1. Who We Are
BlockSense is a platform built for gated residential societies in India. It is operated by Muhammed Yassir Khan, a sole proprietor based in Bangalore, Karnataka, India.
Contact: muhammedyassirkhan@gmail.com
Phone: +91 97391 21146
Address: Bangalore, Karnataka, India
As a Data Fiduciary under the DPDP Act 2023, we are responsible for decisions about how your personal data is processed.
2. Data We Collect
We collect only the data necessary to provide the BlockSense platform. Here is exactly what we collect and why:
2.1 Identity & Contact Data
| Full name | Account creation, role assignment |
| Mobile phone number | OTP authentication (email or SMS) |
| Email address | Fallback authentication, notifications |
| Flat/unit number | Resident identification within society |
| Block/tower identifier | Society structure mapping |
2.2 Transaction & Payment Data
| Maintenance dues amounts | Payment tracking and reminders |
| Payment status (paid/pending/overdue) | Financial reporting for RWA |
| Payment date and reference | Audit and reconciliation |
We do not store credit card numbers, UPI IDs, bank account numbers, or any raw payment credentials. All payment processing is handled by third-party payment gateways.
2.3 Visitor & Gate Log Data
| Visitor name | Gate log and resident notification |
| Visitor phone number | Verification and contact |
| Vehicle number (if provided) | Gate entry log |
| Entry/exit timestamps | Security audit trail |
| Purpose of visit | Society records |
2.4 Utility & Infrastructure Data
| Water meter readings | Consumption tracking and billing |
| Power consumption readings | Usage monitoring |
| Gas, sewage, waste data | Society infrastructure management |
2.5 Staff & Operational Data
| Staff name, phone, role | Roster and attendance management |
| Shift timings and attendance | Payroll support and operations |
| Task assignments | Staff management |
2.6 Technical & Usage Data
| IP address | Security, rate limiting, fraud prevention |
| Device type and browser | App compatibility and debugging |
| Session timestamps | Authentication security |
| Feature usage patterns | Product improvement (via PostHog) |
| Error logs | Bug fixing (via Sentry) |
2.7 Data We Do NOT Collect
- ✕Biometric data (fingerprints, facial recognition)
- ✕Aadhaar numbers or government ID numbers
- ✕Income or financial account details
- ✕Health or medical information
- ✕Caste, religion, or political opinions
- ✕Location tracking beyond what you voluntarily provide
3. How We Use Your Data
We use your data exclusively to provide, maintain, and improve the BlockSense platform:
- →Authenticate your identity: Verify you are who you say you are via OTP
- →Operate society management: Enable RWA committees to manage residents, payments, complaints, and utilities
- →Send notifications: Push and email alerts for dues, visitors, emergencies, and broadcasts
- →Generate reports: Maintenance statements, RERA compliance reports, utility summaries
- →AI-powered features: Predictive maintenance alerts, complaint categorisation, broadcast drafting
- →Security and fraud prevention: Rate limiting, PIN lockouts, audit logs
- →Legal compliance: Maintaining records required under Indian law
We do not sell, rent, or trade your personal data. We do not use your data for advertising profiling.
4. Legal Basis for Processing
Under the DPDP Act 2023, we process your personal data on the following lawful bases:
Consent
For optional features such as AI-drafted broadcasts, predictive alerts, and analytics. You provide consent during onboarding and can withdraw it at any time.
Contract Performance
Data necessary to deliver the BlockSense service you (or your RWA) have subscribed to — authentication, resident records, payment tracking.
Legal Obligation
Data required to comply with Indian law, including RERA compliance records and audit trails.
Legitimate Interest
Security monitoring, fraud prevention, error logging — processed to protect users and maintain platform integrity.
5. Data Sharing & Disclosure
We share your data only in the following limited circumstances:
5.1 Within Your Society
RWA admins and managers can view resident data, payment status, and complaints for their society only. Guards can view visitor logs and gate passes. Residents can view only their own data.
