Privacy Policy

This policy explains how Bhumiq (“we”) handles your personal data in accordance with India’s Digital Personal Data Protection Act, 2023 (DPDP). It covers the Bhumiq website and app. It is a notice of what we do with your data, not a request for your agreement: where we rely on your consent, we ask for it on its own, for one purpose at a time, and you can withdraw it in Settings.

Bhumiq is an 18+ service. We do not direct it at children and we do not knowingly process the personal data of anyone under 18 (section 9 of the DPDP Act) — see our Terms of Service.

What we collect

• Account details you provide: name, email, and (optionally) phone number.
• Verification status: whether your email and phone have been OTP-verified.
• On-site activity you generate: the questions you ask and the answers you receive (stored with your account, so you can return to them), saved developers/projects (watchlist), and, only with your consent, a computed buyer-intent score.
• With your intent-scoring consent, and only once you have an account: the pages of the app you open and how long each stays on your screen, and where you first arrived from. That means the name of the website that sent you (never its full address) and any campaign tags in the link. Where you arrived from stays in your browser until you ask us to call you, and is then kept with your request.
• If a question you ask names a budget or a timeline, we keep that phrase, up to 120 characters, as a signal for your intent score.
• Your IP address, and the country we derive from it. We use it for rate limiting, security, and to decide which features to serve. A precise location is only ever read with your consent. Each time you sign in, we keep a record of the sign-in until you delete your account. It holds a code made from your IP address with a secret key, not the address itself.
• If you request a voice callback, the call is answered by our AI assistant and a transcript is stored with your enquiry.
• If you write to our team in the chat, we store your messages, the team’s replies and the page you wrote from with your account. We use them to answer you and to keep a record of what we told you. Only the Bhumiq team reads them. When the team replies while you are away, we email you a short notice that does not include the message.
• If you pay for a feature, Razorpay collects the payment. We store the payment and subscription identifiers and their status, never your card or bank details.
• Technical data needed to run the service: session identifiers, rate-limit records and error reports.

Cookies: one cookie keeps you signed in. We set no advertising or cross-site tracking cookies. Our traffic analytics are aggregate and cookieless.

Opening a Bhumiq email loads our logo from bhumiq.in, so our web host sees the time and IP address of that request. We do not use it to track who opens our mail.

Why we use it, and your consent

We process your data for three consented purposes, each of which you turn on explicitly and can withdraw at any time:

• Intent scoring — computing a buyer-intent signal from your sign-in status, on-site activity and approximate location.
• Contact sharing — sharing your name and phone number with one developer, only when you agree to it on a call with the Bhumiq team.
• Email alerts & digests — using your contact details to send property alerts, digests, and outreach about listings and developers you have shown interest in. Without this consent your watchlist alerts appear in the in-app bell only; no email is sent.

We also process the minimum data necessary to provide the core service (your account and security). Every consent you give is logged and reversible in Settings. With each one we keep the exact words beside the box you ticked, which box it was, the time, your IP address and the description your browser gives of itself.

How we share it

Bhumiq does not sell your details. Your name and phone number go to a developer only if you say yes on a call with us, and if a developer wishes to connect with you, we tell you here first. You deal only with Bhumiq. On that call we name the developer first.

We record when that call happened and the words we read out. Until then, no developer sees anything about you. After it, that developer first sees a masked summary (an intent band, budget range and locality), and gets your details only when our team makes the introduction. You can withdraw this in Settings at any time. Your details then leave every developer inbox on Bhumiq, and no developer gets them again unless you agree on a new call. We do not sell your personal data, and we do not share it for advertising.

We use processors strictly to operate the service, each under contract and only for the purpose named:

• Answering your questions: the text of your question and the records needed to answer it are sent to OpenAI (United States). Your name, phone and email are not.
• Payments: Razorpay (India).
• Email and SMS: Resend and MSG91, for one-time codes and the alerts you have opted into.
• Voice callbacks: Exotel (India).
• Hosting and delivery: the database is in Bengaluru (DigitalOcean); the website runs on Vercel behind Cloudflare; Sentry receives error reports, which can include your IP address and the page you were on.

Some of these processors operate outside India. The Act permits such transfers except to countries the Central Government restricts, and we do not transfer to any restricted country.

Your rights

Under the DPDP Act you can, at any time:

• Access and export the personal data we hold about you (Section 11).
• Correct or erase your data and close your account (Section 12).
• Withdraw any consent you have given, in one click, in Settings.

Export and erasure are available from your account settings. Withdrawing any consent stops that processing going forward.

Retention & security

We keep your data only as long as your account is active or as required to meet legal obligations, then delete or anonymise it. Deleting your account deletes your chat with our team, including the team’s replies. Access to personal data is restricted and tenant-isolated at the database level; consent and sensitive actions are recorded in an append-only audit log.

Grievance officer & contact

For any privacy question or to exercise your rights, write to Gautam Taneja at Gautam.t@varatech.in. We acknowledge every grievance within 24 hours and resolve it within 15 days. Full details — the officer’s name, postal address, what to include, and how to escalate to the Data Protection Board of India — are on our grievance redressal page.

Changes

We may update this policy; material changes will be notified in-app before they apply. See also our Terms of Service.