Privacy Policy
Version 1.0 · Effective 2026-09-14
Effective Date: 14th Sept, 2026 Version: 1.0
1. INTRODUCTION, APPLICABILITY AND HOW TO READ THIS POLICY:
1.1. This Privacy Policy ("Policy") explains how Rishmathi Tech Ventures Private Limited (CIN U58200TS2026PTC216367), having its registered office at Villa 224, Kavuri Forest Nest, Lemoor Road, Mahesharam, Hyderabad, Telangana – 501359, India, operating under the brand "MemberSpace" ("MemberSpace", "we", "us", "our"), collects, uses, discloses, retains, and protects personal data in connection with the website memberspace.app, our mobile application, and the Services described in our Terms of Service ("Platform").
1.2. This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made thereunder ("DPDP Rules"), and applies to "Digital Personal Data" within the meaning of Section 3 of the DPDP Act that is, personal data in digital form, and personal data collected in non-digital form that is subsequently digitised processed by MemberSpace in connection with the Platform.
1.3. This Policy should be read together with our Terms of Service, Cookie Policy, and Refund & Cancellation Policy, each of which is incorporated by reference. Terms defined in the Terms of Service (such as "Community", "Admin", "Member", "Sub-Community", and "Content") carry the same meaning in this Policy unless stated otherwise.
1.4. This Policy does not apply to information that does not constitute "personal data" under the DPDP Act, including data that has been irreversibly anonymised such that a Data Principal is no longer identifiable, in accordance with the standard described in Terms of Service Clause 9.3, or to publicly available personal data that a Data Principal has themselves made public, save to the limited extent the DPDP Act continues to apply to such data.
2. DEFINITIONS
2.1. "Data Principal" means the individual to whom the personal data relates, and, in relation to a child, includes the parent or lawful guardian of such child, and, in relation to a person with a disability, includes the lawful guardian acting on their behalf.
2.2. "Data Fiduciary" means any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data.
2.3. "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary.
2.4. "Consent Manager" means a person registered with the Data Protection Board of India who acts as a single point of contact to enable a Data Principal to give, manage, review, or withdraw consent through an accessible, transparent, and interoperable platform, as contemplated under Section 6 sub-clause (7) to sub-clause (9) of the DPDP Act.
2.5. "Significant Data Fiduciary" means a Data Fiduciary, or a class of Data Fiduciaries, notified as such by the Central Government under Section 10 of the DPDP Act, based on factors including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, and other prescribed factors.
2.6. "Data Protection Board" or "Board" means the Data Protection Board of India established under Section 18 of the DPDP Act.
2.7. "Processing", in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure, erasure, or destruction.
2.8. "Community Data" has the meaning given in the Terms of Service, being Content and Personal Data relating to a Community and its Members, uploaded, entered, or generated using the Platform at the Community's instance.
3. CURRENT LEGAL BASIS DURING THE DPDP ACT'S STAGED COMMENCEMENT:
3.1. The DPDP Act is being brought into force in stages by the Central Government. As of the Effective Date of this Policy, the DPDP Act's substantive provisions on notice, consent, security safeguards, breach notification, children's data, Significant Data Fiduciary obligations, Data Principal rights and cross-border transfer restrictions have not yet been notified into force. Pending that notification, MemberSpace's processing of personal data is governed, as a matter of current law, by Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and, for specified categories of cyber security incidents, by Section 70B of the Information Technology Act, 2000 and the CERT-In Cyber Security Directions, 2022.
3.2. This Policy nonetheless describes MemberSpace's practices, in large part, by reference to the DPDP Act's framework, reflecting MemberSpace's voluntary and anticipatory alignment with that framework ahead of its commencement. Except where this Policy expressly states otherwise, each reference in this Policy to a provision of the DPDP Act or the DPDP Rules shall be read as referring to the corresponding requirement under the SPDI Rules or other applicable current law until such time as that DPDP Act provision is notified into force, and to the DPDP Act provision itself thereafter.