5.2 Service Providers (Data Processors)
| Provider | Purpose | Location |
|---|---|---|
| Convex (convex.dev) | Database and backend infrastructure | EU (Ireland) |
| Vercel | Application hosting and deployment | Global CDN |
| Resend | Email OTP and transactional email | USA |
| PostHog | Product analytics (anonymised) | EU |
| Sentry | Error monitoring and debugging | USA |
| Google (Gemini AI) | AI-powered features | USA |
All service providers are bound by data processing agreements and may only process your data on our instructions.
5.3 Legal Requirements
We may disclose data if required by Indian law, court order, or government authority. We will notify you where legally permitted.
5.4 We Never
- ✕Sell your personal data to any third party
- ✕Share data with advertisers or data brokers
- ✕Transfer data across societies without explicit consent
6. Data Retention
We retain your data only for as long as necessary:
| Account and identity data | Duration of account + 2 years after deletion request |
| Payment records | 7 years (Indian accounting and tax law) |
| Visitor logs | 1 year from date of visit |
| OTP codes | 10 minutes from generation |
| Audit logs | 3 years |
| Error logs (Sentry) | 90 days |
| Analytics data (PostHog) | 12 months, anonymised thereafter |
| DPDP consent records | Duration of consent + 3 years |
When retention periods expire, data is securely deleted or anonymised.
7. Your Rights Under DPDP Act 2023
As a Data Principal under the Digital Personal Data Protection Act 2023, you have the following rights:
Right to Access
Request a copy of all personal data we hold about you.
→ Email us at muhammedyassirkhan@gmail.com with subject 'Data Access Request'
Right to Correction
Request correction of inaccurate or incomplete personal data.
→ Update via your profile settings or contact us
Right to Erasure
Request deletion of your personal data (subject to legal retention requirements).
→ Use the 'Delete My Account' option in Settings or email us
Right to Withdraw Consent
Withdraw consent for any processing based on consent at any time without affecting prior processing.
→ Manage consents in Settings → Privacy
Right to Grievance Redressal
Lodge a complaint with our Grievance Officer and receive a response within 15 days.
→ See Grievance Officer section below
Right to Nominate
Nominate another individual to exercise rights on your behalf in case of death or incapacity.
→ Contact us in writing
8. Data Security
We implement industry-standard security measures to protect your data:
- ✓All data in transit encrypted with TLS 1.3
- ✓Data at rest encrypted by Convex (AES-256)
- ✓OTP codes expire within 10 minutes and are single-use
- ✓Guard PIN lockout after 5 failed attempts, enforced server-side
- ✓Rate limiting on all authentication endpoints
- ✓SHA-256 hash-chained immutable audit ledger for governance actions
- ✓Role-based access control — users see only what their role permits
- ✓All sensitive mutations require Human-in-the-Loop (HITL) AI approval
- ✓Vercel environment variables are encrypted at rest and restricted to production
Despite these measures, no system is 100% secure. If you discover a security vulnerability, please report it immediately to muhammedyassirkhan@gmail.com.
9. Children's Privacy
BlockSense is not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor's data has been collected, please contact our Grievance Officer immediately and we will delete it promptly.
11. Third-Party Links & Integrations
BlockSense may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not cover those third-party services. We encourage you to review their privacy policies:
12. Grievance Officer
In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act 2023, we have appointed a Grievance Officer:
Designation: Founder & Grievance Officer, BlockSense
Email: muhammedyassirkhan@gmail.com
Phone: +91 97391 21146
Response time: Acknowledgement within 24 hours, resolution within 15 days
Address: Bangalore, Karnataka, India
If you are not satisfied with our resolution, you may escalate to the Data Protection Board of India once operational under the DPDP Act 2023.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we do:
- • The "Last updated" date at the top will change
- • We will notify you via email for material changes
- • Continued use of BlockSense after changes constitutes acceptance
For significant changes affecting your rights, we will request fresh consent where required by the DPDP Act 2023.
14. Contact Us
For any privacy-related queries, data requests, or complaints: