Last updated: 30 October 2026
Commonkeep helps housing societies and apartment owners' associations ("your society") keep their accounts. That covers recording expenses with receipts, getting two people to approve them, collecting maintenance, and showing every owner where the money went.
This notice explains what personal data is used, why, who can see it, how long it is kept, and your rights. It is short on purpose. If anything is unclear, write to [email protected].
1. Who is responsible for your data
There are two parties. Which one is responsible depends on the data.
| Data | Who decides how it is used | Our role |
|---|---|---|
| Your society's books: your name, flat, role, the expenses, receipts, approvals, comments, maintenance dues and payments recorded for your society | Your society (acting through its committee or board). It is the Data Fiduciary. | We process this data on your society's behalf and under its instructions, as its Data Processor. |
| Your account with us: your login identifier (phone number), sessions, security logs and support messages | Us, Deepak Sharma, who runs Commonkeep | We are the Data Fiduciary. |
Questions about your society's records (for example, a payment shown against your flat) are best sent to your society's committee. If you send them to us, we will pass them on within 2 working days and help your society answer.
- Deepak Sharma, an individual who runs Commonkeep, Supreme Estia, Pune, Maharashtra, India. Contact: [email protected].
- Grievance Officer: Deepak Sharma, [email protected].
2. What data we use, and why
| What | Example | Why it is used | Who provides it |
|---|---|---|---|
| Name, flat number | "Priya, A-202" | To show who owns or occupies a flat, who spent, and who approved | Your society's admin |
| Mobile number | +91 98xxxxxx10 | To let you log in with a one-time code, and to send you notices and reminders about your society's money | Your society's admin |
| Your role and its dates | "Treasurer, 1 Apr 2026 – 31 Mar 2027" | To decide what you can do in the app, and to keep a record of who held each role and when | Your society's admin |
| Expenses you capture or approve | amount, vendor, date, category, your approval, comments | To keep your society's books and show every owner where the money went | You and other members |
| Receipt photos and PDFs | a bill or a payment screenshot | Proof behind each expense | The person who spent |
| Maintenance dues and payments for your flat | amount due, amount paid, date, payment method, UPI, cheque or transfer reference | To track what your flat owes and has paid | Your society's treasurer, or you when you report a payment |
| Technical data | login times, IP address, device type, security events | To keep the service secure and stop misuse | Collected automatically |
| Notifications | the list in your Inbox ("An expense is waiting for your signature"; for the owners of a flat, "A payment was recorded for your flat", "A payment on your flat was reversed" or "A credit note was applied to your flat", which name the amount and month (and, for the payment ones, the payment method) of your own flat only and never the reason), and, if you allow app notifications, your phone's notification address (a push token) and whether it is Android, iPhone or web | To tell you when something needs you, and to deliver that message to your phone | Created by the app when something happens; the token comes from your phone |
| Your society's old records, if the treasurer uses Add your records | the previous treasurer's Excel, a photo of the owners' register, a bank passbook page, a WhatsApp message with the flat list | To prepare a set-up draft (flats, who lives where, opening balances, dues owed, the maintenance amount) that the treasurer checks and saves. Used for nothing else | Your society's treasurer or admin |
| A usage counter | "opened the monthly summary in October" (one entry per person per month) | To learn whether the owner summary is being read, so we can improve it. Used by us only; no analytics company receives it | Collected automatically |
| The number and code you type on the login or sign-up screen | the number you enter and the code you type, even if the number does not belong to a member | To check the code, and to answer the same way for everyone so the screen cannot be used to find out who is a member | You |
We do not collect: Aadhaar, PAN, bank passwords, card numbers, your location, or your address book. Payments happen in your own bank or UPI app; we only record the reference you or the treasurer enter. Location data is removed from photos before they are stored.
Picking someone from your phone's contacts. When you add a signer or member, the app can open your phone's own contact picker so you do not have to type their name and number. This happens on your device only and only on the phone app (not the web version): the app reads just the one contact you tap, and nothing else from your contacts is read, stored or uploaded. The name and number you picked are sent to us only when you press "Add and invite", exactly as if you had typed them, and are then handled like any other member's name and number (§2). If you refuse contacts access, you can type the details instead. The app does not write to your contacts.
Legal grounds
- Your society's books are processed for the specified purpose of keeping its accounts, using data provided for that purpose (DPDP Act s.7(a)). Where co-operative or other law requires the books, that is a supporting ground.