4. MEMBERSPACE'S DUAL ROLE: DATA FIDUCIARY AND DATA PROCESSOR
4.1. MemberSpace operates a multi-tenant platform used by Communities to manage governance, communication, and administration for their members. Because of this structure, MemberSpace occupies different roles under the DPDP Act depending on the personal data in question, and this Clause 4 is the single most important clause in this Policy for understanding who is responsible for what.
4.2. In respect of Community Data, the personal data of a Community's Members, residents, tenants, family members, staff, and visitors that is uploaded, entered, or generated by a Community and its Admin(s) on the Platform the Community is the Data Fiduciary. The Community alone determines why and how that personal data is processed. MemberSpace acts solely as a Data Processor for Community Data, processing it only on the documented instructions of the relevant Community and strictly for the purpose of providing, maintaining, securing, and improving the Platform, consistent with Terms of Service Clause 5.6 deals with Data Processing Roles and Clause 1.6 which contemplates a data processing addendum where the parties choose to execute one.
4.3. In respect of personal data that MemberSpace collects for its own purposes such as an Admin's or billing contact's account details, authentication credentials, support communications, marketing opt-ins (if any), and device/usage data described in Clause 4 MemberSpace itself is the Data Fiduciary, and the remainder of this Policy (notice, consent, rights, retention, security) applies directly and in full.
4.4. If you are a Member of a Community and you wish to exercise a right such as correction or erasure over data your community has entered about you, your primary point of contact is your Community's Admin, who is the Data Fiduciary for that data and who is responsible under the DPDP Act for responding to you. MemberSpace will support the Community in fulfilling that request as its Data Processor, as described in Clause 12. If your request concerns your own MemberSpace account credentials or your direct dealings with MemberSpace, you may contact MemberSpace directly under Clause 20.
4.5. Where the Community is the Data Fiduciary, the Community and its Admin are separately responsible, under the DPDP Act, for:
4.5.1. establishing a valid lawful basis for collecting and processing each category of personal data of its members;
4.5.2. giving its Members the itemised notice required under Section 5 of the DPDP Act;
4.5.3. honouring Members' rights under Sections 11–14; and
4.5.4. ensuring role-based access to another Member's data is limited to what is necessary for the Community's governance purposes, consistent with Terms of Service Clause 3.4 (Administrator Responsibility).
This Policy describes MemberSpace's own practices and does not, and cannot, discharge a community’s independent obligations as Data Fiduciary.
5. PERSONAL DATA WE COLLECT AND WHY:
5.1. Section 5 of the DPDP Act requires that a Data Fiduciary give a Data Principal an itemized notice describing the personal data collected and the specific purpose of processing a generic, catch-all description does not satisfy this requirement. The table below sets out that itemised notice for the categories of personal data processed on the Platform.
5.2. We do not process personal data for any purpose other than those stated in the table above and elsewhere in this Policy. If MemberSpace intends to process personal data for a new purpose, it will provide the Data Principal for Community Data, the Community with notice of that new purpose and, where required, obtain fresh consent before doing so, in accordance with Section 8(2) of the DPDP Act.
5.3. MemberSpace does not track or collect a User's precise geolocation through the website or the mobile application.
6. SOURCES AND METHOD OF COLLECTION:
6.1. Personal data is collected:
6.1.1. directly from Users, through registration forms and in-app entries;
6.1.2. from Community Admins, who upload or enter data relating to their Members and Community in the Admin's capacity as Data Fiduciary for that data;
6.1.3. automatically, through cookies and similar technologies as described in our Cookie Policy; and
6.1.4. from our payment gateway and other Third-Party Services integrated with the Platform under Terms of Service Clause 10, which may share limited transaction-confirmation data such as payment status and a masked reference number, but not full card or bank credentials back with MemberSpace.
6.1.5. through the registration process described in Clause 5.2 below, which, for Assisted Registration, includes direct communication such as calls, meetings, or written correspondence with an Admin, management team, or authorised representative of a community.
