Privacy Policy

VastuSetu PropTech Pvt Ltd ("VastuSetu", "Company", "we", "us", or "our") operates vastusetu.in and associated mobile applications and services (collectively, the "Platform"). This Privacy Policy explains what personal data we collect from Buyers, Sellers, Brokers, Builders, Bankers, and visitors, how we use and share it, and the choices and rights available to you.

This Policy is framed in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as applicable. By using the Platform, you consent to the practices described in this Policy.

This Policy should be read together with our Terms of Service. Where the two conflict on data handling matters, this Privacy Policy governs.

2.1 Data You Provide Directly

• Account details: name, email address, mobile number, and password or OTP-based credentials.
• Identity and KYC data: government ID documents, PAN, and documents retrieved via DigiLocker for verification purposes.
• Profile data: role selection (Buyer, Seller, Broker, Builder, Banker), RERA registration numbers, business details, and preferences.
• Listing content: property details, photographs, videos, and location data uploaded by Sellers, Brokers, or Builders.
• Video Verification recordings captured for identity or property authentication.
• Payment information processed for Subscriptions, including billing name and address (card and bank details are collected and stored solely by our payment gateway partner, not by VastuSetu).
• Communications: messages, support tickets, and feedback submitted through the Platform.

2.2 Data Collected Automatically

• Device and usage data: IP address, device identifiers, browser type, operating system, and app version.
• Log data: pages viewed, search queries, clickstream, session duration, and referring URLs.
• Location data: approximate or precise location, where permitted, to support property search and proximity-based features.
• Cookies and similar technologies, as described in Section 8.

2.3 Data From Third Parties and Government Sources

• Property and regulatory data sourced from MahaRERA, IGR Maharashtra, and other government registries, used to compute the Builder Trust Score™, Property Risk Score™, and IGR+MahaRERA dual verification.
• Identity confirmation data received via DigiLocker under your explicit consent.
• Transaction status updates received from Razorpay and other payment or banking partners.

• To create and manage your account and authenticate your access to the Platform.
• To display, match, and rank property Listings relevant to your search and preferences.
• To generate Verification Services, including Builder Trust Score™, Property Risk Score™, and Vastu Compliance Indicator™.
• To process payments, Subscription renewals, invoices, and applicable tax documentation.
• To verify identity and prevent fraud, including through DigiLocker and Video Verification.
• To provide customer support and respond to grievances or service requests.
• To send transactional communications, service updates, and, where consented to, promotional communications.
• To comply with legal obligations, including under RERA, tax law, and requests from law enforcement or regulatory authorities.
• To improve Platform features, train and evaluate our AI-driven analytics, and detect misuse.

We process personal data on the basis of your consent (obtained at the time of account creation, DigiLocker linking, or specific feature use), for the performance of a contract with you (such as fulfilling a Subscription), for compliance with a legal obligation (such as RERA or tax reporting), or for our legitimate interests in operating and securing the Platform, balanced against your rights under the DPDP Act.

5.1 With Other Users

Information you choose to make public on a Listing or profile (such as contact details for a Seller or Broker) is visible to other Users as necessary to facilitate transactions on the Platform.

5.2 With Service Providers

• Razorpay and other payment gateway partners, for processing Subscription payments.
• Cloud infrastructure providers (AWS) hosting our servers, databases, and content.
• DigiLocker, for identity and document verification, subject to your consent.
• Communication providers used to deliver SMS, email, and push notifications.

5.3 With Government and Regulatory Bodies

We may share data with MahaRERA, IGR Maharashtra, tax authorities, or law enforcement agencies where required by law, in response to valid legal process, or to protect the rights, property, or safety of VastuSetu, our Users, or the public.

5.4 Business Transfers

If VastuSetu is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.

VastuSetu does not sell personal data to third parties for their independent marketing purposes.

Personal data is stored on secure cloud infrastructure (AWS), including Aurora MySQL and DynamoDB, with encryption of sensitive data at rest and in transit using industry-standard protocols such as AES-256/GCM. Access to personal data is restricted to authorised personnel on a need-to-know basis and is subject to internal access controls and audit logging.

While we take reasonable technical and organisational measures to protect your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain personal data for as long as your account remains active, and thereafter for the period necessary to comply with legal, tax, or regulatory obligations (including RERA record-keeping requirements), resolve disputes, and enforce our agreements. KYC and Video Verification records are retained in accordance with applicable Reserve Bank of India and regulatory guidelines where relevant to payment or financing features. Upon expiry of the applicable retention period, data is securely deleted or anonymised.

The Platform uses cookies and similar technologies to remember your preferences, maintain login sessions, analyse usage patterns, and improve Platform performance. You may control cookie preferences through your browser settings; disabling certain cookies may limit some Platform functionality.

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and the processing activities undertaken.
• Request correction or completion of inaccurate or incomplete personal data.
• Request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
• Withdraw consent for processing that is based on consent, without affecting the lawfulness of processing carried out prior to withdrawal.
• Nominate another individual to exercise your rights in the event of death or incapacity, in accordance with the DPDP Act.
• Register a grievance with our Grievance Officer, and thereafter with the Data Protection Board of India if unresolved.

To exercise these rights, please contact us using the details in Section 13. We may need to verify your identity before acting on a request.

The Platform is not directed to individuals under 18 years of age, and we do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor without verifiable parental or guardian consent, we will take steps to delete such data.

Personal data may be processed and stored on servers located outside India, including on AWS infrastructure. Where such transfers occur, we take steps to ensure an equivalent level of protection is maintained, consistent with the DPDP Act and any conditions notified by the Central Government from time to time.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be notified via the Platform or your registered email at least fifteen (15) days before taking effect. The "Effective Date" at the top of this Policy indicates when it was last revised.