- Our processing of your account data is based on your consent, which you give by accepting this notice when you first log in. You can withdraw it at any time (see §7).
3. Who can see what
Commonkeep is built for transparency, with limits:
- Every member of your society can see society-level totals and every recorded expense with its receipt. They can also see who captured and who approved each expense, and the role history.
- Only the treasurer, committee head, backup approver and admin can see each flat's dues and payments. Other owners see totals only, unless your society chooses to show per-flat status to everyone. If it does, the app tells you so.
- Phone numbers are visible only to the committee roles above. Other members do not see yours.
- Comments you post on an expense are visible to all members of your society.
- We (our staff) access your society's data only to run, support or secure the service, or when the law requires it. Access is limited to named people and is logged.
We never sell personal data, never use it for advertising, and never use your society's records to train AI models.
4. AI receipt reading
When someone photographs a receipt, the image is sent to an AI model, which suggests the amount, vendor, date and category.
- What is sent: only the receipt image (with location and camera data removed), your society's currency and country, and its list of expense categories. No names, phone numbers or flat numbers are sent.
- Who reads it: Google's Gemini model, run on Google Cloud (Vertex AI) and reached through OpenRouter. These providers act on our instructions. They are contractually barred from training on the images and set to keep no copy after answering (zero data retention).
- The AI only suggests. The person who spent checks every field, and two people must approve before anything is recorded.
- Your society can have AI reading turned off, and expenses are then typed in by hand. The setting exists, but there is no switch for it in the app yet: ask us at [email protected] and we will turn it off for your society.
4A. Setting up from your society's records
This feature is not switched on yet. This section describes how it will work once it is; we will update this notice and ask again before it starts.
A treasurer setting up Commonkeep can drop the society's existing records into the app instead of typing them: spreadsheets, photos of the register, passbook pages, a forwarded message. An AI model reads them and prepares a draft of the flats, the people in them, the opening balances and the maintenance amount.
- Only with a clear yes. Before the first file is added, the treasurer ticks two separate boxes, which start un-ticked: that these are the society's own records and they may use them for this, and that they agree to the AI reading described here. We record who ticked them, when, and against which version of this notice. They can always choose "I'll type them instead"; nothing else in Commonkeep depends on this feature.
- One purpose. The files are used only to prepare your society's set-up draft. They are not used for anything else, not shared with any other society, and never used to train AI models.
- What is sent: the text read from the files, with its position (for example "Sheet 2, cell B7"). Names and flat numbers are sent, because they are what links one file to another. Phone numbers are replaced with placeholders before anything leaves our servers, and put back only on our side.
- Who reads it: Anthropic's Claude model, reached through OpenRouter, set to keep no copy after answering and barred from training on it.
- The AI only drafts. Every value in the draft points to the place in the file it came from, and our server checks that it is really there and drops anything that is not. Nothing reaches the members list, the flats or the books until the treasurer saves it, and opening balances also need the committee head's confirmation, like any other opening position.
- Changing your mind. The treasurer can stop at any time with "Stop and delete these files". The files and the unsaved draft are deleted. Anything already saved stays, as part of your society's records.
5. Who we share data with
We use a small number of service providers (sub-processors), each under a written contract that requires them to protect the data:
| Provider | What for | Where |
|---|---|---|
| DigitalOcean | Hosting, database, file storage and backups | India (Bangalore) for the app and database; Singapore for receipt files and backups |
| Twilio | Sending login codes by SMS and checking the code you type | United States, delivered through local mobile networks |
| OpenRouter | Routing receipt images, and the text of records dropped for set-up (§4A), to the AI model, with zero data retention | United States |
| Google (Google Cloud, Vertex AI) | Reading receipts (see §4) | United States, or in-region where available |
| Anthropic (not in use yet) | Preparing set-up drafts from your society's records (see §4A) | United States, or in-region where available |
| Expo, then Google (Android) or Apple (iPhone) | Delivering push notifications to your phone. Expo passes each message to Google's or Apple's notification service. Used only if push notifications are switched on for the service | United States |
Login and sign-up. A mobile number entered on the login or sign-up screen, and the code typed with it, are passed to Twilio to check the code, whether or not the number belongs to a member. On the login screen, a number that is not a member's gets no SMS and the check simply fails; on the sign-up screen, a code is sent to the number typed. On our side we do not keep the code you typed. We keep a scrambled (keyed) form of the number, and of the device's network address, to apply attempt limits; routine clean-up normally deletes them within about two days. If a number is locked out after repeated wrong codes, a pseudonymous entry (the scrambled form, not the number) is also written to our security log, which we keep for about a year (see §6). Our server logs may show the last four digits of the number for that attempt.
