Privacy Policy

Applicable law. This Privacy Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules made thereunder (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021). LocaNest acts as a Data Fiduciary under the DPDP Act for the personal data you provide.

1. Data we collect. When you sign up we collect your name, email, phone number, and role. When you list a property we collect the listing photos, address, category-specific attributes, and verification documents (Aadhaar, PAN, and business proof for commercial listings). When you pay, Cashfree collects the card / UPI / netbanking details directly — we never see or store them. Chat messages, ratings, referral usage, IP address, device / browser identifiers and support requests are stored to run the platform.

2. How we use it. To operate listings, match tenants with owners, run verification, process payments and refunds, prevent fraud, and comply with law. Transactional emails (booking confirmation, refunds, ratings reminders, referral rewards) are sent via official@locanest.in. Consent for these processing purposes is captured at signup, and can be withdrawn at any time by writing to the Grievance Officer named below.

3. Aadhaar & sensitive-data safeguards. Aadhaar is collected only for owner-identity verification as permitted under Section 4 of the Aadhaar (Targeted Delivery of Financial and other Subsidies, Benefits and Services) Act, 2016 and UIDAI regulations. We follow UIDAI guidelines:

• Aadhaar numbers are masked in the UI (only last 4 digits visible) and are never published on any listing or shared with tenants.
• Aadhaar images are stored encrypted at rest and are viewable only by authorised admin reviewers on an as-needed basis.
• We do not use Aadhaar for any purpose other than one-time identity verification, and we do not share it with any third party except where compelled by law or by UIDAI directive.
• You may request deletion of your Aadhaar image once verification is complete; the masked reference (last 4 digits + verification status) is retained for audit.

4. Sharing. We share data with (a) Cashfree Payments Services Pvt. Ltd. for payment processing (India), (b) our transactional email provider Hostinger International Ltd. (mail-relay servers located outside India), (c) verification reviewers within LocaNest, and (d) government / regulatory / law-enforcement authorities on lawful request. We do not sell your data or use it for third-party advertising.

5. Cross-border transfer. Some of our service providers (notably Hostinger’s SMTP infrastructure, and any content-delivery / DNS providers we may use) operate servers outside India. Where personal data is transferred to such providers, we ensure the transfer is limited to what is necessary to deliver the service (e.g. delivering an email) and is subject to the provider’s contractual security commitments. Transfers are made only to countries that the Central Government has not restricted under Section 16 of the DPDP Act.

6. Retention. Account data is kept for the life of the account plus 3 years for financial / tax / audit compliance. Verification documents are stored securely and viewable only by admin reviewers. On account deletion, data that is not legally required to be retained is deleted or anonymised.

7. Your rights under the DPDP Act. As a Data Principal you may:

• request access to a summary of the personal data we process about you,
• request correction of inaccurate or incomplete data,
• request erasure of personal data that is no longer necessary,
• withdraw your consent at any time (though this may affect the services we can provide),
• nominate a person to exercise these rights on your behalf in the event of your death or incapacity, and
• lodge a grievance with our Grievance Officer (see clause 10 below).

Certain data (for example, financial records under the Income Tax Act) may be retained where law requires.

8. Security. Passwords are hashed using bcrypt (12 rounds). Traffic is served over HTTPS/TLS. Sensitive fields like bank account numbers are masked in the UI (only the last 4 digits are ever displayed) and are never exposed outside the owner’s own profile and the admin console. Access to production systems is restricted, logged, and reviewed periodically.

9. Data breach notification. Notwithstanding our safeguards, no online service is completely secure. If we become aware of a personal-data breach that is likely to result in risk to affected users, we will:

• notify the Data Protection Board of India as required under Section 8(6) of the DPDP Act,
• notify each affected user by email at the address on file and via an in-app notice, without undue delay,
• describe the nature of the breach, the categories of data involved, the likely consequences, and the mitigation actions we are taking, and
• publish periodic updates on our website until the incident is closed.

10. Grievance Officer (IT Rules 2021 & DPDP Act). If you have any complaint or question about how your data is processed, you may write to:

• Name: Aman Saini
• Designation: Grievance Officer & Data Protection Contact, LocaNest
• Email: official@locanest.in
• Postal address: LocaNest, Jaipur, Rajasthan, India

We will acknowledge complaints within 48 hours and endeavour to resolve them within 15 days as required by the IT (Intermediary Guidelines) Rules, 2021.

11. Cookies & analytics. We use a strictly-necessary session cookie for authentication and localStorage for a JWT fallback. As of the effective date above, we do not use any third-party marketing, advertising or behavioural-tracking cookies and we do not embed third-party analytics scripts such as Google Analytics, Facebook Pixel, Hotjar or Mixpanel. If we introduce any such tool in the future — for example a first-party analytics provider or a session-replay tool for debugging — we will (a) list it in this Cookies section with the vendor name and purpose, (b) update the “Effective date” at the top, and (c) surface a consent banner where required by law.

12. Children. The platform is not intended for anyone under 18. We do not knowingly collect personal data from minors.

13. Changes to this policy. We may amend this Privacy Policy from time to time. When we do:

• the “Effective date” at the top of this page will be revised,
• for material changes (e.g. new categories of data, new processing purposes, new third-party sharing, new cross-border transfers), we will notify registered users by email at the address on file and via an in-app banner at least 7 days before the change takes effect, and
• an archived copy of the previous version will be available on request from the Grievance Officer.

Continued use of the platform after the effective date of a revised policy signifies acceptance.

14. Contact. Data Fiduciary: Aman Saini (sole proprietor of LocaNest), Jaipur, Rajasthan. Email: official@locanest.in.