Privacy notice
What we hold
For operators: your name, contact details, your properties and your billing history. For residents: what your operator collects during onboarding, which usually includes a CNIC and a photograph. For people searching for a place: your name, email, saved places, applications and enquiries.
Why we hold it
To run the service you asked for, to bill you, and to meet a legal obligation where one applies. We do not sell personal data and we do not use it to train models.
The mobile app
The BedShift app for Android and iOS is the same service on a phone. It carries no analytics or advertising SDK and no tracker of any kind. Each thing below is collected only when you use the feature that needs it, and the app asks the phone for permission first where the phone requires it.
Push notifications
If you allow notifications, the app registers a Firebase Cloud Messaging token with our servers, with the device make, model and operating system version, so that notices, reminders and messages can be delivered to that phone. Turning notifications off in the phone settings stops delivery. Signing out removes the token from our servers.
Camera and photos
The camera opens only when you tap a control that needs it: photographing a document during onboarding, adding a listing photo, or scanning a gate QR code. QR codes are decoded on the phone and never uploaded. Photos and documents you submit are stored with your operator's records, in the same place as the ones collected on the web.
Fingerprint and face unlock
Biometric unlock is optional. The phone's operating system checks your fingerprint or face and tells the app only yes or no. No biometric data reaches the app or our servers.
Device identifiers
The app makes up a random identifier when it is installed and sends it with each request, so that a session can be tied to one phone and signed out from another. For staff, an attendance check-in records a short device label and whether the phone was online at the time. The app does not read the advertising ID, the phone number or any hardware serial.
Maps and Google sign-in
Listing maps are drawn by Google Maps, which receives the map position the app is showing while the map is open, and nothing when it is closed. Choosing Sign in with Google sends the name and email on your Google account to us, to create or match your account. Neither happens unless you open the map or pick that sign-in.
Crash reports
When the app crashes, a report goes to an error tracking service we run ourselves at errors.anubris.com, not to a third party. A report carries the app version, the device model and operating system, and the stack trace. Sign-in tokens are stripped before it is sent. Reports are kept for 90 days.
Who else sees it
Paddle for billing, our hosting provider, an email provider, and Google for push delivery, maps and the optional Google sign-in. Crash reports stay on servers we run. Nobody else, unless a court in Pakistan orders it.
Your rights
Ask for a copy, ask for a correction, or ask us to delete what we hold. Residents can delete their account from inside the app, and every other route is set out on the Delete your account page beside this one. Or write to [email protected] and we will reply within 30 days.