Privacy Policy & Data Protection Notice

MessMate / Hostel

• Name and phone number.
• College / hostel, and where required, division, class or room.
• A photograph, only if you choose to provide one — optional, and taken live, not uploaded from a gallery.
• Payment screenshots you send, and the payment records the owner / rector enters.
• Attendance: which days you ate or were present.
• If you use the food / workout tracker: meals, workouts and weight entries you record.

School ERP

• Student name, class and section, and the contact details the school holds (including a parent's phone number).
• Attendance, marks and results entered by school staff.
• Fee records and payment history entered by the school.
• Homework, notices and messages posted by the school.

This website (shrinidhi.tech)

• If you send an enquiry or request the full app: your name, phone / email, and what you run.
• If our team captures your details during an onboarding conversation: your business and requirement details.
• If you use the website assistant: the messages you type, which are sent to Google's Gemini API to generate a reply (see sub-processors below).
• The free tools at gift.shrinidhi.tech store everything only in your own browser (localStorage). We do not receive or store that data on our servers unless you tap “Get the full app”, which sends the contact details you enter.

We do not collect Aadhaar or any government identifier in any product. An earlier MessMate spec asked for it; we removed it deliberately — holding one raises the stakes of any breach and earns nothing operationally.

We process personal data only to deliver the service to the organisation you belong to and on the basis of consent or the legitimate uses permitted by the DPDP Act (for example, providing a service you or your organisation signed up for). A mess needs to know who ate and who has paid; a school needs to record attendance, marks and fees and reach parents; the website needs your contact details to answer your enquiry. That is the whole purpose — purpose limitation and data minimisation are design rules for us.

We do not sell personal data. We do not share it with advertisers. There is no advertising in any of our apps, and no third-party analytics or tracking SDK. You can withdraw consent at any time (see your rights below); withdrawing it does not affect processing already done.

As a Data Principal, you have the right to:

• Access — a summary of the personal data we hold about you and how it is processed.
• Correction, completion and updating of your personal data.
• Erasure of your personal data, unless retention is required by law or for the purpose it was collected.
• Grievance redressal — raise any concern with our Grievance Officer and get a response.
• Nominate another person to exercise these rights on your behalf (for example, in case of death or incapacity).
• Withdraw consent at any time, as easily as you gave it.

To exercise any of these, use the Your data rights form or write to connect@shrinidhi.tech. We respond within 30 days (usually much sooner). For much of the School ERP and MessMate data, your school or mess holds and can edit the record directly, so we may route you to them while overseeing that it is done.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

The School ERP (and any mess / hostel serving minors) holds information about children. Under the DPDP Act, such data is processed on the basis of verifiable parental / guardian consent, which the school or institution obtains and instructs us to act on as its technology provider. We use children's data only to run the institution's own processes, and we never use it for advertising, behavioural tracking, profiling, or any processing likely to cause harm to a child. A parent or guardian can ask the institution, or us at the address above, to access, correct or delete a child's data.

• All traffic is over HTTPS.
• Photographs and payment screenshots are encrypted at rest with AES-256-GCM before they reach the database. The key is held in the server environment, never in the database — a database copy on its own yields nothing readable.
• Passwords are stored only as bcrypt hashes. Nobody at Shrinidhi Technologies can read your password.
• Access is scoped: staff at one mess, hostel or school can reach only their own records. Counter staff accounts are restricted further and cannot see financial information at all.

We maintain reasonable security safeguards. In the event of a personal-data breach, we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act.

We keep the list short on purpose. Our processors, acting on our instructions, are:

• Vercel — website and application hosting.
• Neon (managed PostgreSQL, on cloud infrastructure in the Asia-Pacific / applicable region) — the database.
• Razorpay — only when you make a payment on our /pay page. We never see or store card or bank credentials.
• Google (Gemini API) — only to generate replies for the website assistant, from the messages you type into it.

Some of these providers may process data on servers outside India. The DPDP Act permits such transfers except to countries the Government may restrict; we will comply with any such restriction. Data is never shared between different messes, hostels or schools — each is separate.

We keep records for as long as your mess, hostel or school keeps you on their register, and for a reasonable period afterwards so they can answer questions about past payments and attendance. Website enquiry and onboarding records are kept while we are in contact and for a reasonable follow-up period. When personal data is no longer needed for its purpose, we erase it.

Ask us and we will delete your data, unless your institution is required to retain it for its own accounting or statutory reasons.

Our apps do not process payments. Mess, hostel and school money is paid directly to the institution and recorded there by staff. Where a membership is paid by UPI, the transfer happens in your own UPI app; we only store the screenshot you choose to send as proof. The only place this website takes money is /pay, handled by Razorpay. We never see or store card or bank credentials.

If this policy changes materially we will update the date at the top and, where the change affects how your data is used, tell you in the app or on this site.

Shrinidhi Technologies
Grievance Officer — Data Protection
Pune and Satara, Maharashtra, India
connect@shrinidhi.tech