Privacy policy

This policy explains how Shiva Dhali Services (“we”, “us”), which operates Mahina by SlotRecover (the “Service”), handles personal data. It is written to comply with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.

Who this policy covers

• Account holders: the tutors, businesses and individuals who sign up to use Mahina.
• Members: the students, customers, tenants or other people whose details account holders add to Mahina to track monthly payments.

For members' data, the account holder decides what to record and why. We process that data on the account holder's behalf. Account holders are responsible for having a lawful reason to record their members' details and for telling members that they use Mahina.

What we collect

From account holders

• Email address and password (passwords are stored only as a secure hash by our authentication provider).
• Profile details you choose to add: your name, business name, business type, phone number, UPI ID and the name on your UPI account.
• Billing records for Pro purchases: order and payment IDs, plan and amount. Card, UPI PIN and bank details are handled by Razorpay and never reach us.
• Support messages you send us.

About members, entered by account holders

• Name, phone number, monthly fee, due date, batch or group, notes, and records of payments.

Automatically

• Privacy-friendly, cookieless page-view and performance analytics (Vercel Web Analytics and Speed Insights), which do not identify you personally.
• Essential cookies that keep you signed in.
• Server logs (IP address, browser type, time of request) kept for security for a limited period.

How we use data

• To provide the Service: showing dues, generating reminder messages, payment links and receipts.
• To process Pro purchases and keep billing records required by law.
• To respond to support requests and send essential account emails (for example, sign-in links and plan expiry notices).
• To keep the Service secure and prevent abuse.

We do not sell personal data, show advertising, or use members' data to contact members ourselves.

Payment links and receipts

Each member has a payment link containing a long random code. Anyone with the link can see only the member's first name, the business name, the amount due, and the account holder's UPI ID and UPI name. Receipt links show the member's name, amount, month, payment date and business name. Links do not show phone numbers, notes or other members' data. Account holders can make a payment link stop working by marking the member inactive.

WhatsApp and UPI

Mahina does not send WhatsApp messages itself. When you tap Remind, your device opens WhatsApp with a pre-filled message that you send from your own account, subject to WhatsApp's terms. Payments made through the UPI link go directly from the member to the account holder through their UPI apps and banks. We do not receive, hold or see these payments.

Where data is stored and who processes it

• Supabase (database and authentication), hosted in Mumbai, India.
• Vercel (website hosting, analytics and performance monitoring).
• Razorpay (Pro plan payments).

These providers process data only to provide their services to us and are bound by their own security and privacy commitments.

Security

Data is encrypted in transit (HTTPS) and at rest. Database access is restricted per account by row-level security, so one account holder can never read another's data. Administrative access is limited to the operators of the Service.

Retention

We keep account data for as long as your account is active. If you delete your account, we delete your profile, members and payment records within 30 days, except billing records we must keep for tax and accounting law (generally 8 years).

Your rights

You may access, correct, export or delete your data, withdraw consent, and nominate another person to exercise your rights. Most corrections can be made in Settings. For anything else, including account deletion, contact us. Members who want their data corrected or removed should contact the account holder who added them, or write to us and we will pass the request on.

Children

Account holders must be 18 or older. Student records added by tutors may relate to children; account holders should add only what is needed to track fees and should obtain parental consent where required.

Grievance officer

For privacy questions or complaints, write to the grievance officer at support@kriosity.in, Shiva Dhali Services, Noida, Uttar Pradesh, India. We aim to respond within 7 days and resolve complaints within 30 days.

Changes

If we make significant changes, we will notify account holders by email or in the app before they take effect.