Privacy Policy for the Rest-isle App
Effective Date: 2 May 2026
Last Updated: 2 May 2026
This Privacy Policy describes how the Rest-isle mobile application (“the App”) handles personal data of its users. The App is operated by Rest-isle (“we”, “us”, “our”), a monthly accommodation service located in Marathahalli, Bangalore, India.
The App is intended for use by Rest-isle’s residents, gate staff, and authorised administrators only. It is not a public-facing service.
When you sign in to the App, we collect:
- Your email address
- A password (stored only as a one-way cryptographic hash; we never see your actual password)
- Your full name (when provided by you or your property administrator)
- Your phone number (optional)
- Your role within Rest-isle (resident, gate staff, property admin, or super admin)
- The property and suite to which you are assigned
- Parcel records — when a parcel is logged at the gate, we record the suite it is for, the carrier, recipient name, tracking number, any notes, the time it was received, and the gate staff member who logged it.
- Photographs of parcels — gate staff may attach a photograph of the parcel package as a record. These photographs may show the outside of a parcel (label, packaging) and are visible only to gate staff at your property and to the residents of the destination suite.
- Collection records — when a resident marks a parcel as collected, we record the time and the resident’s identity for audit purposes.
- An Expo push notification token — a long random string that allows our system to deliver notifications to your specific device. This token does not contain your name, email, or any personal identifier.
- Device model and operating system version — used to diagnose issues and to confirm push tokens remain active.
- IP address and approximate location — captured by our hosting provider (Supabase) for security and abuse prevention.
- Server-side timestamps — for audit logs.
We use the information described above to:
- Authenticate you and control access to data within your property
- Display parcels addressed to your suite in your inbox
- Send push notifications to your device when a parcel arrives for you
- Maintain an audit trail of who logged each parcel and who collected it
- Respond to your support requests and resolve issues
- Improve the App’s reliability and performance
We do not use your information for advertising, behavioural profiling, or sale to third parties.
We share your information only with the following service providers, each of whom is bound by their own privacy commitments:
- Supabase Inc. — provides our database, authentication, and file storage. Data is hosted in Mumbai, India (ap-south-1) in compliance with India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
- Expo (Exponent, Inc.) — operates the push notification relay service that forwards messages to Apple and Google.
- Apple Inc. (for iPhone users) — delivers push notifications via the Apple Push Notification service.
- Google LLC (for Android users) — delivers push notifications via Firebase Cloud Messaging.
We may also disclose information if required by law, valid court order, or to protect the safety of users.
4. Data Storage, Location, and Security
- Storage location: India (Mumbai region). Personal data of Rest-isle users does not leave Indian data centres in normal operation.
- Encryption in transit: All data exchanged between the App and our servers is encrypted using TLS (HTTPS).
- Encryption at rest: Database storage is encrypted at rest by our cloud provider.
- Access control: Database access is restricted by per-user, per-property Row-Level Security policies. Staff at one property cannot access data of any other property.
- Passwords: Stored only as one-way hashes; not recoverable in plaintext.
While we apply industry-standard security practices, no method of electronic storage is completely secure. We cannot guarantee absolute security.
5. Data Retention
- Active account data: retained while you have an active account.
- Parcel records: retained for 24 months from the date of collection, to support audit and dispute resolution.
- Parcel photographs: retained for 6 months from the date the parcel is marked collected, then deleted.
- Push notification tokens: deleted automatically if the device has not been active for 90 days.
- Audit logs: retained for 36 months as required by reasonable business practice.
If you close your account, we delete or anonymise your personal data within 90 days, except where retention is required by law.
6. Your Rights
Under the DPDP Act and similar applicable laws, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or outdated data
- Delete your account and your personal data (subject to lawful retention requirements)
- Withdraw consent for push notifications at any time, via your device’s notification settings or by contacting us
- Object to specific uses of your data
- Lodge a complaint with the Data Protection Board of India
To exercise any of these rights, email hello@rest-isle.com with your request. We will respond within 30 days.
7. Children’s Privacy
Rest-isle is rented monthly to adults (women and couples, 18 years or older). The App is not intended for use by, and we do not knowingly collect personal data from, anyone under the age of 18. If you believe a child has provided personal data through the App, contact us and we will delete it.
8. Push Notifications
We send push notifications to inform you when a parcel has been logged for your suite. You may disable push notifications at any time:
- iPhone: Settings → Notifications → Rest-isle → Allow Notifications (off)
- Android: Settings → Apps → Rest-isle → Notifications → off
Disabling push notifications will not affect your ability to use other features of the App.
9. Permissions Used by the App
- Camera (gate staff only): to photograph parcels at the gate.
- Photo Library (gate staff only): to attach existing photographs of parcels.
- Notifications: to deliver parcel alerts.
These permissions are requested when first needed and may be revoked at any time in your device settings.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to you via email or an in-app notification at least 14 days before they take effect. The “Last Updated” date at the top of this document indicates when the policy was last revised.
If you have any questions about this Privacy Policy, or to exercise your rights described above, please contact:
Rest-isle
Marathahalli, Outer Ring Road
Bangalore, Karnataka, India
Email: hello@rest-isle.com
12. Grievance Officer (DPDP Act 2023)
In accordance with the requirements of the DPDP Act 2023, our Grievance Officer can be contacted at:
Email: hello@rest-isle.com
Subject line: “Grievance — Rest-isle App”
We will acknowledge your grievance within 7 working days and respond substantively within 30 days.