Privacy policy
What Griho collects, why, where it is stored, who can see it and how long we keep it. Tenant NID numbers are encrypted and every reveal is logged.
This is a draft under legal review. The final version will be dated when it takes effect.
This policy explains what information Griho handles, why, where it is kept, who can see it, and how long we keep it. Griho is run by ceKapsys, Shaptak Square, Dhanmondi 27, Dhaka 1209, Bangladesh. Questions go to sendmail@cekapsys.com.
Two kinds of people
Griho holds information about two groups:
- Owners, and anyone they add to their account, who sign up and use Griho.
- Tenants and their family members, whose details owners enter to manage a lease. Tenants don't sign up. The owner decides what to record and is responsible for having a good reason to hold it and for telling the tenant.
What we collect
About owners
- name, phone number and email address
- password (stored only as a one-way hash) and, if enabled, two-factor sign-in settings
- language, digit and time-zone preferences
- plan, payments to us and billing history
- sign-in records: date, time, IP address and browser, used for security
Entered by owners, about their flats and tenants
- flats and buildings: names, addresses, rent and photos
- tenants: name, phone and WhatsApp numbers, email, occupation, emergency contact and receipt language
- national ID (NID) numbers and family members' phone numbers, encrypted
- leases, rent, payments, receipts, bills, expenses and their receipt photos, agreements and move-out settlements
- messages Griho sends to tenants on the owner's behalf, and their delivery status
Why we use it
- to run the service: create rent months, record payments, number and send receipts and reminders, and produce reports
- to keep accounts secure: sign-in, rate limits, detecting misuse, and the audit log
- to bill for paid plans and handle support requests
- to meet legal obligations
We don't sell personal information, and we don't use tenants' details for advertising.
How sensitive details are protected
- NID numbers and family phone numbers are encrypted in the database with a key kept separately from it. They are hidden on screen and shown only when someone with permission chooses to reveal one. Each reveal is recorded.
- The database keeps every account's records apart. One owner's data can't be read by another account.
- Photos and documents are stored privately. Links to them expire after five minutes. Location and camera details are removed from photos when they're uploaded.
- Our staff use a separate console with two-factor sign-in. Support staff see masked details, must give a reason to open an account, and each visit is logged.
Who else handles data
We use a small number of service providers to run Griho. Each receives only what it needs:
- Database and file hosting: our cloud database and storage providers
- Email: our email delivery provider sends receipts and account emails
- WhatsApp: Meta's WhatsApp Business platform delivers messages on paid plans
- SMS: a Bangladeshi SMS gateway sends sign-in codes
- Payments: SSLCommerz and bKash process payments for plans; we don't see or store card numbers
We may disclose information when Bangladeshi law requires it, and we will tell the affected owner when the law allows.
Cookies and storage on your device
Griho uses a sign-in cookie to keep you signed in, a cookie that remembers your language, and storage on your device for the app's offline features, such as rent logged without a connection waiting to sync. We don't use advertising cookies.
How long we keep it
- Account and rent records are kept while the account is open, so your history stays complete.
- Deleted items are removed from lists and totals but kept in the history, so records can't silently disappear.
- The audit log (sign-ins, role changes, reveals of sensitive details, payments, exports and deletions) is kept for two years.
- When an account is closed, we delete or anonymise its data, except what we must keep by law.
Your choices and rights
Owners can see, correct and download their records at any time: receipts and settlements as PDF on every plan, and reports as PDF or Excel on paid plans. To close your account or ask what we hold about you, email us.
Tenants who want to know what an owner has recorded about them should ask the owner first, since the owner controls those records. If that doesn't resolve it, email us and we'll help.
If something goes wrong
If a security incident affects personal information, we will tell affected owners within 72 hours of confirming it, with what happened and what we're doing about it.
Changes
We'll post any change to this policy on this page with a new date, and tell owners by email about significant changes.