Draft for legal review before launch.
Privacy Notice
Version 2026-09-28 · [to be added before launch]
This Privacy Notice explains how [to be added before launch] ("we"), operator of the RealEstateKart app, processes your personal data under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. We are the Data Fiduciary; you are the Data Principal. The service is offered only in India and only to people aged 18 or above.
1. What we collect and why
| Data | Purpose |
|---|---|
| Name, email, password (stored hashed), or Google / Apple sign-in identifier | Create and secure your account; send verification and security emails |
| Mobile number (optional) | Shown to signed-in users only if you turn on "Show my phone number" on a listing |
| Your chosen area (state, district, city) | Show nearby properties |
| Listings you post: details, price, address, map pin, photos | Publish your listing. Address is not shown publicly; locality and approximate map location are. Photo location (EXIF/GPS) data is removed on your phone before upload |
| Messages, rental applications, visit requests | Let you talk to owners / interested people |
| Favourites, recently viewed, searches | Personalise browsing inside the app |
| Reports, grievances and moderation records | Keep the platform safe; meet our duties under the IT Rules, 2021 |
| Device push token; approximate location only when you tap "Use my location" | Notifications; suggest your city. We do not track your location in the background |
| Advertising identifier (only if you opt in to personalised ads) | Show more relevant ads through Google AdMob. Without your consent, ads are non-personalised |
| App usage data: screens opened, buttons tapped, searches by type and city, coarse price bands, app version and device model (only if you opt in to usage analytics) | Understand which features help people find homes and fix problems, through Google Analytics for Firebase. Never includes your name, email, phone number, messages or listing text |
2. Consent and your choices
We process your data on the basis of your consent, which you give when you create an account, and for the legitimate uses the Act allows (for example, complying with law or preventing fraud). Personalised advertising, usage analytics and marketing messages are separate, optional choices, off by default. You can change or withdraw any consent at any time in Profile → Privacy & ads; withdrawing is as easy as giving it. Withdrawal does not affect processing done before it.
3. Who we share data with
- Other users: your listings, your name, badge (owner / agent / builder) and, only if you choose, your phone number.
- Service providers processing data on our behalf under contract: cloud hosting and storage (including Cloudflare R2 for photos), email delivery, push notifications (Google Firebase Cloud Messaging / Apple Push Notification service), advertising (Google AdMob) and usage analytics (Google Analytics for Firebase, only with your consent).
- Authorities, when required by Indian law or a valid order.
We do not sell your personal data.
4. How long we keep it
While your account is active. When you delete your account, your profile, listings, photos, chats and favourites are erased; photo files are removed from storage in the background. We keep limited records (for example moderation and grievance logs) only as long as the law requires. Accounts inactive for 3 years may be deleted after notice to you.
5. Your rights
- Access: download a copy of your data (Profile → Download my data).
- Correction and completion: edit your profile and listings in the app.
- Erasure: delete your account (Profile → Delete account).
- Withdraw consent: Profile → Privacy & ads.
- Nominate a person to exercise your rights in case of death or incapacity: write to the Grievance Officer.
- Grievance redressal: contact the Grievance Officer below. If unsatisfied, you may approach the Data Protection Board of India.
6. Security
Passwords are hashed with Argon2id, connections are encrypted, photos are stored privately, and access to personal data is limited and logged. If a personal data breach occurs, we will inform affected users and the Data Protection Board as the Rules require.
7. Children
This service is not for anyone under 18. We do not knowingly process children's data or show them targeted ads. If you believe a child has an account, contact us and we will delete it.
8. Grievance Officer
[to be added before launch]
Email: [to be added before launch]
[to be added before launch]
Or raise a ticket in the app: Profile → Help & grievances. We acknowledge within 24 hours and aim to resolve within 15 days.
9. Changes
We will tell you in the app before material changes take effect, and ask for fresh consent where required.