6.2. MemberSpace offers two methods for a community to register for the Services, as further described in Terms of Service Clause 3.6, each of which is a distinct source and occasion of personal data collection:
6.2.1. Self-Service Registration for Small Communities. A Community's Admin may register directly through the "Register Society" page on the Platform, selecting the required number of Members/Units and the applicable subscription plan, and completing payment online. The personal data collected through this method is limited to the admin’s account and identity data, the selected plan and Member/Unit count, and payment-confirmation data from our payment gateway, each as described in the itemised notice in Clause 4.
6.2.2. Assisted Registration for Large Communities. For larger Communities with more complex requirements, onboarding may involve a discussion or meeting with the admin, management team, or other authorised representatives of the Community, following which MemberSpace issues an invoice for the subscription fee and any installation/setup fee. In addition to the data described in sub-clause (a), this method involves collecting the personal data of the individuals who participate in that discussion (such as their name, role, and contact details) and a record of the confirmed subscription requirements and scope of services, as reflected in the "Registration & onboarding data" row of the itemised notice in Clause 4.
6.2.3. Consent and notice are given at the point of collection under either method, as described in Clause 6.2.
7. THE CONSENT NOTICE AND HOW CONSENT WORKS:
7.1. Where MemberSpace or a Community relies on consent as the lawful basis for processing, that consent must, under Section 6 of the DPDP Act, be free, specific, informed, unconditional, unambiguous, and given through a clear affirmative action, limited to the personal data necessary for the specified purpose. Silence, pre-ticked boxes, or inactivity do not constitute valid consent the same affirmative-action standard that Terms of Service applies to a community’s opt-in to auto-renewal.
7.2. Wherever consent is relied upon, Users are presented with a notice, in clear and plain language, at the point of collection, describing:
7.3. the personal data being collected;
7.4. the specific purpose for which it will be processed;
7.5. the manner in which the Data Principal may exercise their rights under Sections 11 and 13 of the DPDP Act; and
7.6. the manner in which a complaint may be made to the Data Protection Board, as required under Section 5 of the DPDP Act.
7.7. The consent notice and this Policy are currently made available in English.
7.8. MemberSpace does not, as of the date of this Policy, use or route consents through a registered Consent Manager. This Policy will be updated if those changes.
7.9. Where personal data is processed based on consent, Users may withdraw their consent at any time by updating their privacy preferences within the MemberSpace app or by contacting their community administrator or MemberSpace Support. In accordance with Section 6(4) of the DPDP Act, the ease of withdrawing consent shall be comparable to the ease with which it was given. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal, and may limit access to certain features or Services that depend on the withdrawn data, but will not, by itself, affect any other lawful processing MemberSpace or the Community is entitled to undertake.
7.10. Save to the extent that providing certain personal data is optional and clearly marked as such, refusal or withdrawal of consent for data that is necessary for the Platform's core functionality (for example, an Admin's login credentials) will mean that the relevant Service, or that part of it, cannot be provided.
8. LAWFUL BASIS FOR PROCESSING:
8.1. We or, in respect of Community Data, the relevant Community as Data Fiduciary process personal data only where at least one of the following lawful bases under the DPDP Act applies:
7.1.1 Consent: the Data Principal has given free, specific, informed, unconditional, and unambiguous consent, as described in Clause 6; or
7.1.2 Certain Legitimate Uses: processing is undertaken for one of the specific legitimate uses recognised under the DPDP Act, without requiring separate consent, including as relevant to the Platform:
7.1.2.1 where the Data Principal has voluntarily provided their personal data for a specified purpose and has not indicated that they do not consent to its use;
7.1.2.2 compliance with any judgment, decree, order, or any law for the time being in force in India;
7.1.2.3 responding to a medical emergency involving a threat to the life or immediate health of the Data Principal or another individual; or (iv) taking measures to ensure safety of, or provide assistance during, any disaster or breakdown of public order.
8.2. MemberSpace does not rely on the "legitimate use" ground under Section 7 as a substitute for consent in circumstances where the DPDP Act requires consent; it is used only for the narrow set of purposes the Act itself recognises as not requiring consent.
