This site and the software behind it are operated by TODO: registered legal name of the company, e.g. “… Private Limited”, with its registered office at TODO: full registered address, including PIN code (“we”, “us”).

In the language of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), you are the Data Principal and we are the Data Fiduciary for the personal data described below. Where you deal with a listed estate agency through this site, that agency becomes an independent Data Fiduciary for its own use of your details — see clause 4.

There are two very different kinds of people on this platform, and they are treated differently:

• Visitors to the public listings site (the marketplace at /site and each agency’s own listings page) — buyers, tenants and property owners. Most of this policy is about you.
• Estate agency staff who log in to the CRM. Data you enter about your own clients is your agency’s data; we process it on your agency’s behalf and it is never shown to another agency.

You can browse every listing, search, filter and open the map without giving us any personal details. Personal data is collected only at the points below.

a. When you sign up or ask to see an owner’s contact number

• Your name.
• Your mobile number, stored in international format (+91…). This is your identity on the site — one account per number.
• Your email address, if you choose to give one. It is optional.
• What you are looking for, if you tell us: purchase or rent, an upper budget, and the localities you are interested in.
• A password, if you create an account. It is stored only as a one-way hash — we cannot read it back.

b. When you enquire about a listing

We record which listing you enquired about, which agency it belongs to, and when. See clause 4 for what that enquiry does inside the agency’s CRM.

c. When you ask us to list your own property

The “sell or rent out” form collects your name, mobile number, optional email, the agency you chose, and the property details you type: sale or rent, property type, city and locality, configuration, asking price, area and any notes.

d. When you raise a service request

If you ask a question or request help from your account, we store the request type, the free text you write, and the listing it relates to, if any.

e. Usage data, on every page

To understand which listings and localities get attention, we record an event when a page or a listing is viewed. Each event holds: a random session identifier that lasts until you close the browser tab, the page path, the referring page, campaign tags in the link you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content), your window size, whether the device is a phone, tablet or desktop, and the first 300 characters of your browser’s user-agent string. If you are signed in, the event is linked to your account.

What we do not collect

• We do not store your IP address. It is read momentarily to rate-limit the analytics endpoint against abuse, and is not written to the database.
• We do not collect payment card details, bank details, Aadhaar, PAN or any identity document — there is no payment flow on this site.
• We do not ask for or store precise device location. Map pins come from the listing, not from you.

This is the most important thing on this page, so it gets its own clause. Contact numbers on listings are hidden until you ask for them. When you ask, all of the following happen at once:

• You are shown the contact number held against that listing.
• Your name and mobile number are written into that agency’s CRM as a contact, tagged as having come from the public site.
• A lead is created for that agency, pointing at the listing you asked about, with a follow-up task due immediately. In plain terms: expect that agency to call or WhatsApp you.

Your details go to that agency only — the agency that published the listing. They are not shared with other agencies on the platform, not pooled into a common lead database, and not sold. Enquiring about a second listing from a different agency shares your details with that second agency too, and nothing more.

Asking a second time for the same listing does not create a second lead. Once the agency holds your details, its own use of them — how long it keeps them, how often it calls you — is its responsibility as an independent Data Fiduciary, and you can raise that with the agency directly or through us using clause 10.

Submitting the “sell or rent out” form works the same way, with the agency you picked: it creates a contact, a lead and a private draft listing in that agency’s account. Nothing you submit through that form is published on the public site by us; only the agency can choose to publish a listing after speaking to you.

We set no advertising cookies and no third-party cookies. Everything below is first-party and functional.

The usage events in clause 3(e) are recorded by our own code and stored in our own database. We do not load Google Analytics, the Meta pixel, or any other advertising, retargeting or session-replay tag, and we do not track you across other websites.

The counts published on the site — live listings, localities covered, agencies — are aggregates of listing data, not of people.

If we ever add a third-party analytics or advertising tag, this clause will be updated before it goes live. TODO: if you add a Meta or Google ads pixel to run paid traffic, say so here first

• The agency you enquired with, exactly as described in clause 4.
• Our hosting and infrastructure providers, who store the data on our behalf under contract and may not use it for their own purposes. TODO: name your hosting provider and database host, and the country the servers are in
• WhatsApp, if you use a click-to-chat button. That opens WhatsApp with a pre-filled message; what happens after that is between you, the agency and WhatsApp, under WhatsApp’s own privacy policy.
• Authorities, where we are legally required to disclose.

We do not sell personal data, and we do not share it with data brokers, lead aggregators or advertising networks.

Your account and enquiry history are kept while your account exists, and are deleted when you ask us to erase them under clause 9.

A lead created inside an agency’s CRM is that agency’s record. We will pass your erasure request on to the agency, but the agency controls its own retention.

Usage events are kept in aggregate form for market analytics. TODO: state the retention period for analytics events, e.g. 24 months, then set up the deletion job

Under the DPDP Act 2023 you may ask us to:

• Confirm what personal data of yours we hold and what we have done with it.
• Correct anything inaccurate, complete anything incomplete, or update anything out of date.
• Erase your personal data, where we no longer need it for the purpose you gave it for and no law requires us to keep it.
• Withdraw your consent. Withdrawing it does not undo what was lawfully done beforehand — in particular, an agency already holding your number from an earlier enquiry will still hold it, and you should ask that agency directly.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
• Have a grievance addressed, before escalating to the Data Protection Board of India.

You also have duties under the Act — in particular, not to impersonate someone else or file a false or frivolous complaint.

If anything here goes wrong — an agency will not stop calling you, a request was ignored, data looks incorrect — contact our Grievance Officer. We will respond within the period prescribed by law.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

This site is not intended for anyone under 18. We do not knowingly collect the personal data of a child, and we do not profile or advertise to children. If you believe a child has given us details, tell the Grievance Officer and we will delete them.

• Passwords are stored as one-way hashes, never in readable form.
• The cookies that identify you are HTTP-only and cryptographically signed, so they cannot be read by scripts or forged by guessing an identifier.
• Every query in the CRM is scoped to a single agency, so one agency cannot read another's contacts, listings or leads.
• The public analytics endpoint is rate-limited so nobody can flood it with fake activity.

No system is perfect. If you find a security problem, please report it to the Grievance Officer above rather than disclosing it publicly.

When this policy changes materially we will update the date at the top of the page, and — where the change affects what we do with data you have already given — tell you directly.

See also our Terms of Use.