Privacy Policy

1. Information We Collect

We collect the following categories of information:

a. Account Information

• Full name, email address, and phone number when you register or sign in via Google/GitHub OAuth.
• Profile picture and username provided by your third-party authentication provider.
• Password (stored in hashed form; we never have access to your plain-text password).

b. Property Listing Data

• Property details including address, description, pricing, images, and specifications.
• Location data (latitude/longitude) to display properties on maps.
• Contact preferences and availability for property inquiries.

c. Usage and Device Data

• Pages viewed, search queries, filters applied, and interactions with listings.
• IP address, browser type, operating system, device model, and screen resolution.
• Referring URL and exit pages.
• Location data derived from IP address (city-level, not precise GPS).

d. Payment Information

• Subscription plan details and payment history.
• Payment is processed by Cashfree. We do not store your credit/debit card number, CVV, or UPI PIN on our servers. Cashfree's privacy policy governs payment data: cashfree.com/privacy.

e. Google Account Data (OAuth)

• When you sign in with Google, we receive your name, email address, and profile picture from your Google Account.
• We do not access your Google contacts, emails, calendar, or any other Google data.
• We do not store your Google OAuth tokens. They are used only to authenticate your session and are discarded after sign-in.

2. How We Use Your Information

We use collected information for the following purposes:

• Service Delivery: To create and manage your account, display property listings, and facilitate connections between property seekers and owners.
• Authentication: To verify your identity when you sign in via email/password or OAuth providers (Google, GitHub).
• Communication: To send service-related notifications (e.g., listing updates, inquiry responses, account alerts). We do not send marketing emails without your explicit consent.
• Payment Processing: To manage your subscription, process payments, and maintain billing records.
• Analytics: To understand usage patterns, improve platform performance, and develop new features. Analytics data is aggregated and does not identify individual users.
• Security: To detect and prevent fraud, abuse, unauthorized access, and violations of our Terms of Service.
• Legal Compliance: To comply with applicable laws, regulations, court orders, or enforceable governmental requests.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data with:

• Service Providers: Third-party vendors who perform services on our behalf (cloud hosting via Vercel, image storage via Cloudflare R2, payment processing via Cashfree, email delivery via Resend). These providers are contractually obligated to protect your data and use it only for the services we request.
• Other Users: When you submit a property inquiry, your name and contact information are shared with the listing owner/agent to facilitate the transaction. Your email address is not disclosed unless you explicitly share it.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Aaradhya, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law (e.g., financial records under Indian tax regulations, which are retained for 7 years). Inactive accounts with no activity for 24 months may be contacted and, if unresponsive, deactivated.

5. Data Security

We implement industry-standard security measures including:

• TLS/SSL encryption for all data in transit.
• AES-256 encryption for data at rest.
• Secure, access-controlled servers hosted on Vercel (SOC 2 Type II certified).
• Supabase Row Level Security (RLS) policies restricting database access.
• Rate limiting and DDoS protection on all API endpoints.
• Regular security audits and dependency updates.

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security and encourage users to exercise caution when sharing personal information online.

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and associated data, subject to legal retention requirements.
• Portability: Request your data in a structured, machine-readable format.
• Withdraw Consent: Withdraw consent for data processing at any time (this does not affect the lawfulness of processing based on consent before its withdrawal).
• Restrict Processing: Request restriction of processing in certain circumstances.

To exercise any of these rights, contact us at support@aaradhyahomes.com. We will respond to your request within 30 days.

7. Cookies and Tracking

We use the following types of cookies:

• Essential Cookies: Required for authentication, session management, and security. Cannot be disabled.
• Functional Cookies: Remember your preferences (e.g., dark mode, language) to enhance your experience.
• Analytics Cookies: Help us understand how users interact with the platform. Used only in aggregate form.

You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning properly.

8. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us immediately.

9. Third-Party Services

The Service integrates with the following third-party services:

• Google OAuth: For sign-in. Governed by Google's Privacy Policy: policies.google.com/privacy.
• GitHub OAuth: For sign-in. Governed by GitHub's Privacy Policy: docs.github.com.
• Google Maps: For displaying property locations. Governed by Google's Privacy Policy.
• Cloudflare R2: For image storage. Governed by Cloudflare's Privacy Policy: cloudflare.com/privacypolicy.
• Cashfree: For payment processing. Governed by Cashfree's Privacy Policy: cashfree.com/privacy.
• Supabase: For authentication and database. Governed by Supabase's Privacy Policy: supabase.com/privacy.

We are not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies.

10. Indian Data Protection (DPDP Act, 2023)

We comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian data protection regulations. As a Data Funder (as defined under the DPDP Act), we process personal data only for lawful purposes and with appropriate safeguards. You have the right to grievance redressal under the DPDP Act. To exercise your rights or file a complaint, contact our Grievance Officer at support@aaradhyahomes.com.

11. International Data Transfers

Your data may be processed in countries other than India (e.g., United States for Vercel hosting, various regions for Cloudflare CDN). These countries may have different data protection laws. By using the Service, you consent to the transfer of your data to countries that may not provide the same level of data protection as India. We ensure that appropriate safeguards are in place for all international transfers.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant authorities as required by the DPDP Act and applicable law. We will take all reasonable steps to contain and remediate any breach promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email to registered users and/or a prominent notice on the Service at least 7 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree, you must stop using the Service and delete your account.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at: