Privacy Policy

1. Introduction

EstateLoop ("we", "us", or "our") operates the EstateLoop website at estateloop.in and the EstateLoop mobile application. EstateLoop is operated by its current owner/operator. EstateLoop is not yet incorporated as a private limited company. Once a legal entity is registered, its exact name, registered office, CIN, GSTIN, and other statutory details will be inserted consistently across all legal pages below.

This Privacy Policy explains how we handle personal data when you use our platform to discover, list, or connect on property listings in India. EstateLoop is designed to handle personal data in accordance with applicable Indian data-protection requirements, including the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, as and when they apply to our processing.

Please read this Policy carefully. If you do not agree, do not create an account or otherwise use EstateLoop. At signup you confirm you are 18 or older and agree to the Terms with a single checkbox. This Policy and an itemized "What we collect" notice are linked there — they are not extra checkboxes. Optional analytics and marketing stay off until you opt in under Privacy & data.

EstateLoop is a technology platform. We are not a real estate broker or party to sale/rent transactions between users. This Policy is not legal advice and is not a certification of compliance by a regulator.

2. Data We Collect

We collect only data we need to operate the service. Categories and purposes:

We do not sell your personal data to brokers, advertisers, or unrelated third parties.

3. How We Use Your Data

We use personal data for specific purposes, including to:

• create and secure your account and authenticate you
• provide property discovery, listing, chat, offers, and wallet features
• review listings and verification submissions to reduce fraud and spam
• process subscriptions, swipe passes, boosts, and wallet transactions
• send service notifications, security alerts, and account updates
• respond to support, contact, careers, and privacy enquiries
• improve safety, search relevance, and product performance (analytics only if opted in)
• send promotional messages only if you opt in to marketing
• comply with legal, tax, and security obligations and respond to lawful requests

We do not use personal data for vague or unrelated "any business purpose" processing.

4. KYC & Verification Documents

4.1 What we may request

To post listings or access certain features, EstateLoop may request identity documents such as Aadhaar (front and back) and PAN, and a profile photo. Property ownership proof may be requested for owners but is optional in the current flow. Requirements may vary by role and feature.

4.2 Why and when

• Confirm identity and reduce impersonation or fake listings
• Enable posting and verification review workflows
• Respond to fraud or abuse reports

Submission is mandatory only for features that require verified posting status in the app.

4.3 Who can access KYC data

• Authorized EstateLoop administrators for verification review
• Our infrastructure providers (Google Firebase / Cloud Storage) that host encrypted file storage
• Law enforcement or regulators when required by applicable law

Other users do not receive your KYC document images through the platform.

4.4 Retention and deletion

KYC document images for verified users are scheduled for deletion approximately 90 days after verification submission, through an automated purge job. Copies may persist briefly in backups or logs for a limited period. If you delete your account, KYC files in your storage paths are deleted as part of account erasure, subject to legal retention exceptions below.

Treat all KYC uploads as sensitive — share only what is requested.

5. Consent & Legal Basis (India – DPDP Act, 2023)

We process personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (as and when applicable), on one or more of the following bases:

• Your consent, which you may withdraw in the app (Profile → Privacy & data) or by emailing privacy@estateloop.in
• Performance of our service and fulfilment of a contract with you
• Compliance with applicable law, including fraud prevention, tax, and security obligations
• Other legitimate uses expressly permitted under applicable data protection law

5.1 How signup consent works

Creating an account requires one checkbox: "I am 18+ and agree to the Terms". The Privacy Policy and the itemized "What we collect" notice are links, not additional ticks. Analytics and marketing are not ticked at signup and remain off until you opt in under Privacy & data. You do not need to accept optional marketing to create an account.

Withdrawing optional consent does not affect processing necessary to provide core services you continue to use.

6. Data Sharing & Processors

We may share limited data with service providers who process data on our behalf:

We may also share data with:

• law enforcement, courts, or regulators when required by applicable law
• professional advisers (legal, accounting) under confidentiality obligations where needed
• successors in the event of a merger, acquisition, financing, or business transfer

We do not sell your data.

