What we collect
| Account details | Name, email address, mobile number, password (stored only as a one-way hash, never in readable form), and whether you are a student or a working professional. |
|---|---|
| Identity documents | Images of an Aadhaar card, voter ID, student or university ID, or employment proof, plus the identity number where you provide it. Residents only; owners submit their own separate set. |
| Tenancy information | The property and room you requested or rented, dates, rent, deposit, check-in, notice and move-out records, and messages you send through ROOMZY. |
| Payment records | Amount, rent month, transaction reference, payment method type (UPI, card, netbanking), status, and the resulting invoice. Not your card number, CVV, UPI PIN or bank credentials. |
| Owner details | For owners: business or personal identity documents, address, and bank account details used to pay out rent collected on their behalf. |
| Technical information | IP address, browser type, and timestamps of security-relevant actions such as sign-in, failed sign-in and document access. |
3. Why we use it
- To run the service — showing you rooms, sending room requests, recording a tenancy, issuing invoices.
- To verify identity — so an owner knows who is moving in, and a resident knows the property has a verified owner behind it.
- To take and settle payments — collecting rent, calculating our commission, paying owners, and processing refunds.
- To keep people safe — detecting fraud, impersonation, and misuse of the platform.
- To support you — answering questions and resolving disputes over deposits or refunds.
- To meet legal obligations — tax and accounting records, and responding to lawful requests.
We do not sell your personal data. We do not share it with advertisers.
4. Your identity documents
These deserve their own section, because they are the most sensitive thing we hold and because people are right to ask what happens to them.
Where they are stored
Uploaded documents are written outside the public web folder, in a location that cannot be reached by typing a URL, protected by a deny-all rule. They are never linked directly. The only way to see one is through an authenticated viewer that checks who you are and whether you are entitled to it, every single time. Identity numbers, where you give them, are encrypted before they are stored.
Who can see them
- ROOMZY staff who review KYC, to verify the document is genuine and consistent.
- The owner of the property you move into — and only from the moment you have checked in with them using your 6-digit code. Not when you send a request, not when they accept it, not when you pay. This is deliberate: it means an owner cannot collect identity documents from people they never actually house.
The access log
Every time an owner or an administrator opens or downloads one of your documents, ROOMZY records who did it, which document, whether they viewed or downloaded it, when, and from what IP address. If you ever want to know who has seen your Aadhaar, ask us and we can tell you.
What owners may do with them
Owners are bound by our Terms of Service to use your documents only for tenancy and police-verification purposes, not to copy, publish or forward them, and to delete them when they are no longer needed. If you believe an owner has misused your documents, tell us immediately at support@roomzy.in and we will investigate, using the access log as evidence.
You are never obliged to upload a document you are uncomfortable sharing. Where you have a choice of identity proof, a masked Aadhaar, a voter ID, a student ID or employment proof serves the same purpose for us.
5. Payment information
Payments are processed by Cashfree Payments, a payment aggregator authorised by the Reserve Bank of India. When you pay, you are on Cashfree's own secure page. Your card number, CVV, UPI PIN, netbanking password and bank credentials go to Cashfree, never to ROOMZY. We could not disclose them if we were asked to, because we do not have them.
What comes back to us is the amount, the reference, the method type and whether it succeeded. Refunds are returned to the same method you paid with, which is why we never need your bank details for a refund.
Owners do provide bank account details, because that is how rent is paid out to them. Those are stored for that purpose alone.
6. Who we share it with
| Property owners | Your name and contact details when you request their room; your verified identity documents only after check-in, as described above. |
|---|---|
| Residents | The owner's name and contact details, and the property address, once a booking is in progress. |
| Cashfree Payments | Your name, email, mobile number and the amount, so a payment can be created and a refund returned. |
| Service providers | Our hosting and email providers, who process data on our instructions and may not use it for their own purposes. |
| Law enforcement and courts | Where we are legally required to disclose, or where it is necessary to establish or defend a legal claim. We disclose the minimum necessary. |
Your data is stored on servers in the European Union operated by our hosting provider, and is transferred only to countries permitted under Indian law.
7. How it is protected
- Everything is served over HTTPS.
- Passwords are stored as one-way hashes. Nobody at ROOMZY can read your password.
- Identity documents live outside the public web root and are served only through an authenticated, logged viewer.
- Identity numbers are encrypted at rest.
- Database access uses prepared statements throughout, and every form is protected against cross-site request forgery.
- The three portals — resident, owner and admin — use separate sessions, so access to one does not grant access to another.
- Failed sign-in attempts are counted and accounts are locked after repeated failures.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data, we will inform you and the Data Protection Board of India as required by law, and tell you plainly what happened and what to do.
8. How long we keep it
| Account information | While your account is open, and for a reasonable period afterwards for dispute and fraud purposes. |
|---|---|
| Identity documents | While you have an active or recent tenancy. Deleted on request once no tenancy or dispute depends on them. |
| Payment and invoice records | Retained for 8 years, as required by Indian tax and accounting law. These cannot be deleted on request. |
| Document access logs | Kept as a security record, so past misuse remains traceable. |
9. Your rights
Under the Digital Personal Data Protection Act, 2023 you may:
- Ask what we hold about you, and who we have shared it with.
- Correct anything inaccurate or incomplete — much of this you can do yourself in My Profile.
- Ask us to erase data we no longer need for the purpose it was collected, subject to the retention periods above.
- Withdraw consent for processing that relies on it. Withdrawing consent for identity verification means we can no longer offer you a booking.
- Nominate somebody to exercise these rights on your behalf if you are unable to.
- Complain to us, and then to the Data Protection Board of India if you are not satisfied.
Write to support@roomzy.in from the email address on your account. We respond within 30 days. We may ask you to confirm your identity first, precisely because we do not want to hand your data to somebody pretending to be you.
10. Cookies and sessions
ROOMZY uses a small number of strictly necessary cookies: a session cookie
to keep you signed in, and a token that protects forms from cross-site
request forgery. They are marked HttpOnly, Secure
and SameSite, and each portal uses its own separate cookie.
We do not use advertising or third-party tracking cookies. Blocking the session cookie will prevent you from signing in.
11. Children
ROOMZY is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, tell us and we will delete it.
12. Contacting us
| Data Protection & Grievance Officer | Nilabja Chatterjee |
|---|---|
| Company | ROOMZY (by robosol india) |
| Address | mm bose road , Subhash gram South 24 parganas West bengal, India Kol-700146 |
| support@roomzy.in | |
| Phone | 9339859087 |
| Response time | Acknowledged within 24 hours, resolved within 15 days. |
13. Changes to this policy
We update this policy when ROOMZY changes. The effective date at the top of the page shows the current version. If a change materially affects how your data is used — particularly anything about your identity documents — we will tell you in the app or by email before it takes effect.
See also our Terms of Service, which govern your use of ROOMZY, or write to us through the contact form.