Apna PlotBazaar — Privacy Policy

Effective: [DD Month YYYY] Last updated: [DD Month YYYY] App: in.plotbazaar

Before publishing: replace every [BRACKETED] field with your real details. A policy that still contains placeholders will be rejected at Play Console review, and an unnamed grievance officer breaches the DPDP Act, 2023.

1. Who we are

Apna PlotBazaar is a marketplace for buying, selling and discovering plots and land, operated by [LEGAL ENTITY NAME] (“Apna PlotBazaar”, “we”, “us”), a [company type] registered in India at [REGISTERED ADDRESS], [CIN / GSTIN].

We are the Data Fiduciary for the personal data described here, as that term is used in the Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

Apna PlotBazaar does not own any of the land listed on it and is not a party to any sale. Listings are posted by owners, agents and builders.

Contact: support@apnaplotbazaar.in

2. What this policy covers

What personal data the Apna PlotBazaar Android app and website collect, why, who we share it with, how long we keep it, and what you can ask us to do about it. It applies to every user — buyers, sellers, agents and builders.

3. Data we collect

3.1 Data you give us

Data	When	Why
Mobile number (with country code)	Sign-up and sign-in	It is your account identifier; we send a one-time password (OTP) to verify it
Name	Sign-up / profile	Shown to the people you deal with on the platform
Email address (optional)	Profile	Account recovery and notices
Password (optional)	If you set one	Alternative sign-in. Stored only as a salted hash — we never store or see your password
Profile photo (optional)	Profile	Displayed on your profile and listings
Seller details — business name, bio, WhatsApp number, contact preferences (optional)	Seller profile	Shown to buyers so they can reach you the way you prefer
Listing content — plot details, price, address, locality, photos, documents you upload	When you post a listing	To publish your listing and let buyers find it
Enquiries, chat messages, buyer requirements	When you contact a seller, chat, or post what you are looking for	To deliver your message and match you with listings
Reviews and ratings	When you leave one	Displayed publicly against the user reviewed
Land-record numbers — khasra, khata / B-1, village, tehsil (optional)	When you add them to a listing	Shown on the listing so buyers can check the government land record themselves
Land documents — khasra / B-1, P-II, registry and similar (optional)	When you upload them from My Listings → Documents	Checked by our verification team for the "Documents verified" badge. Never shown to buyers
Walkthrough video (optional)	When you add one to a listing	Published with your listing
Identity document — PAN card, or a masked Aadhaar (optional)	When you choose to verify your identity	For the "ID verified" badge. See section 3.5 for exactly what is kept
Site-visit requests and price offers	When you book a visit or make, accept or counter an offer	Shared with the other party so the visit or offer can happen
Loan enquiry — loan amount, monthly income, type of employment (optional)	When you ask for loan offers	Passed to a lending partner only if you tick the consent box — see section 7
Legal-help and survey bookings — the package, the plot and any note you add	When you book one	So the lawyer or surveyor we assign can contact you and do the work
Reports	When you report a listing, a user or a chat	Reviewed by our moderation team; the person reported is not told who reported them
Support messages	When you write to us	To answer you

3.2 Data collected automatically

Data	Why
Location, only with your permission — you choose Precise or Approximate in Android's own dialog	To show your position on the map, sort plots by distance ("Near me"), show how far a plot is from you, and help you mark your own plot's boundary while standing on it. The app asks only when you tap one of these features, and works without it. Your live position is used for that search or screen only — we do not store it or keep a history of where you have been
Voice searches (only when you tap the microphone)	Speech is turned into text by your phone's own speech service (usually the Google app), under that provider's terms. We receive only the resulting text, as an ordinary search
Device push token and platform	To send notifications you have opted into
IP address and device/browser identifier	Security: fraud prevention, rate limiting, detecting suspicious sign-ins, audit log
Session records	To keep you signed in and let you sign out of other devices
In-app activity — searches, filters, listings viewed and saved	To rank results, show relevant listings, give sellers anonymous performance statistics, and understand unmet demand in a locality
Crash and diagnostic logs	To find and fix faults

Kept only on your phone, never sent to us: plots you recently viewed, plots you added to Compare, your "before you buy" checklist ticks, and an unfinished listing draft. Clearing the app's data or uninstalling removes them.

3.3 Payment data

Subscriptions, promotions, advertisements and premium unlocks are processed by our payment gateway, Razorpay. Card, UPI, netbanking and wallet credentials are entered on the gateway and never reach Apna PlotBazaar’s servers. We store only the transaction record: amount, currency, status, gateway reference, payment method type, and the invoice raised to you.

3.4 Data we do not collect

We do not collect your contacts, call logs, SMS messages, other files on your device, a history of your location, voice recordings, health data, biometrics, or your device's advertising ID. We never store a full Aadhaar number. The app asks for no permission it does not use.

