Privacy Policy

01 Who we are

MoMPA HOME Pvt Ltd ("MoMPA", "we") runs mompahome.com and the MoMPA Home app. We connect people looking for a PG, hostel or flat in Greater Noida with the organizations (PG owners and their teams) that run those properties, and we give residents and teams the tools to manage a stay — check-in, rent, attendance, incidents, electricity and the rest.

For a property you book or live in, the organization that runs that property is responsible for the stay. MoMPA is the platform that holds the data for both of you.

02 What we collect

03 Why we collect it

• Identity and safety. A PG must know who lives there. Aadhaar, selfie and emergency contact exist so the property team and, if ever needed, a parent or the police can identify a resident.
• Running the stay. Rent, receipts, attendance, incidents and electricity are the record of your stay. Money rows are never rewritten — a correction is a new entry, so your statement is always reproducible.
• Night safety. Night attendance and out-requests exist so the team knows who is in the building at night and a parent can be told when a resident is late or out — only for the properties that switch this on.
• Showing you listings. Browsing data tells us which areas and budgets people look for; it is never sold and never used for outside advertising.
• Legal duties. Tenant records a PG must keep under local rules, and tax records for payments.

04 Who sees it

• The organization running your property — its owner and the staff the owner has given that specific right (every sensitive screen has its own grant: Aadhaar review, finance, night attendance, data retention and so on). Staff of other organizations never see your data; the platform isolates every organization.
• MoMPA's own team — platform staff see only what the admin assigns them, and every opening of a sensitive record is logged.
• A parent or guardian — only the night-safety messages you or the property set up (late / out / back), never your documents.
• Service providers that carry messages for us: SMS / WhatsApp for OTPs and alerts, push-notification services (Google, Apple, Mozilla), our hosting provider. They see what is needed to deliver the message and nothing more. OTPs, passwords and Aadhaar numbers are never sent over WhatsApp.
• Nobody else. We do not sell or rent personal data. We disclose it to authorities only when the law requires it, and we tell the property owner when we do.

05 How long we keep it

• Stay records (check-in, rent, receipts, incidents): for the stay plus the period the organization and tax rules require. Money records are kept, not deleted.
• Walk-in visitors who never booked, staff applicants who were never verified, the WhatsApp message log: the organization sets its own period (30 days to 2 years; MoMPA sets the platform default). After that the files are deleted automatically and only a "Deleted" shell remains so counts stay right.
• Raw IP addresses from browsing: kept at most 180 days, then reduced to a non-identifying form.
• A resident marked inactive / deleted: personal fields are erased on the owner's confirmation; the money ledger keeps a nameless entry.
• Push subscriptions: removed when you log out or the device stops accepting messages.

06 How it is protected

• Aadhaar numbers are encrypted at rest; everywhere except the authorised review screen they appear masked.
• Documents and selfies live outside the public web folder and are streamed only after a permission check.
• Passwords are stored as one-way hashes; OTPs expire in minutes and are rate-limited; sensitive actions (approvals, finance, deletions) ask for a PIN again.
• Every organization's data is separated at the query level; a signed-in person only reaches the organizations they belong to, and a suspended organization loses access at once.
• Sensitive pages are sent with no-store so a shared phone's back button does not show them; security headers and a content policy limit what can run on a page.
• Changes to money, roles and documents are logged with who, when and from where.

07 Your choices

• See and correct. Your profile and stay details are on your dashboard; a change to rent, dates or room goes through the property team's approval so both sides agree.
• Download. Receipts and your statement can be downloaded any time.
• Delete. Ask the property team or MoMPA to erase your personal data once the stay has ended; records the law requires (payments, tax) stay in nameless form.
• Notifications. Turn push alerts off in the app or your phone's settings; OTP and safety messages still arrive by SMS / WhatsApp.
• Night-safety sharing with a parent is set up by you or the property and can be withdrawn by telling the property team.

08 Cookies & the app

We use a session cookie (keeps you signed in), a device cookie (remembers this phone so you are not asked for OTP every time; it is never your identity on its own), a CSRF token (blocks forged requests) and a small set of preferences. No third-party advertising cookies. The installed app stores the same things plus an offline copy of the pages you opened last, on your device only.

09 Contact & changes

Privacy questions or requests: WhatsApp +91 99905 98887 or the "Report a problem" option in the app. We answer within 7 days.

When this policy changes we update the date at the top; a change that affects what we collect or who sees it is announced inside the app before it applies.