Push notifications. A push message tells you only that something is waiting, in a fixed sentence such as "You have 1 thing to sign." It never contains a vendor, an amount, a name or anyone's comment. Along with it goes a reference number so the app can open the right item once you are signed in. Expo, Google and Apple see your phone's notification address, that sentence and the reference number. The full text is in the app, in your Inbox, where only you can read it after logging in.
The current list is always at https://commonkeep.app/legal/subprocessors. We give societies 30 days' notice before adding a new one.
WhatsApp. When a treasurer sends a reminder or an invite, Commonkeep prepares the message and the treasurer sends it from their own WhatsApp. WhatsApp is not our service provider; WhatsApp's own terms and privacy policy apply to those messages.
We may also disclose data where the law requires it (for example, a court order or a regulator's lawful request). Where allowed, we tell your society first.
International transfers
- Your society's records are stored in India, in the database behind the app.
- Receipt photos and PDFs, and our encrypted backups, are stored in Singapore with the same hosting provider.
- Receipt images, and the text of records dropped for set-up (names included, phone numbers replaced), may be processed in the United States by the AI provider, with no copy kept.
- This is permitted under DPDP Act s.16, as neither Singapore nor the US is a restricted country.
6. How long we keep data
| Data | How long |
|---|---|
| Your society's accounting records (expenses, receipts, approvals, dues, payments, audit trail) | As long as your society uses Commonkeep. Your society must keep its accounting records for its legal period (by default 8 years after the end of the financial year); when it leaves, it takes a full export to keep them, and we delete our copy as described in the last row of this table. |
| Your name and phone number after you leave the society | 90 days after your access ends. Then your name is replaced with "Former member" and your flat number (for example, "Former member · Flat A-202") and your phone number is deleted. |
| Login codes | Until used or expired (a few minutes). Routine clean-up normally deletes them within about a day after that. |
| Numbers typed at login or sign-up by people who are not members | A scrambled form (and one of the device's network address), for attempt limits, normally deleted within about 2 days. If the number is locked out after repeated wrong codes, a pseudonymous security-log entry is kept for about 1 year, like other security logs. Twilio's own handling is described in its terms with us. |
| Login sessions | Up to 30 days, or 14 days without use |
| Security logs | 1 year |
| Notification list (the Inbox) | 90 days. A reminder whose item is still waiting is kept until it is dealt with |
| Your phone's notification address (push token) | Until you log out (or log out everywhere), your login contact is changed, your access ends or your details are erased, or the phone's push service says it is no longer valid. It is not removed when your login simply expires, so that approval reminders keep reaching you |
| The monthly-summary usage counter | Until your details are erased (see "Erase it" below) |
| Database backups | Each nightly backup is kept for 35 days, then deleted. Our storage provider keeps a deleted copy for 7 more days, so a backup is fully gone about six weeks after it was made. These backups are encrypted with a key only we hold. Where we use the provider's managed database, it also keeps its own backups for 7 days |
| Receipt copies in backups | A copy of each receipt photo or PDF is kept in private backup storage (each copy is encrypted with the same key as our database backups, a key only we hold, so the storage provider and anyone who got hold of the bucket cannot read it) for as long as the receipt itself is kept. Receipts are accounting records, so they are not deleted before the end of the retention period above. The storage keeps earlier versions of a file as well, so a receipt is only really gone once we have removed those versions too. When your society stops using Commonkeep, the deletion tool described in the last row of this table removes all of them |
| Receipt photos that were uploaded but never attached to an expense | Kept like other receipts for now. Automatic clean-up is not built yet |
| Records dropped for set-up (§4A) and the draft made from them | Deleted when the treasurer saves or dismisses the draft, when they choose "Stop and delete these files", or 30 days after anyone last touched them, whichever is first. Files the treasurer attaches as evidence to the opening balances stay with them as accounting records |
| The record of the two set-up confirmations (who, when, which notice version) | As long as your society's accounting records, because it shows on what instruction the set-up data was used |
| Copies held by the AI provider | None |
| If your society stops using Commonkeep | Your society gets a full export. We delete its data 90 days after the contract ends, unless your society asks us in writing to keep a read-only archive for its legal period. We do this with a dedicated, logged deletion tool that only we can run, and we confirm in writing when it is done. Database backups made before then are deleted within a further 35 days and are fully gone about 7 days after that (about six weeks in all). Receipt files, their copies in the backup store and the earlier versions the storage provider holds are all deleted by the same tool at the same time. The security log of sign-in attempts (it names no person and holds no amounts or receipts) keeps its own period of 1 year. |
7. Your rights
You can ask to:
- See your data and get a copy. Email [email protected], or ask your society's committee. You get your profile, roles, your flat's dues and payments, and the expenses you captured or approved, as a file. In the app: You → Privacy & data → My data downloads a copy at once, as a file for other apps (JSON) or as a PDF.