9. CHILDREN AND PERSONS WITH DISABILITY HAVING A LAWFUL GUARDIAN:
9.1. The Platform is intended for use by adult Admins and Members. Where a Community's records such as a household directory include personal data relating to a child a person under 18 years of age, per Section 9 and the definitions under the DPDP Act or a person with a disability who has a lawful guardian, such data may only be entered by, or with the verifiable consent of, the parent or lawful guardian, and the Community/Admin, as Data Fiduciary for that data, is responsible for obtaining and being able to demonstrate such consent before uploading such data. Pending Section 9 of the DPDP Act being notified into force, this position is additionally grounded in the general principle that a minor cannot themselves validly contract or consent under the Indian Contract Act, 1872, and in the consent standard applicable to sensitive personal data under the SPDI Rules.
9.2. In accordance with Section 9 of the DPDP Act, MemberSpace does not undertake tracking or behavioural monitoring of children, does not carry out targeted advertising directed at children, and does not process children's personal data in any manner that is likely to cause any detrimental effect on the well-being of a child.
9.3. The Platform does not independently verify a Data Principal's age or guardianship status; this is currently a matter left to the entering Community/Admin's own diligence.
10.RIGHTS OF DATA PRINCIPALS:
10.1. You have the right to obtain a summary of the personal data being processed about you and the processing activities undertaken with respect to such data, the identities of Data Fiduciaries and Data Processors with whom your data has been shared along with a description of the data so shared, and any other information prescribed under the DPDP Rules.
10.2. You have the right to correction, completion, updating, and erasure of your personal data. On receiving such a request, we (or, for Community Data, the relevant Community) will correct inaccurate or misleading data, complete incomplete data, update data, and erase data that is no longer necessary for the purpose for which it was processed, unless retention is required for a legal purpose.
10.3. You have the right to have a readily available means of registering a grievance with us regarding any act or omission relating to your personal data or the exercise of your rights, as further described in Clause 20.
10.4. You have the right to nominate, in the manner prescribed under the DPDP Rules, another individual who shall, in the event of your death or incapacity, exercise your rights under the DPDP Act on your behalf. Where the Platform enables this feature, you may register such a nomination within the MemberSpace app; where it does not yet do so, you may register a nomination by writing to MemberSpace Support, and we will record it against your account.
10.5. Users may exercise these rights by using the MemberSpace app, or by contacting their community administrator where the Community is the Data Fiduciary for the relevant data or MemberSpace Support at abhilash@rishmathi.com. We will acknowledge a request within 48 forty-eight hours of receipt, and will use reasonable efforts to resolve it as expeditiously as possible, and in any event within the timelines prescribed under the DPDP Act and the DPDP Rules.
10.6. Where the personal data in question is Community Data for which the Community is the Data Fiduciary, MemberSpace will support the Community, as its Data Processor, in responding to the request including by providing technical means to retrieve, correct, or erase the data, but the Community remains legally responsible for the substantive response to the Data Principal.
11.DUTIES OF DATA PRINCIPALS:
11.1. Section 15 of the DPDP Act also places certain duties on Data Principals, and, by extension, on Users of the Platform. In particular, Users must:
11.1.1 comply with the provisions of all applicable laws while exercising rights under the DPDP Act.
11.1.2 ensure they do not impersonate another person while providing personal data for a specified purpose.
11.1.3 ensure they do not suppress any material information while providing personal data for any document, unique identifier, proof of identity, or proof of address issued by the State or any of its instrumentalities.
11.1.4 ensure they do not register a false or frivolous grievance or complaint with MemberSpace, a community, or the Data Protection Board; and
11.1.5 furnish only such information as is verifiably authentic while exercising the right to correction or erasure under Section 12.
11.2. A breach of these duties may, independent of any liability under the DPDP Act itself, constitute a breach of the Acceptable Use Policy under Terms of Service Clause 8.
12.SHARING AND DISCLOSURE OF PERSONAL DATA:
12.1. Consistent with Terms of Service Clause 10 (Third-Party Services and Integrations), we share personal data with the following named Third-Party Services and other categories of recipients:
12.1.1 MSG91 operated by Walkover Web Solutions Pvt Ltd) for sending SMS notifications, including OTPs and renewal reminders (including the pre-renewal reminder required under Terms of Service Clause 6.5.2(b).
