Legal & Compliance•Version 1.0

Privacy Policy

Disclosing our collection, processing, Supabase storage, lead forwarding, and security practices in alignment with the Digital Personal Data Protection Act, 2023.

Last Updated: 7 October 2026
Effective From: 7 October 2026
1

Commitment to Data Privacy

At Yards & Acres (“We”, “Us”, “Our”), we are deeply dedicated to upholding user privacy, data security, and confidentiality. This Privacy Policy outlines our practices regarding the collection, processing, storage, sharing, and protection of personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

By accessing the Platform, creating an account, posting a listing, or submitting an enquiry, you consent to the collection and handling of your information as articulated in this policy.

2

Categories of Personal Data We Collect

We collect only data necessary to fulfill genuine real estate discovery, advertising, and lead matching purposes:

Account & Profile Data: Full legal name, mobile phone number, email address, password hash, and account role (Buyer, Seller, or Entrepreneur/Developer).

Buyer Activity Data: Saved or favorited properties, cadastral dossier requests, search filters, enquiry messages, and communication timestamps.

Seller & Developer Data: Property title disclosures, plot/apartment measurements, asking price, uploaded photographs, company legal name, corporate identification numbers (CIN), GSTIN, and state RERA registration credentials where provided.

Transactional & Billing Data: Order reference IDs, transaction amounts, subscription tier records, payment timestamps, and payment gateway references (e.g. Razorpay Payment IDs). We do not store credit/debit card numbers or CVVs on our servers.

Technical & Telemetry Data: IP address, device type, operating system version, browser user-agent, session identifiers, and access timestamps collected to prevent fraud and maintain security.

3

Purpose of Data Processing

Your personal data is processed strictly for the following lawful business purposes:

  • Authenticating user sessions and providing access to role-based portals (Buyer, Seller, Developer, and Super Admin).
  • Processing property listings and multi-unit project showcases for public discovery.
  • Facilitating verified lead generation: connecting interested Buyers with Sellers/Developers upon administrative review.
  • Managing subscription tier entitlements, upload quotas, and priority listing boosts.
  • Sending critical transactional alerts, SMS/OTP verification codes, and lead status notifications.
  • Preventing multi-device quota circumvention, identity fraud, duplicate listings, and automated scraping.
  • Complying with statutory reporting requirements and cooperating with Indian law enforcement authorities.
4

Data Sharing & Lead Forwarding Protocols

Yards & Acres never sells, rents, or commercializes personal data to third-party telemarketing networks or credit brokers. Personal data is shared strictly under the following transparent scenarios:

Verified Buyer-to-Seller Matching: When a Buyer submits “Get Contact Details” on a property, their contact snapshot (name, phone number, email, and message) is reviewed and forwarded to the designated Seller or Developer for direct property communication.

Supabase Managed Database: Stored securely within our enterprise PostgreSQL database hosted on Supabase cloud infrastructure with strict Row Level Security (RLS) policies.

Razorpay Payment Processing: Payment parameters and customer contact tokens are passed securely to Razorpay Software Private Limited for payment checkout processing.

Statutory Disclosures: In response to formal legal process, court orders, or subpoenas from Indian judicial or regulatory bodies (including state RERA authorities and Cyber Crime police).

5

Technical & Organizational Security Safeguards

We employ reasonable and customary technical and organizational security measures designed to safeguard personal data against unauthorized destruction, loss, alteration, or disclosure:

  • Encryption in Transit: All HTTP traffic is enforced over TLS 1.3 cryptographic protocols with HTTPS.
  • Row Level Security (RLS): Granular PostgreSQL RLS rules ensure sellers access solely their own listings and forwarded leads.
  • Cryptographic Password Hashing: Passwords and authentication tokens are secured via industry-standard hashing algorithms (bcrypt/Argon2) managed via Supabase Auth.
  • Payment Gateway Tokenization: Financial credentials are tokenized directly with PCI-DSS compliant aggregators.

Disclaimer: While we implement rigorous technological safeguards, no digital storage or internet transmission can be guaranteed as 100% immune from sophisticated cyber attacks.

6

Your Rights under Indian Data Protection Law

Under the Digital Personal Data Protection Act, 2023, you hold the following rights regarding your personal data:

  • Right of Access & Summary: You may request a summary of your personal data processed by the Platform.
  • Right to Correction & Updation: You can edit and update inaccurate profile information directly via your account settings.
  • Right to Erasure: You may request deletion of your account and personal data, subject to statutory retention obligations (e.g. financial tax records and fraud investigation logs).
  • Right of Grievance Redressal: You may lodge complaints regarding data handling directly with our designated Grievance Officer.
7

Data Retention Guidelines

Personal data is retained only for the duration necessary to fulfill the purposes for which it was gathered, or as mandated by applicable Indian statutory laws (including the Income Tax Act, 1961, and Information Technology retention mandates). When data is no longer required, it is securely purged or anonymized.

8

Privacy Officer & Contact

For any data protection inquiries, access requests, or consent withdrawals, please contact:

Designated Privacy Desk: privacy@yardsandacres.com

Response Timeline: We review and respond to valid privacy requests within statutory timelines (typically within 30 days).

Need more information or clarification?

Explore our complete platform policies or contact our Grievance Redressal desk.

Central Legal DirectoryContact Support