3.5 Identity verification — what we keep

We never store your full PAN or Aadhaar number. For Aadhaar we accept only the masked version UIDAI issues and keep the last four digits; for PAN we keep the first three and last two characters.
The photo of the document is stored privately, is seen only by our verification team, and is deleted as soon as they decide — verified or not.
What we keep afterwards: the masked number, the name as printed on the document, the decision and its date.
Other users see only one fact: that your identity is verified.

for no permission it does not use.

4. Device permissions, and why we ask

Permission	Used for	Optional?
Internet / network state	Required for the app to load anything	Required
Location (precise or approximate — your choice)	Your position on the map, "Near me", distance to a plot, marking your plot's boundary on site	Optional — you can pick a city manually instead
Camera	Photographing a plot, a land document or an identity document	Optional — you can pick existing photos instead
Photos, videos and media	Choosing listing photos, a walkthrough video or a document from your gallery	Optional
Notifications	Enquiry alerts, chat messages, matches, plan expiry reminders	Optional

Every permission is requested at the moment the feature needs it, never on launch, and you can withdraw any of them in Android Settings at any time. Voice search uses your phone's speech service, which holds the microphone itself; the app does not request microphone access.

5. Why we process your data, and on what basis

We process personal data on the basis of your consent — given when you create an account and when you grant each device permission — except where processing is for a legitimate use permitted by the DPDP Act, such as complying with a legal obligation or preventing fraud.

Purpose	Basis
Creating and securing your account; verifying your number by OTP	Consent / performance of the service
Publishing your listings and showing them to buyers	Consent
Connecting buyers and sellers (contact reveal, chat, enquiries)	Consent
Showing you relevant listings, search results and matches	Consent
Taking payment and issuing invoices	Performance of the service
Verifying land documents and identity, and showing the resulting badges	Consent (you choose to submit them)
Passing a loan enquiry to a lending partner	Explicit consent, recorded with the wording you agreed to
Arranging a paid legal or survey service you booked	Performance of the service
Fraud prevention, abuse detection, moderation, platform security	Legitimate use / legal obligation
Keeping tax and accounting records	Legal obligation
Product analytics and improving the service	Consent
Service notices we must send you	Legitimate use

We do not sell your personal data.

6. What other people can see

This is a marketplace, so some data is shown to others on purpose:

Your public profile — name, photo, company name, bio, badges, trust score, ratings and reviews, and your active listings.
Your listings — everything you put in them, including photos and the location you set. The map shows a listing within an approximate radius, not as an exact pin, unless you choose to share the precise location.
Your phone number is not shown openly. It is revealed to a specific buyer only when they use the contact-reveal feature, and you can restrict how buyers may reach you (call, chat, WhatsApp) in your seller settings.
When you enquire on a listing, that seller receives your name, your message and — depending on how you made contact — your phone number, so they can respond.
Chat messages are visible to the person you are chatting with, and may be reviewed by our moderation team if a conversation is reported.
Land-record numbers you add to a listing (khasra, khata, village, tehsil) are public on that listing. Land and identity documents are never public — buyers see only the "Documents verified" or "ID verified" badge.
Site visits and offers — the other party sees your name, the time or amount you proposed, and any note you add. Booking a visit does not reveal your phone number.
A listing you share opens a public web page with its photo, price, area, place and description — the same things any buyer sees in the app.

Please do not put anything in a listing, photo, chat message or review that you would not want a stranger to read.

7. Who we share data with

Recipient	What they receive	Why
Other users of the platform	As described in section 6	To operate the marketplace
Razorpay Software Private Limited (payment gateway)	Your name, contact details, amount, order reference	To process payments and refunds
MSG91 (our SMS gateway)	Your mobile number and the OTP message	To deliver the verification code
Meta Platforms, Inc. — WhatsApp Business (only if you choose "Get code on WhatsApp")	Your mobile number and the OTP	To deliver the verification code on WhatsApp
Lending partners (banks and NBFCs we work with) — only with your explicit consent	Your name, mobile number, loan amount, monthly income, type of employment, and the plot concerned	So they can contact you with loan offers. We record the consent you gave; you can withdraw it by writing to us, after which we pass on nothing further
Lawyers and surveyors we assign to a paid booking	Your name, mobile number, the plot and any note you added	To deliver the legal or survey service you booked
OpenStreetMap Foundation (Overpass API) and/or Google Maps Platform	The public map position of a listing — never your own location	To show schools, hospitals, banks and roads near a plot
Google LLC — Firebase Cloud Messaging	Your device push token and the notification content	To deliver push notifications
Google LLC — Google Maps Platform	Map queries, and the coordinates or place text you search	Maps, geocoding, place suggestions
Our cloud hosting and storage provider — `[e.g. AWS, Mumbai region]`	Data stored on our behalf	To host the service and store listing media
Professional advisers and auditors	As required	Accounting, audit, legal advice
Law enforcement, courts, regulators	As legally required	To comply with a valid legal order, or establish or defend a legal claim

Each provider operates under its own privacy policy. We engage them under contract and do not permit them to use your data for their own purposes.