12.1.2 Zoho ZeptoMail operated by Zoho Corporation for sending transactional email notifications and support communications.
12.1.3 Razorpay operated by Razorpay Software Private Limited for processing subscription fee payments, installation/setup fee payments, and donation/expense contributions made through the Sub-Community modules; card and bank credentials are collected directly by Razorpay and are not stored by MemberSpace, consistent with Terms of Service.
12.1.4 Google Cloud Storage (operated by Google Asia Pacific Pte. Ltd. or Google LLC) for hosting the Platform and storing Content and Personal Data, including uploaded documents and images.
12.1.5 Analytics Providers: for understanding Platform usage and improving the Services, as further described in our Cookie Policy.
12.1.6 other Users within the same Community, to the extent necessary for the Community's governance functions for example, a committee member viewing a voter list, or an Admin viewing a member’s contact details, subject to the role-based access controls described in Clause 15.
12.1.7 government authorities, courts, arbitral tribunals, or regulators, where required by law, or in connection with a legal process, subpoena, or governmental request, consistent with Terms of Service Clause 5.4 (Disputed Elections, Subpoenas and Record Production);
12.1.8 a successor entity in connection with a merger, acquisition, or sale of assets, subject to that entity being bound by materially equivalent privacy protections.
12.1.9 We do not sell, rent, or share personal data with any third party for that third party's own independent marketing purposes.
13.CROSS-BORDER TRANSFER OF PERSONAL DATA:
13.1. Section 16 of the DPDP Act permits the transfer of personal data outside India, save to any country or territory that the Central Government may, by notification, restrict. As of the date of this Policy, the Central Government has not issued a notification restricting transfer to any specific country under the DPDP Act; MemberSpace will monitor and comply with any such notification if and when issued. Pending Section 16's commencement, a cross-border transfer of sensitive personal data by MemberSpace is, as a matter of current law, governed by Rule 7 of the SPDI Rules, which permits such a transfer where necessary for performance of the lawful contract between MemberSpace and the Data Principal or Community, or where the Data Principal has consented, and, in either case, only to a transferee that maintains the same level of data protection provided for under the SPDI Rules.
13.2. MemberSpace processes and stores personal data on servers located in India. Where a Third-Party Service integrated with the Platform processes data on infrastructure located outside India, that transfer is undertaken subject to contractual safeguards requiring the Third-Party Service to maintain a standard of protection consistent with this Policy.
14. DATA RETENTION AND ERASURE:
14.1. We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, for so long as the relevant Community's subscription remains active, and thereafter for such further period as may be required to comply with our legal, regulatory, accounting, tax, or backup-retention obligations, after which the data is erased or anonymised, in accordance with Section 8(7) and 8(8) of the DPDP Act.
14.2. Where a Community ceases to use the Platform, its data including underlying Member personal data shall be made available for export during the Export Window described in Terms of Service Clause 15.4, after which it will be deleted from active systems in accordance with the retention schedule above; residual copies may persist in encrypted backups until those backups are, in the ordinary course, purged.
14.3. Where a Member requests erasure of their own personal data while their Community remains an active customer, MemberSpace will refer the request to the Community as Data Fiduciary for that data for instruction, save where MemberSpace independently controls the data in question, in which case MemberSpace will act on the request directly, subject to any data the Community is legally or contractually entitled to retain for its governance records.
15. SECURITY SAFEGUARDS:
15.1. MemberSpace implements reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, appropriate to the nature of the data processed, in accordance with Section 8(5) of the DPDP Act. Pending the DPDP Act's staged commencement (see Clause 3), these measures currently satisfy, and are maintained in accordance with, Rule 8 of the SPDI Rules, which requires reasonable security practices and procedures such as a documented information security programme (for example, one meeting the IS/ISO/IEC 27001 standard or a comparable standard) that is verified through periodic, independent audit.
15.2. Access to production Member data is restricted to authorised MemberSpace personnel who require it for platform operations, technical support, security, or maintenance. Access is granted on a need-to-know basis, protected by role-based access controls, authentication, and audit logging, and is reviewed periodically to ensure compliance with our security and privacy practices.
