Privacy Policy

This is unusual enough to state first. A register is opened by scanning its own QR tag and entering a 6-digit PIN printed on the admin card in the box. There is no sign-up, no username and no password.

We do hold one management email address per register, given when it is set up, and we ask you to confirm it. It exists for one job: if the PIN and the backup code are both lost, a reset link goes there and nowhere else. Without it the only way back is a person at NLAD verifying your management by hand, which takes days. We also use it to tell you before your term ends, and to confirm it when a PIN is changed.

What that address is never used for: marketing, profiling, sale or sharing. It is not shown on any public page. You can change it in Settings whenever the management changes, and asking us to delete the register deletes it with everything else.

About the organisation: the name your management typed, the type (society, RWA, school and so on), the town and state, and one management WhatsApp number. The state decides which paperwork your register talks about; the number is how we know whose register a kit belongs to, since kits ship in bulk and nothing else links a serial to a buyer.

About the equipment: what each tag is on, where it is, make and model, licence and certificate numbers and their expiry dates, and the service schedule.

About the work: the date, what was done, the technician’s name and company if they gave one, the amount if there was a bill, and any photographs attached.

About money: what was spent, on what, who paid, and receipt images. These are never public.

Optionally, a person: the name and role of whoever keeps the register. It appears on your public tag pages only if the management ticks the box that says so, and it can be removed at any time.

Anyone who scans an equipment tag sees a page for that item: what it is, where it is, when it was last serviced, when the next service is due, and the approved service history. That is the point of the product — a resident or an inspector standing in front of a lift can see its record without asking anybody.

Never on that page: your PIN, your backup code, any money entry, any receipt or evidence photograph, the management WhatsApp number, or the name of the keeper of the register unless it was deliberately published.

Evidence photographs and receipts are stored privately. They are visible only to whoever holds the admin PIN, through links that expire after an hour.

When you or a technician tap “read this photo”, that one image is sent to Anthropic in the United States to be turned into draft form fields. This happens only when someone presses that button — never in the background, and never to a photograph nobody asked us to read. The image is used for that request and is not kept for training. Everything it fills in is a draft a human must check and the management must approve before it enters the register. If you would rather nothing left India, do not use the photo-reading buttons; every field can be typed.

The register itself is in Mumbai, India, on Supabase’s Indian region, with the website served by Netlify.

The backup copies are held outside India, and are encrypted before they leave. A copy is taken every night so that a failure at our database provider cannot end a building’s record: the photographs go to a private bucket in Europe, the rows to GitHub, and both are encrypted here first, with keys that stay with us. Neither company can read what it holds for us — what crosses the border is an unreadable block, not somebody’s lift licence. They are kept away from the live system on purpose, because a backup in the same place as the thing it protects is not a backup. The row copies expire after 30 days.

So three things leave India, and all three are named on this page: a photograph you ask to have read, an email we send you, and the encrypted backups. Nothing else does.

Your PIN and backup code are stored only as one-way hashes. Nobody at NLAD can read them, we will never ask you for them, and we cannot look one up for you — which is why losing both has a seven-day recovery procedure rather than a phone call.

Five wrong attempts lock that admin page for fifteen minutes. Public tag pages are unaffected and keep working.

Nobody, other than the service providers that make the product run: Supabase (database and file storage, Mumbai), Netlify (serving the website), Anthropic (only the photographs you ask to have read), Resend (which carries the email we send to your one address), Backblaze and GitHub (which hold the encrypted backups and can read neither), and Razorpay if and when you pay us — we never see your card number.

We do not sell data, we do not share it with advertisers, and there is no analytics or tracking on the pages a resident scans.

For as long as the register is open. Records are never silently deleted — an entry can be voided with a reason and stays visible, struck through, because a maintenance record that can be quietly edited is not a record.

You can export everything at any time from Reports, as a CSV and as a printable audit pack. If you ask us to close a register, tell us at support@nlad.in and we will confirm what is removed and when.

The off-site copies go too, and nobody has to remember to remove them. When a register is deleted, its photographs and documents are removed from the live system that day. They stay in the encrypted European backup a little longer, because a backup that forgets the moment you do is no protection against a deletion made by mistake — and then they are deleted automatically, on the first nightly run after they have been gone from the live system for thirty days. The row copies expire on the same thirty-day schedule. After that there is no copy of that register anywhere, ours or anyone else’s.

This section is for anyone whose details are in a register, not only the management. A technician whose name is on a service record and a resident who reported a broken lift and left a number are both in here, and neither of them signed up for anything.

You may ask what we hold about you or about your organisation, ask us to correct anything that is wrong, ask for an export, and ask us to delete it. Write to support@nlad.in. That address is the one a person with a complaint should use, and it reaches a person rather than a queue.

We answer within 30 days. That is the same promise we make for any written complaint, and we would rather be held to it than to the outside limit the rules set, which is ninety days. If we are going to need longer on something — an export from a backup, say — we will say so inside the 30 rather than at the end of them.

We identify the management by their register number and PIN, or by writing from the confirmed management address on that register. Where neither is possible, by the same evidence used for an assisted PIN reset — letterhead, registration number, a resolution from the management, and a photograph of a tag in place. An individual asking about their own name or number in somebody’s register we identify from the entry itself, and we do not ask a resident to prove anything to the management to reach us.

If there is a breach. If personal data held here is exposed, we tell the people affected without delay, in plain words: what happened, what of theirs was in it, what we have done, and what they can do. We tell the Data Protection Board of India as well, first straight away and then in fuller detail. We have written the steps down in advance, with the wording of the notice, so that on the day nobody is drafting a legal document and deciding who to ring at the same time.

This is a tool for building management teams and their contractors. It is not directed at children and we do not knowingly collect anything about them.

If this policy changes we will update the date at the top. If a change materially affects what we hold or where it is stored, we will say so on the register itself, where the management will actually see it.