7. User-to-User Sharing

Other users may see information you choose to publish or share, including:

• your name, profile photo, and role on your public profile
• property listing details, photos, and price on listings you publish
• messages, offers, and contact details you send through chat or contact features
• phone or email if you reveal them in chat or your profile settings allow visibility

Once you voluntarily share information with another user, EstateLoop cannot control how that recipient uses it afterward, subject to our platform rules and your right to report abuse. Share carefully.

8. International Transfers

Our infrastructure providers (including Google Firebase and related Google Cloud services) may process or store data on servers located outside India. Where such cross-border processing occurs, it is subject to applicable law and the provider's contractual and security frameworks. We do not make unsupported blanket claims about every transfer mechanism; we rely on provider terms and applicable legal requirements.

9. Data Retention

We retain personal data only as long as needed for the purposes below. Backups, logs, and legal records may persist for limited additional periods.

10. Account Deletion

You can delete your account in the app: Profile → Privacy & data, then type DELETE to confirm. This triggers erasure of your profile, listings, builder projects, offers, notifications, chats, user private data, KYC files in storage, and your Firebase Authentication account.

We may retain limited records where required or permitted by law, including:

• wallet transaction records for tax and accounting
• hashed account deletion logs and fraud/security logs
• records needed for ongoing disputes or legal obligations
• residual copies in backup systems for a limited time

If you cannot access the app, email privacy@estateloop.in with subject "Account deletion".

11. Security

We use safeguards appropriate to the nature of the data, including:

• encrypted data transmission using HTTPS/TLS
• Firebase Authentication for account access
• role-based access controls and Firestore security rules
• payment processing through Razorpay's PCI-DSS compliant infrastructure (EstateLoop does not store card numbers or UPI PINs)

No method of transmission or storage is completely secure. We do not claim ISO, SOC, or PCI certification for EstateLoop itself. You are responsible for keeping your login credentials confidential and for the devices you use to access EstateLoop.

12. Your Rights

Subject to applicable law (including the DPDP Act, 2023 and DPDP Rules, 2025 when in force), you may:

• access a summary of personal data in the app (Profile → Privacy & data → Download my data)
• correct inaccurate or incomplete information in Profile or via a privacy request
• withdraw optional analytics and marketing consents in Privacy & data (both are off unless you opt in)
• delete your account and associated personal data as described above
• nominate another individual to exercise rights if you die or cannot act (DPDP §14) — save a nominee in Privacy & data
• lodge a grievance in-app (Privacy request) or by email

Email privacy@estateloop.in with subject "Privacy request", or use Help Center → Privacy request in the app. We aim to respond within 30 days, and in any event within 90 days where required by applicable law.

13. Children

EstateLoop is for users aged 18 and above only. We do not knowingly collect personal data from children. If you believe a minor has created an account, contact privacy@estateloop.in and we will take appropriate action, including deletion where required.

14. Cookies and Tracking

Our website uses necessary cookies for authentication, preferences, and security. Optional analytics stay off until you accept them in the cookie bar at the bottom of the site (or later under Cookie settings). In the mobile app, analytics events are off by default until you opt in under Privacy & data. See our Cookie Policy for details and control options.

15. Personal Data Breaches

If we become aware of a personal data breach (unauthorised access, loss, or disclosure of personal data likely to affect users), we will take steps to contain it, investigate, and mitigate harm.

EstateLoop will notify affected users and regulators within the timeframes required by applicable law. Where the DPDP Rules, 2025 impose specific reporting timelines (including provisions relating to notification within 72 hours once a breach is confirmed), we will follow those requirements as and when they apply to us.

We may also comply with other applicable cyber-incident reporting obligations, including directions issued under Indian CERT-In requirements where relevant to our infrastructure.

Notices to users will be in plain language and, where we still have contact details, sent by email and/or in-app. They will describe what happened, what data was involved, steps you can take, what we are doing, and how to reach privacy@estateloop.in.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date. Where required by law, we will seek fresh consent or provide additional notice. Continued use of EstateLoop after changes become effective constitutes acceptance of the revised policy to the extent permitted by law.

17. Contact & Grievance

A formally designated Data Protection Officer will be published here if and when legally required after incorporation.