Privacy notice
What personal data we collect, why, how long we keep it, who sees it, and how to use your rights under the Digital Personal Data Protection Act, 2023.
Who is responsible for your data
[company legal name to be added] ([registered office address to be added]) decides why and how your personal data is processed for Showcasia. Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025, we are the Data Fiduciary.
For any question about your data, or to use your rights, write to privacy@showcasia.com. Our Grievance Officer is [Grievance Officer's name to be added], grievance@showcasia.com.
In short
- We collect only what we need to run the search, contact, listing and credit services.
- We never sell personal data and we show no advertising, so we have no reason to profile you.
- Your mobile number and email are encrypted in our database, and stored separately from listings.
- When you reveal a lister's contact, your number goes to that lister only, so they can reply. It is never broadcast to other listers. A broker you choose gets a relay number, not your own.
- You can see, correct and delete your data, and withdraw consent, whenever you like.
What we collect and why
| What | Why | Basis |
|---|---|---|
| Mobile number (seekers and listers) | Sign-in codes; showing a lister's contact once you are verified; preventing abuse | Your consent when you ask for a code |
| Email address and name from Google (if you sign in with Google) | Sign-in | Your consent |
| Lister profile: name, role, firm, RERA agent number, GSTIN, languages, WhatsApp choice | Showing who listed a property; invoices; legal checks for brokers and builders | Your consent; legal obligations (GST, RERA) |
| Listing details, exact address, photos and documents (Index II, NOC, title report) | Publishing your listing; checking it is real; the dated verification labels | Your consent when you list |
| Enquiries and contact reveals | Passing on enquiries, charging credits, refunds and disputes | Your consent; performing the service you asked for |
| Payments: amount, payment reference, invoice. Card and UPI details stay with Razorpay | Selling credits; tax records | Legal obligation (GST and accounting law) |
| Device and use data: IP address, browser, pages, times, failed attempts | Security, fraud and scraping prevention, rate limits, fixing faults | Legitimate uses allowed by the DPDP Act, and the one-year log rule in the DPDP Rules |
| Device location, only when you press "I am at the property" | Placing the map pin for your listing | Your consent each time; never stored apart from the pin you confirm |
| Consent records | Proving what you agreed to and when | Legal obligation |
We do not knowingly collect data from anyone under 18. If we learn that a child has given us data, we delete it.
How long we keep it
| Data | Kept for |
|---|---|
| Sign-in codes | 10 minutes, stored only as a one-way hash |
| Sessions | 30 days, or until you sign out |
| Account and profile | While your account is open. If you do not use Showcasia for 3 years, we delete it, after warning you at least 48 hours before. |
| Listings and photos | While the listing is live, then 12 months after removal for disputes, unless you ask us to delete them sooner |
| Enquiries and reveal records | 3 years, for disputes and refunds |
| Payments and invoices | As long as GST and accounting law require (at least 72 months from the due date of the annual return) |
| Security logs | 1 year, as the DPDP Rules require |
| Consent records | As long as the law requires us to be able to prove consent |
How we protect it
Mobile numbers and emails are encrypted (AES-256) and looked up only through keyed hashes. Sign-in codes and session tokens are stored only as one-way hashes. Credit records cannot be edited once written. Access by staff is limited to what their job needs and is logged. Original photos and documents are never public.
If a personal data breach happens, we will tell the Data Protection Board of India and each affected person, as the DPDP Rules require, with what happened, what it may mean for you and what we are doing about it.
Your rights
- Access: ask for a summary of the personal data we hold about you and what we do with it, and who we have shared it with.
- Correction and erasure: ask us to correct, complete, update or delete your data. Some records must be kept by law (for example invoices); we will tell you which.
- Withdraw consent: as easily as you gave it, from Account, Settings or by email. This does not affect what was done before you withdrew.
- Nominate: name another person to use your rights if you die or cannot act yourself.
- Complain: to our Grievance Officer first. If you are not satisfied, you can complain to the Data Protection Board of India.
Write to privacy@showcasia.com from the mobile number or email on your account. We reply within 30 days, and always within the 90 days the DPDP Rules allow.
Changes to this notice
When we change this notice we change the version date at the top. If a change affects what you have consented to, we will ask you again.