Privacy Policy
- We collect only what is needed to run a PG: names, mobile numbers, room and rent details, meal choices and, if a hostler chooses to verify, Aadhaar details fetched from DigiLocker with their consent.
- We never see or store the full Aadhaar number — only the masked form (last 4 digits) issued by UIDAI.
- We do not sell personal data and do not show ads.
- Aadhaar details are deleted 90 days after a hostler checks out, or immediately if they were added by mistake.
- Data is stored in India (AWS Mumbai region) and is encrypted in transit and at rest.
1. Who we are
UrPG is a hostel and paying-guest (PG) management service operated by Thinkz It Solutions Pvt Ltd, Hyderabad, Telangana, India ("UrPG", "we", "us"). For data relating to their residents, the PG owner decides why and how it is used; we process it on their behalf to provide the service. For account and app data of owners themselves, we are responsible for it.
2. Who this policy covers
- PG owners and wardens who use the UrPG Owner app or app.pg.urpg.in.
- Hostlers (residents) added by their PG and using the UrPG Hostler app or app.urpg.in.
- Visitors to urpg.in.
3. What we collect
| Who | Data | Source |
|---|---|---|
| Owners | Name, mobile number; property name, address, optional GPS location and photos; rooms, beds and rent settings; expenses (with optional bill photos); staff names, roles, phone numbers and salaries. | Entered by the owner |
| Hostlers | Name, mobile number, room and bed, joining date, rent, deposit, payments and receipts; optional parent/guardian name, mobile and relation; complaints, attendance (in/out times), meal Yes/No choices and private notes the PG writes. | Entered by the PG; meal choices and complaints by the hostler |
| Hostlers who verify | From DigiLocker (UIDAI Aadhaar): name, date of birth, gender, care-of name, address, photo, and the masked Aadhaar number (e.g. XXXX XXXX 1234); the time and version of the consent given. | DigiLocker, only after the hostler gives explicit consent |
| Everyone signing in | Mobile number and a one-time password (OTP) for the first sign-in; after that, a 6-digit login PIN the user sets (we store only a one-way hash, never the PIN itself); device push-notification token if notifications are turned on. | The user / their device |
We do not collect the full Aadhaar number, biometrics, bank or card details, contacts, or location of hostlers.
4. How we use it
- To run the PG: rooms and beds, rent and dues, receipts, deposits, meals, notices, complaints, attendance and staff salaries.
- To let a PG confirm a hostler's identity, and to flag when the Aadhaar name does not match the name the PG entered.
- To sign users in securely with an OTP and then their login PIN.
- To send reminders the user or their PG asks for — rent and meal reminders (push notifications), and on-device meal alarms.
- To keep the service secure, prevent misuse and fix problems.
We do not use personal data for advertising or profiling, and we do not make automated decisions with legal effect about anyone.
5. Aadhaar and DigiLocker
- Verification is optional for the hostler and starts only after they give explicit consent in the app.
- The hostler signs in to DigiLocker themselves; details are fetched through our verification partner Equal. We never receive their DigiLocker password or OTP.
- Only the masked Aadhaar number is kept. Aadhaar details are visible only to that hostler and to the owner/staff of their PG.
- When a hostler checks out, their Aadhaar details and photo are automatically deleted after 90 days. If a hostler is removed because they were added by mistake, these details are deleted immediately.
6. Who we share it with
We do not sell or rent personal data. We share it only with:
- The hostler's PG (owner and staff), who use it to manage the stay.
- Service providers who process data for us under contract: Amazon Web Services (hosting and storage, Mumbai region), Google Firebase Cloud Messaging (push notifications), Equal (DigiLocker verification) and our SMS provider (sending OTPs).
- Authorities, when required by law or a valid legal order.
WhatsApp and phone calls are started by the user from their own device; we do not send data to WhatsApp.
7. How long we keep it
| Data | Kept for |
|---|---|
| Aadhaar details and photo | Until 90 days after checkout (immediately deleted if added by mistake) |
| One-time passwords | Up to 10 minutes |
| Login PIN (hashed) | Until the user changes it or deletes their account |
| Stay, rent and payment records | While the PG uses UrPG, and as long as the PG must keep them for accounting or legal reasons |
| Push notification tokens | Until the user logs out, the token expires, or notifications are turned off |
| Owner account | Until the owner deletes it (in the app or by request) |
8. Security
All connections use HTTPS. Data and uploaded photos are encrypted at rest. Access is limited to the user's own PG, uses short-lived sign-in tokens, and photos are shared only through links that expire within minutes. Sign-in codes expire after 10 minutes, and a login PIN locks for 15 minutes after 5 wrong tries.
9. Your rights
Under India's Digital Personal Data Protection Act, 2023 you can:
- Get a summary of the personal data we hold about you and how it is used;
- Ask us to correct, complete or update it;
- Withdraw consent (for example, for Aadhaar verification) and ask us to erase data we no longer need;
- Nominate someone to exercise these rights on your behalf;
- Raise a grievance with us, and then with the Data Protection Board of India.
Hostlers can also ask their PG directly. To make a request, email hello@thinkz.in from, or mentioning, your registered mobile number. We reply within 30 days.
Deleting your account
You can delete your account yourself in the app: Owner app → More → Delete account, or Hostler app → Home → Delete account. You can also ask us on the web — see urpg.in/delete-account for what is deleted, what is kept and how to request it.
10. Grievance Officer
Raja, Grievance Officer, Thinkz It Solutions Pvt Ltd
Email: hello@thinkz.in · Address: Hyderabad, Telangana, India
11. Children
UrPG is meant for adults. If a PG adds a resident under 18, the PG is responsible for obtaining verifiable consent from a parent or guardian before adding or verifying them.
12. App permissions
- Notifications — rent and meal reminders (optional).
- Alarms (Hostler app, Android) — ring before a meal's opt-in closes (optional).
- Location (Owner app) — only when the owner taps "Use my location" to fill in the property address.
- Camera / photos — only when the user chooses to upload a property or bill photo, or during DigiLocker verification.
13. Changes
If we change this policy, we will update the date above and, for important changes, tell users in the app before they take effect.