Privacy Policy & Data Protection
Effective Date: October 21, 2026 · Version 2.4
Privacy by Architecture
GateZ is designed so that privacy is enforced at the database level rather than by policy alone. We collect only the minimum data required to verify physical entry, encrypt personal information at rest, refuse storage of full national identity numbers, and enforce strict row-level tenant isolation.
Who We Are
GateZ is a product of Appable Technologies Pvt. Ltd. ("Appable", "we", "us"), which operates the GateZ platform, this website and the GateZ apps. For visitor and resident records, the organisation that runs the gate (your office, society or agency) decides what is collected and for how long; Appable processes those records on its behalf under this policy.
1. Information We Collect at the Gate
When an individual checks in at a GateZ-enabled physical gate, the system captures:
- Visitor Details: Full name, contact mobile number, purpose of visit, and host person or flat.
- Entry Verification Photo: Captured live at the kiosk or guard tablet for visual badge verification.
- Government Identification: We record which ID type was presented (e.g. Driving License, Voter ID) and strictly its last 4 characters only. The full identification number is systematically rejected by our input validators and database constraints.
- Vehicle Information: Vehicle type and the last 4 characters of the vehicle registration plate.
2. Cryptographic Protection & Encryption at Rest
All personal data (including mobile numbers and visitor photos) is encrypted in storage using AES-256-GCM.
Database searches and lookup indexing utilize keyed cryptographic HMAC hashes rather than plain text numbers. At no point are plain telephone numbers or visitor identities exposed in public or cross-tenant databases.
3. Multi-Tenant Database Isolation
GateZ is a multi-tenant SaaS. Isolation is strictly maintained using PostgreSQL Row-Level Security (RLS). Every query execution is scoped to the authenticated tenant organization. One organization’s visitor logs, employee rosters, and material passes are completely invisible to any other customer organization.
4. Append-Only Tamper-Evident Audit Chains
Every entry decision, check-in, pass generation, and supervisor override is sealed into an append-only, SHA-256 hash-chained audit log. Cryptographic linkage ensures that no historical entry can be deleted or altered retroactively by guards, organization administrators, or GateZ support staff without detection.
5. Data Retention & DSAR Rights (Access and Deletion)
Customer organizations define automated retention periods (e.g., 30, 90, or 180 days). Once the retention window expires, visitor logs are purged automatically.
Under applicable data protection laws, individuals maintain Data Subject Access Rights (DSAR):
- Right to Access: Request an export of your physical gate entries across a specific facility.
- Right to Deletion: Request the purging of your historical visitor records subject to the facility's statutory incident retention obligations.
To exercise these rights, email our Data Protection Officer at [email protected].
6. No Sale of Personal Data
GateZ does not sell, license, or monetize visitor records or personal information under any circumstances. We do not place third-party behavioral advertising trackers on our marketing website or application console.