Privacy Policy

The data fiduciary (controller) is Build Bharat Mart Pvt. Ltd., a company incorporated in India. Registered office and contact details are listed at the bottom of this page.

We only collect what we need to run the marketplace. We never sell your personal data.

• Account data: mobile number (for OTP login), name, email, profile photo, preferred language.
• KYC data (hosts and high-value guests): Aadhaar XML / DigiLocker verification token, PAN (for payouts), selfie liveness check. We do NOT store raw Aadhaar numbers — only the masked last-4 plus the verification reference issued by the KYC provider.
• Listing & booking data: property details, photos, prices, availability, messages between guest and host, booking dates and payment status.
• Payment metadata: Razorpay/UPI transaction IDs, payout account number (last-4), invoice records. We never see or store full card numbers or UPI PINs — those go directly to the payment gateway over a tokenised channel.
• Location data: approximate location (city / pincode) when you search, and precise location only if you explicitly turn on “Use my location”. You can revoke this any time in the app or your OS settings.
• Device & app data: device model, OS version, app version, Firebase Installation ID, crash logs, and basic usage analytics (which screens you visit, how long bookings take to complete).
• Cookies and similar: on the web, we use first-party cookies for session management and Firebase Analytics cookies for usage metrics. No advertising cookies, no third-party trackers.

• To create your account and verify your identity (DPDP §7(a)).
• To match you with suitable listings and process bookings.
• To collect rent / deposits and pay hosts.
• To enable chat between guests and hosts.
• To detect fraud, abuse, and policy violations.
• To comply with Indian law (GST invoicing, KYC under PMLA, lawful requests from government authorities).
• To improve the product through aggregated, de-identified analytics.

We share only what each partner needs to perform the service, and only under contract.

• Google Firebase (Auth, Firestore, Storage, Cloud Functions, FCM, Analytics, Crashlytics) — data hosted on Google Cloud, primarily in the asia-south1 (Mumbai) region. Some sub-services (e.g. Analytics) may process data in other Google regions.
• Razorpay — payments, payouts and invoices.
• KYC providers (DigiLocker, Karza or equivalent) — to verify government IDs.
• Communication providers (SMS gateway, WhatsApp Business API, transactional email) — to send OTPs, booking receipts and host updates.
• Hosts and guests — your name, profile photo, and the messages you send are visible to the other party in a booking. Phone numbers and email are masked behind a proxy until a booking is confirmed.
• Government authorities — only when compelled by a valid order under Indian law.

The DPDP Act permits transfers outside India except to countries the Central Government may notify as restricted. Some of our sub-processors (e.g. Google Firebase Analytics) may process data outside India. We rely on standard contractual protections and the asia-south1 region for the bulk of storage.

• Account & profile: while your account is active, plus 90 days after closure.
• Booking, payment and tax records: 8 years (statutory under GST and the Companies Act).
• KYC verification reference: 5 years after the last booking (PMLA Rule 9).
• Chat messages: 2 years from the last message in a thread, then auto-deleted.
• Crash logs & analytics: 14 months.

• Access — ask for a copy of the personal data we hold about you.
• Correction — fix anything that is wrong or out of date (you can do most of this yourself in Profile → Edit).
• Erasure — request deletion. We'll remove what we can while keeping the records the law requires us to keep (see §6).
• Withdraw consent — turn off location, marketing messages, or close your account at any time.
• Grievance redressal — escalate to our Grievance Officer (§9).
• Nominate — under DPDP §14, you can nominate someone to exercise these rights on your behalf in case of death or incapacity. Write to privacy@smartkiraya.com to register a nominee.

To exercise any right, email privacy@smartkiraya.com from the address linked to your account, or use the in-app “Delete my account” flow under Profile → Privacy. We respond within 30 days.

Smart Kiraya is not directed to children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, write to grievance@smartkiraya.com and we will delete the account.

As required by the IT Rules, 2021 and the DPDP Act, 2023:

If you are not satisfied with our response, you may approach the Data Protection Board of India.

• TLS 1.2+ for every connection.
• OTP-based authentication; no passwords stored.
• Firestore security rules enforce per-document access.
• Encryption at rest (Google Cloud default AES-256).
• KYC documents stored encrypted with restricted Cloud Storage IAM.
• Quarterly access review; least-privilege for engineering staff.
• Mandatory breach notification under DPDP §8(6) — we will inform you and the Data Protection Board if a personal data breach involves you.

We update this page when our practices change. If the change is material we will notify you in-app and by email before it takes effect. The “Last updated” date at the top tells you when this page was last revised.

Build Bharat Mart Pvt. Ltd.
Email (general): support@smartkiraya.com
Email (privacy / DPO): privacy@smartkiraya.com
Email (grievance): grievance@smartkiraya.com