Privacy Policy

1. What data we collect

• Account data: name, email, phone number, password hash, company name, and role.
• Project and offer data: project details, unit inventory and pricing, buyer names, contact information, co-applicant details, and offer-related financial information (e.g., token amount, taxes, charges). We avoid storing full card/bank details.
• Communications data: messages and metadata sent via the platform, including WhatsApp share links if used.
• Usage and technical data: device, browser, IP address, timestamps, referral URLs, and interaction logs to improve reliability and security.
• Lead data on microsites: prospective buyer inputs (name, email, phone) via lead forms on project microsites.

2. Lawful basis and purpose of processing

We process personal data for the following purposes:

• To provide and operate the Services, including hosting project microsites and generating offers.
• To communicate with you regarding account administration, updates, and support.
• To comply with applicable laws and RERA guidelines relevant to developers and project communications.
• To maintain security, prevent fraud/abuse, and ensure uptime.
• To improve features, analytics, and user experience (in a privacy-preserving manner).

Our primary legal grounds include consent (for lead capture and marketing communications), performance of contract (with subscribed developers), and compliance with law.

3. Cookies and tracking

We may use strictly necessary cookies for session management and security. Where we use any non-essential cookies or analytics, we will provide appropriate notice and, where required, obtain consent. You can control cookies via your browser settings; disabling some cookies may affect functionality.

4. Data sharing and processors

We use reputable service providers to operate the Services. Typical processors include hosting/infrastructure providers (e.g., Vercel), databases (e.g., Supabase), email and communication tools. These providers process data on our instructions and are bound by appropriate contractual and security obligations.

We do not sell personal data. We may disclose data if required by law, to protect our rights, investigate fraud, or in connection with a merger, acquisition, or reorganization.

5. RERA and real estate context

Our platform assists developers with RERA-compliant communications by organizing project and unit information, offer letters, and disclosures. However, developers are responsible for the accuracy of project data, statutory disclosures, and adherence to applicable state RERA rules. We are a technology platform and not a law firm or broker.

6. International transfers

Some processors or backups may be located outside India. Where applicable, we adopt reasonable contractual and technical safeguards to protect personal data in line with the DPDP Act 2023 and good industry practices.

7. Data security

We implement commercially reasonable technical and organizational measures to protect personal data, including encrypted transport (HTTPS), access controls, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data retention

We retain personal data as long as necessary for the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements. Upon account closure, we may archive limited records for compliance and audit purposes for a reasonable period.

9. Your rights

Subject to applicable law, you may have the right to:

• Request access to and correction of your personal data.
• Request deletion/erasure where retention is no longer necessary and no overriding legal ground applies.
• Withdraw consent for processing that relies on consent (e.g., marketing communications).
• Lodge a grievance/complaint with our Grievance Officer and, if unresolved, with the relevant Data Protection Board as constituted under the DPDP Act 2023.

To exercise these rights, contact us using the details below. We may need to verify your identity before responding.

10. Children’s privacy

Our Services are intended for business use by real estate professionals and adult buyers. We do not knowingly collect personal data from children under 18 years of age. If you believe a child has provided us data, please contact us to delete it.

11. WhatsApp and communications

If you use WhatsApp share features, please ensure you have the recipient’s consent. Messages sent via third-party channels are governed by those providers’ terms and privacy policies. We may log metadata about shares to improve the feature and prevent misuse.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a revised effective date. Material changes may be communicated via email or in-product notice where appropriate.

13. Contact and Grievance Officer

For questions or requests regarding this Policy, contact: hello@citiwise.in

Grievance Officer: To be designated. Until then, please write to hello@citiwise.in with the subject line “Grievance – Privacy”.