- Correct it.
- Wrong name or phone: your society's admin can fix it, or ask us. In the app: You → Privacy & data → Ask for a correction sends a request to your society's committee. It says what is wrong and what it should say, and you can follow it, and withdraw it, in the same place. The committee answers within 30 days.
- Wrong financial entry: financial records are never edited or deleted. That is what makes them trustworthy. The treasurer records a correcting entry instead, and both the original and the correction stay visible.
- Erase it. In the app: You → Privacy & data → Delete my account. It shows what is erased and what stays; you type DELETE and hold the button, and it is done at once. You must have signed in within the last 15 minutes (the app asks you to sign in again with a code, then brings you back), and you must hold no committee role: a treasurer, committee head, backup approver, spender or admin hands the role over first, so that your society is never left without a signer. Or email [email protected] with "Delete my account", or ask your society's admin. The same steps are on commonkeep.app/account-deletion.
- We remove your name, phone number, email and the comments you wrote in expense discussions, end your sessions and your phones' notification addresses, clear your notifications, and stop your access.
- Comments you wrote while approving, returning or rejecting an expense, or on a payment rejection or reversal, are part of the approval record and stay. Like the records above, they are linked only to "Former member".
- We cannot delete accounting records your society must keep by law (for example, a payment from your flat or an expense you approved). They stay with your society's books, linked only to "Former member" and your flat number (for example, "Former member · Flat A-202"). This is permitted by DPDP Act s.8(7) and s.12(3).
- Withdraw consent for our processing of your account. This closes your login. Your society's records continue as described above.
- Nominate someone to exercise these rights if you die or cannot act. In the app: You → Privacy & data → Ask for a correction → Nominate someone, with their name and contact details in the message. Or email us.
How to ask: in the app, under You → Privacy & data (a copy of your data, a correction or concern, or deleting your account); or email [email protected]; or tell your society's committee, who can pass it to us. A request made in the app goes to your society's committee. We may ask you to confirm your identity with a login code. We acknowledge within 7 days and answer within 30 days. It is free.
If you are not satisfied: first contact our Grievance Officer (above). If you are still not satisfied, you can complain to the Data Protection Board of India.
8. Security
- All traffic is encrypted (HTTPS).
- Data is encrypted at rest by our storage provider. Database backups, and the backup copies of receipt files, are also encrypted with a key only we hold. The database is kept in India; receipt files and backups are kept in Singapore.
- Login uses one-time codes with strict limits on attempts.
- Financial records are append-only, so nobody, including us, can quietly change them.
- Every change is logged with who made it and when.
- Our staff access is limited and logged.
If a data breach affects you:
- We tell your society within 24 hours of finding it.
- We tell the authorities and you as the law requires: the Data Protection Board of India and affected people, without delay.
9. Children
Commonkeep is for adult owners, occupiers and committee members. Members must be 18 or older. Societies must not add anyone under 18. If we learn that a child's data has been added, we delete it.
10. Cookies and device storage
The app stores on your phone only what it needs: your login, receipt drafts you have not yet sent, your light or dark choice, a few "already shown" flags, the draft of a society you are setting up (which can include names and phone numbers you typed, and stays on the phone until the society is created), and a short note that lets the contact-picker screen reopen after you sign in again (a kind of contact, your member number and a time; no name or number). We use no advertising or tracking cookies, no third-party analytics and no crash-reporting service. Our server code can talk to an error-reporting service, but it is switched off and we do not use one.
11. Changes to this notice
We will tell you in the app before any important change takes effect, and ask you to accept the new version where the law requires it. Earlier versions are available on request.
12. Languages
This notice is available in English. Hindi and Marathi versions will follow. You can ask for it in any language listed in the Eighth Schedule to the Constitution of India, and we will provide it.