If our business is ever sold, merged or restructured, personal data may transfer to the acquirer, who remains bound by this policy until it lawfully changes it with notice to you.

8. Where your data is stored

On servers in India ([confirm region — e.g. AWS ap-south-1, Mumbai]). Some service providers may process limited data outside India; where that happens it is under contractual safeguards, and only in countries not restricted by the Central Government under the DPDP Act.

9. How long we keep it

Data	Retention
Account and profile data	For as long as your account exists, then as set out in section 11
Listings	While active, plus an archive period after expiry so your history and the related enquiries stay coherent
Chat messages and enquiries	For as long as the account exists, so both sides keep their own record
OTP records	7 days
Search history	180 days
Notifications you have already read	120 days
Payment gateway webhook records	90 days
Invoices, payments and tax records	8 years, as Indian tax and company law require — these survive account deletion
Security and audit logs	`[state the period — e.g. 12 months]`
Identity-document photo	Deleted when our team decides (usually within a day); the masked number and decision are kept while the account exists
Land documents	While the listing exists, or until you remove them
Loan-referral consent records	For as long as the account exists, as evidence of what you agreed to
Site visits and offers	For as long as the account exists, so both sides keep their own record

10. Your rights

Know and access — a summary of the personal data we hold about you and how it has been processed. In the app: Settings → Your data → Download my data. For a conversation the export contains what you sent and who you sent it to — not the other person’s messages, which are theirs to export, not yours.
Correct, complete and update — Profile → Edit profile, or edit the listing concerned.
Erase — see section 11.
Withdraw consent, as easily as you gave it: revoke a device permission in Android Settings, switch off notification categories in Settings → Notifications, or delete your account. Withdrawing consent does not undo processing already carried out, and some features stop working without it.
Nominate another person to exercise these rights on your behalf in the event of your death or incapacity — write to the grievance officer.
Grievance redressal — complain to us first (section 13), and to the Data Protection Board of India if we do not resolve it.

We respond to rights requests within [30] days.

11. Deleting your account

Delete your account from Settings → Account → Delete my account, or by writing to support@apnaplotbazaar.in. You do not need to install the app to ask — use the web form at [https://apnaplotbazaar.in/account/delete].

Your account is immediately marked for deletion and your listings are taken down.
There is a 14-day grace period in which you can cancel the deletion by signing in again. It exists so that a deletion made in anger, or by someone who has compromised your account, can be undone.
After 14 days the deletion is carried out: your name, phone number, email, photo, profile text and listing content are permanently erased or irreversibly anonymised, and the account is closed.

What is kept, and why. Invoices, payments and tax records are retained for the period Indian tax and company law require. Enquiries other users made through your listings remain in their own history in anonymised form — their records are not yours to erase. We record what was retained and why, so we can demonstrate your request was honoured.

12. How we protect your data

All traffic between the app and our servers is encrypted in transit (HTTPS/TLS).
Passwords are stored only as salted hashes. Sign-in tokens are held in the Android Keystore on your device, not in ordinary app storage.
Access to production data is role-based and least-privilege; every administrative action is written to an audit log with before-and-after values.
Sensitive fields — password hashes, two-factor secrets, recovery codes — are never returned by our APIs.
Rate limiting, account lockout and OTP expiry protect against brute force.

No system is perfectly secure. If a personal data breach occurs we will notify the Data Protection Board of India and every affected user, as the DPDP Act requires.

13. Grievance officer

If you have a question or complaint about how we handle your personal data, contact our Grievance Officer. We acknowledge within [48 hours] and resolve within [30 days].

Grievance Officer: [FULL NAME]

Designation: [DESIGNATION]

Email: [grievance@apnaplotbazaar.in]

Phone: [+91 XXXXX XXXXX]

Address: [REGISTERED ADDRESS]

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

14. Children

Apna PlotBazaar is not intended for anyone under 18, and dealing in land requires the legal capacity to contract. We do not knowingly collect personal data from children. If we learn that we have, we delete it. If you believe a child has given us data, write to the grievance officer.

15. Changes to this policy

We may update this policy. If a change materially affects how we use your data we will tell you in the app, or by SMS or email, before it takes effect — and where the law requires it, ask for your consent again. The effective date at the top always reflects the current version.

16. Contact

[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
General enquiries: support@apnaplotbazaar.in
Privacy and grievances: [grievance@apnaplotbazaar.in]