15.3. Community Admins are separately responsible for managing role-based permissions within their own Community's account, so that access to another Member's personal data is limited to committee members, treasurers, or Admins who require it, in accordance with Terms of Service Clause 3.4.
16.PERSONAL DATA BREACH:
16.1. In the event of a personal data breach, MemberSpace will follow its internal incident-response process to promptly assess, contain, and remediate the breach.
16.2. Where required under Section 8(6) of the DPDP Act and the DPDP Rules, MemberSpace will notify the Data Protection Board of India and the affected Data Principals or, where the affected data is Community Data, the relevant Community, who shall in turn be responsible for notifying its affected Members, with MemberSpace's reasonable assistance in the form and manner and within the time prescribed under the DPDP Rules. Independently of, and unaffected by, the DPDP Act's staged commencement, MemberSpace will, where the incident falls within a reportable category, report a cyber security incident to CERT-In within 6 (six) hours of becoming aware of it, in accordance with Section 70B of the Information Technology Act, 2000 and the CERT-In Cyber Security Directions, 2022.
17.SIGNIFICANT DATA FIDUCIARY:
17.1. The client's checklist response indicates that MemberSpace expects to be classified, or anticipates being classified, as a Significant Data Fiduciary. We note, for accuracy, that this classification is made by the Central Government by notification, having regard to the volume and sensitivity of personal data processed, risk to Data Principals' rights, potential impact on the sovereignty and integrity of India, and other prescribed factors it is not a status a Data Fiduciary elects for itself. This Policy therefore records MemberSpace's voluntary, anticipatory commitment to Significant Data Fiduciary-level obligations, without representing that MemberSpace has in fact been so notified. For the avoidance of doubt, and consistent with Clause 3, the Significant Data Fiduciary obligations described in this Clause are not yet operative as a matter of law and are assumed by MemberSpace voluntarily and in advance of the DPDP Act's Significant Data Fiduciary provisions being notified into force.
17.2. In anticipation of, and in the event of, such classification, MemberSpace will:
17.2.1. appoint a Data Protection Officer based in India, who shall represent MemberSpace for the purposes of the DPDP Act and shall be responsible to MemberSpace's Board of Directors or equivalent governing body.
17.2.2. appoint an independent data auditor and carry out periodic data audits; and
17.2.3. carry out Data Protection Impact Assessments for processing activities that pose a significant risk to Data Principals.
18.AUTOMATED PROCESSING:
As of the date of this Policy, MemberSpace does not deploy any automated decision-making, profiling, or artificial-intelligence-driven feature that produces a legal or similarly significant effect on a Data Principal, and does not use personal data to train or fine-tune any machine-learning model.
19.COOKIES:
The Platform uses cookies and similar technologies as described in our separate Cookie Policy, which forms part of the itemised notice under this Policy by reference.
20.CHANGES TO THIS POLICY:
We may update this Policy from time to time to reflect changes in our practices, the Platform, or applicable law. Material changes will be notified to Community Admins by email and/or a notice on the Platform, consistent with the notice mechanism in Terms of Service Clause 20, and the "Effective Date" at the top of this Policy will be updated accordingly.
21.GRIEVANCE OFFICER, DATA PROTECTION CONTACT, AND YOUR RIGHT TO APPROACH THE BOARD:
21.1. For any questions about this Policy, or to exercise your rights as a Data Principal, please contact:
Name: Abhilash Gampa [confirm]
Designation: Grievance Officer
Email: abhilash@rishmathi.com
Phone: +91 80190 91218
Address: Villa 224, Kavuri Forest Nest, Lemoor Road, Mahesharam, Hyderabad, Telangana – 501359, India
21.2. We aim to acknowledge a grievance within 48 (forty-eight) hours of receipt, and will use reasonable efforts to resolve it as expeditiously as possible and in any event within the timelines prescribed under the DPDP Act and DPDP Rules.
21.3. Right to Approach the Data Protection Board. If you are not satisfied with our response, or if we fail to respond within a reasonable time, you have the right under Section 13(3) of the DPDP Act to file a complaint with the Data Protection Board of India.