Privacy Policy

This policy explains what personal data NRR Nivas Technologies Private Limited ("NRR Nivas") collects, why, who sees it and what you can do about it. It is published under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). NRR Nivas is the Data Fiduciary for the data described here.

1. What we collect

• Account: mobile number (verified by OTP), name, email, city, profile photo if you add one.
• Listings: property address, locality, photos, rent or price, deposit, preferences, and for land the survey number, extent, approval details and project or venture name; the owner's name is shown to users who unlock the contact.
• Activity: searches, shortlists, contacts unlocked, visits scheduled, chats sent through the Platform, reports you file.
• Payments: amount, plan or service purchased, gateway transaction id and the last 4 digits of the instrument as returned by the payment aggregator. We never see or store full card numbers, CVV or UPI PINs.
• Rent payments: your landlord's name and bank account or UPI ID that you enter so that we can transfer the rent.
• Rental agreements: names, addresses, ID numbers and the agreement terms you enter so the document can be drafted and stamped. Aadhaar, PAN or passport numbers entered here are sensitive personal data and are used only for the agreement.
• Verification (optional): documents and consent you provide for owner KYC, tenant verification or a land title check (sale deeds, encumbrance certificates, pattadar passbook details, Dharani extracts), processed by our verification and legal partners.
• Device & usage: IP address, browser, approximate location derived from IP, pages viewed and crash logs. If you allow it, precise location to show homes and land near you.

2. Why we use it (purpose and lawful basis)

3. Who sees your data

• Other users: owners see a tenant's name and phone number only after the tenant unlocks the contact or starts a chat; tenants see an owner's name and number after unlocking. Your number is never shown on a public page.
• Processors: cloud hosting (Cloudflare, data stored in its India and global regions), SMS/OTP provider (MSG91), payment aggregators (Razorpay), e-stamping vendors, verification partners, packers and home-service partners for the booking you made, and analytics tools. Each is bound by contract to use the data only for our instructions.
• Law: courts, police or regulators when required by a lawful order under Indian law, including Section 69/79 of the IT Act.
• Business transfer: a successor entity if NRR Nivas is acquired or merged, under the same policy.

We do not sell personal data and do not share it with brokers, builders or lenders for their own marketing without your explicit, separate consent.

4. Cookies and local storage

We use a session cookie to keep you logged in, and browser local storage to remember your search area, theme and drafts. Analytics cookies are first-party and aggregated. You can clear them from your browser at any time; the Platform keeps working, you will just need to log in again.

5. Retention

Account data is kept while your account is active and for 3 years after your last login, then deleted or anonymised, unless a longer period is required by law. Payment and invoice records are kept for 8 years under the Companies Act and GST law. Rental-agreement data is kept for the agreement term plus 3 years so you can download it again. Chat messages are deleted 2 years after the conversation ends. Verification documents are deleted within 90 days of the report being issued.

6. Your rights

Under the DPDP Act you may, from Account › Profile or by writing to us:

• access a summary of the personal data we hold and the processors we have shared it with;
• correct or update inaccurate data;
• withdraw consent for a purpose (we will stop that processing; some services may then be unavailable);
• erase your data, subject to the retention we are legally required to keep;
• nominate a person to exercise these rights if you are unable to;
• raise a grievance with us and, if unresolved, with the Data Protection Board of India.

We respond within 15 days. We will verify identity through your registered mobile number before acting on a request.

7. Children

The Platform is for adults. We do not knowingly process data of anyone under 18 and will delete it on becoming aware.

8. Security

Data is encrypted in transit (TLS) and at rest. Sessions are server-side tokens with a 30-day expiry. Access to production data is limited to named staff with multi-factor authentication and is logged. Payments are handled by PCI-DSS compliant aggregators. In the event of a personal data breach we will notify the Data Protection Board and affected users as required by the DPDP Act.

9. Cross-border processing

Some processors operate infrastructure outside India. Transfers are made only to countries not restricted by the Central Government under Section 16 of the DPDP Act and under contracts requiring equivalent protection.

10. Changes and contact

We will notify material changes on the Platform and by SMS or email 7 days before they take effect. Questions and requests: privacy@nrrnivas.in. Grievance Officer: grievance@nrrnivas.in, NRR Nivas Technologies Private Limited, Madhapur, Hyderabad 500081, Telangana.