Privacy Policy

Welcome to the Privacy Policy for Nexbuild Technologies. We are committed to protecting personal privacy and ensuring transparency regarding how data is handled across our mobile applications.

Our software platform facilitates security communication, gatekeeper operations, visitor approval workflows, and household records between gated residential housing societies, flat residents, and on-duty security gate personnel.

This Privacy Policy governs your use of our two dedicated Android applications published on the Google Play Store:

• NexGate Resident App — Designed for apartment owners and tenants residing within a gated society.
• Nexguard App — Designed for security guards operating on-duty gate checkpoints and kiosks.

This Privacy Policy applies equally to the following two distinct Android applications developed and maintained by us. While both applications communicate with our central secure backend, their features, required permissions, and user categories differ as detailed below.

We collect personal and operational data necessary to authenticate users, facilitate gate entry approvals, and maintain accurate building security records. The categories of data collected depend upon whether you are using the Resident App or the Guard App.

Data Collection Matrix

Android Permissions Disclosed

The table below documents every Android runtime and install-time permission declared in the AndroidManifest.xml of both applications, along with its specific functional justification:

Detailed Breakdown by Application

A. NexGate Resident App

• Resident Profile Information: When your account is provisioned or when you register, we collect your name, mobile phone number, assigned housing society, building wing, floor, and flat number.
• Household Records (User-Submitted): Residents may voluntarily add household family members (name, relation such as spouse/child/parent, and optional phone number) and vehicle details (vehicle number, car/two-wheeler, brand, color) to facilitate authorized society access.
• Visitor Decisions: Timestamped records of your responses (approval, rejection, or expiry) to incoming gate visitor requests.

B. Nexguard App

• Guard Credentials: Guard Name, Guard ID or registered mobile phone number, 4-digit security PIN (stored strictly in encrypted/hashed form), assigned gate name, and duty shift.
• Visitor Log Records (Collected at Gate): When a visitor arrives at the society entrance, the guard logs the visitor's name, mobile number, visit purpose (Guest, Delivery, Cab, Maintenance, or Service), delivery company name (if applicable), vehicle number (if applicable), and destination flat.
• Visitor Check-in Photo: The guard captures a single still photograph of the arriving visitor for visual identification by the destination resident.

When you interact with our applications, our servers automatically collect minimal technical metadata to maintain operational security, prevent unauthorized access, and ensure server uptime:

• IP Address & Network Status: Recorded in backend security audit logs alongside administrative actions and visitor request transactions.
• Session Authentication Tokens: Cryptographically signed JSON Web Tokens (JWT) generated upon successful authentication and stored locally in private device application storage (`SharedPreferences`).
• Timestamps: Exact timestamps of visitor request creation, approval responses, gate entry, and gate exit.
• Device Push Notification Token: An alphanumeric Firebase Cloud Messaging (FCM) device registration token generated by Google Play Services to route push alerts to your specific device.

We use the data collected strictly for functional, security, and administrative purposes in connection with the operation of your residential society:

• Authenticating Authorized Users: Verifying resident mobile numbers via OTP and verifying guard logins via Guard ID and hashed PIN.
• Gate Access Control: Notifying residents when an unexpected or expected visitor arrives at the perimeter gate, showing the visitor's name, purpose, and gate photo for verification.
• Security Audit Trails: Providing society administrators and residents with a reliable, timestamped history of gate entries, exits, deliveries, and vehicle movements for community safety.
• Household Records Management: Enabling residents to maintain their own list of family members and authorized parking vehicles.
• System Communications: Sending essential push notifications regarding visitor requests awaiting approval and critical society administrative announcements.

Our applications use role-based authentication mechanisms tailored to each user category:

Resident Authentication (NexGate Resident)

• Residents register their mobile phone number with the society administration or submit an in-app registration request subject to administrator verification.
• Authentication is passwordless: residents log in by receiving and verifying a secure One-Time Password (OTP) sent to their registered mobile phone number.
• Upon successful OTP verification, a secure session token (JWT) is issued and stored in private device storage.

Guard Authentication (Nexguard)

• Security guards are provisioned directly by society management or security agencies with a unique Guard ID or registered phone number.
• Guards authenticate using a 4-digit security PIN. PINs are salted and hashed using industry-standard bcrypt algorithms on the backend. PINs are never stored in plaintext.
• Guards can change their 4-digit PIN directly within the Guard App after verifying their existing PIN.

We treat camera access and photographic data with the highest level of care. Our two applications have strictly defined camera interactions:

Nexguard App (Camera Access Disclosed)

• Permission Requested: android.permission.CAMERA
• Why the Camera is Used: The camera is used exclusively to take a front-facing verification photo of a visitor arriving at the society gate during the check-in workflow.
• When the Camera is Accessed: The camera is activated only when the on-duty guard initiates a new visitor entry and navigates to the capture screen. The camera is never accessed in the background, when the screen is off, or outside the visitor entry workflow.
• No Audio Recording: Audio recording is explicitly disabled (enableAudio: false). The app does not record or transmit sound.
• Photo Transmission: The captured image is transmitted over encrypted HTTPS/TLS directly to our backend service and stored in our secure visitor photo repository (Cloudinary).
• Intended Recipient: The visitor photo is displayed exclusively to the resident of the destination flat so they can visually confirm the visitor's identity before granting or denying gate access.

NexGate Resident App (Zero Camera Access)

• The NexGate Resident App does NOT request or require android.permission.CAMERA.
• Residents cannot take photos through the resident app. Residents only receive and view the visitor security photograph captured by the guard at the entrance gate.
• The resident app caches visitor photos temporarily in sandboxed app memory using cached_network_image for fast rendering, which is purged in accordance with standard operating system cache management.

Neither android.permission.ACCESS_FINE_LOCATION nor android.permission.ACCESS_COARSE_LOCATION is declared in the Android application manifests of either app. Society gate locations and apartment units are established administratively within the database, not via device GPS sensors.

The NexGate Resident App requests the android.permission.POST_NOTIFICATIONS permission (on Android 13 and above) to deliver timely gate alerts:

• Incoming Visitor Approvals: Real-time alerts when a guest, delivery partner, or cab arrives at the security gate, allowing the resident to approve or deny entry immediately.
• Visitor Decision Confirmations: Confirmation alerts regarding visitor entry or exit timestamps.
• Society Notices: Important administrative broadcasts or emergency announcements issued by the resident's housing society committee.

Push Token Handling: To deliver these notifications, the resident's device obtains an anonymized Firebase Cloud Messaging (FCM) registration token from Google Play Services. This token is transmitted over HTTPS to our backend and stored in our secure database linked to the resident's user account. It is used solely to route incoming gate alerts to the resident's physical device. You may disable notifications at any time via Android System Settings.

We do NOT sell, rent, monetize, or trade personal data to third parties, data brokers, or advertisers under any circumstances.

Information is disclosed only in the following strictly limited scenarios:

• Within Your Residential Community: When a visitor arrives at the gate, their name, purpose, vehicle number, and photograph are displayed to the resident of the destination flat. Similarly, flat numbers and resident names are visible to authorized on-duty security guards to confirm the correct flat is contacted.
• Society Administration: Authorized society administrators have access to society-level visitor entry logs, registered flat directories, and parking records for safety, audit, and community management purposes.
• Infrastructure Service Providers: We share data with trusted cloud infrastructure providers who assist in operating our services under strict confidentiality and security obligations (detailed in Section 11).
• Legal Compliance: We may disclose information if required to do so by applicable law, court order, governmental inquiry, or to protect the vital security and physical safety of residents and premises.

Our applications utilize a minimal set of established third-party cloud infrastructure providers strictly necessary to perform core functional workflows:

These service providers are bound by data processing terms and are prohibited from retaining, sharing, or using your personal data for any purpose other than providing services to us.

We implement reasonable technical and organizational security measures designed to safeguard personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted between our mobile applications, backend APIs, and cloud services is encrypted using Transport Layer Security (TLS/HTTPS).
• Credential Protection: Guard PINs and administrative passwords are cryptographic hashes generated using salted bcrypt. Plaintext credentials are never saved in the database.
• Session Security: API requests require cryptographically signed JSON Web Tokens (JWT) with defined expiration periods.
• Role-Based Access Control: Access to backend endpoints is strictly partitioned by user role (RESIDENT, GUARD, ADMIN). Guards cannot access resident management features, and residents cannot alter gate logs.
• Database Hardening: Relational database queries use parameterized SQL inputs to prevent SQL injection vulnerabilities.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, provide our services, and satisfy community security requirements:

• Resident Profiles & Household Records: Maintained for the duration of the resident's active residency in the registered society. When a resident moves out or requests account deletion, their profile, family records, and vehicle tags are deleted or archived by the society administrator.
• Gate Security Visitor Logs & Photos: Visitor records (names, timestamps, and check-in photos) are retained for a standard operational period (typically between 30 to 180 days, depending upon the housing society's security bylaws and local regulatory requirements), after which records and photos are systematically purged.
• Security Audit Trails: Access logs and critical security event records are retained in accordance with applicable statutory and security requirements.

In compliance with Google Play Store User Data policies, we provide transparent mechanisms for users to request the deletion of their accounts and associated personal data.

In-App Data Management (NexGate Resident App)

Residents can directly delete specific personal records inside the NexGate Resident App without contacting support:

• Delete Family Members: Navigate to Profile & Settings → Household Family Members and tap the trash/delete icon next to any registered family member to immediately remove their record from our database.
• Delete Vehicles: Navigate to Profile & Settings → Registered Vehicles and tap the delete icon next to any vehicle to immediately unregister that vehicle.

Guard Accounts (Nexguard App)

Guard accounts are institutional credentials created, assigned, and managed by society management or authorized security agencies. When a security guard concludes their assignment, the society administrator deactivates or permanently deletes their account through the administrative management dashboard.

Our applications are general-purpose community management tools designed for adult apartment residents, property owners, and adult security personnel. They are not directed to children under the age of 13 (or under 16/18 where applicable by local law).

We do not knowingly collect personal data directly from children under 13. While adult residents may choose to list family members (such as dependents) in their household section for apartment access purposes, such data is provided solely by the adult resident and is not used for profiling or marketing.

If you believe that a child under 13 has provided personal data directly to us without parental consent, please contact us at
helpdesk@nex-build.com, and we will take immediate steps to remove such information from our records.

Depending upon your jurisdiction and local privacy regulations, you may hold specific rights concerning your personal data:

• Right to Access: You can review your profile details, registered flat information, family members, vehicles, and visitor history directly within the mobile application.
• Right to Rectification: You can update or correct erroneous profile or household details directly within the app or by requesting your society administrator to update your flat assignment.
• Right to Erasure: You have the right to request deletion of your account and personal data as described in Section 14.
• Right to Restrict Notifications: You can manage or disable push notification permissions at any time through your Android device settings.
• Right to Withdraw Consent: Where data processing is based on consent, you may withdraw your consent at any time by ceasing use of the application and requesting account deletion.

We may periodically update this Privacy Policy to reflect modifications to our applications, changes in legal or regulatory obligations, or updates to Google Play Store developer policies.

When revisions occur, the updated policy will be posted on this page with a revised "Last Updated" date at the top. For significant changes that materially impact your privacy rights, we will provide additional notice through the applications or via society administrative channels. We encourage you to review this policy periodically.

If you have questions, feedback, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our team: