Privacy Policy

This policy explains how Bhumiq (“we”) handles your personal data in accordance with India’s Digital Personal Data Protection Act, 2023 (DPDP). It covers the Bhumiq website and app. By using Bhumiq you agree to this policy.

Bhumiq is an 18+ service. We do not direct it at children and we do not knowingly process the personal data of anyone under 18 (DPDP §9) — see our Terms of Service.

What we collect

• Account details you provide: name, email, and (optionally) phone number.
• Verification status: whether your email and phone have been OTP-verified.
• On-site activity you generate: the questions you ask and the answers you receive (stored with your account, or against a temporary session if you are a guest, so you can return to them), saved developers/projects (watchlist), and, only with your consent, a computed buyer-intent score.
• Your IP address, and the country we derive from it. We use it for rate limiting, security, and to decide which features to serve. A precise location is only ever read with your consent.
• If you request a voice callback, the call is answered by our AI assistant and a transcript is stored with your enquiry.
• If you pay for a feature, Razorpay collects the payment. We store the payment and subscription identifiers and their status, never your card or bank details.
• Technical data needed to run the service: session identifiers, rate-limit records and error reports.

Cookies: one cookie keeps you signed in. We set no advertising or cross-site tracking cookies. Our traffic analytics are aggregate and cookieless.

Why we use it, and your consent

We process your data for three consented purposes, each of which you turn on explicitly and can withdraw at any time:

• Intent scoring — computing a buyer-intent signal from your sign-in status, on-site activity and approximate location.
• Contact sharing — releasing your contact details to a specific developer you choose to engage.
• Email alerts & digests — using your contact details to send property alerts, digests, and outreach about listings and developers you have shown interest in. Without this consent your watchlist alerts appear in the in-app bell only; no email is sent.

We also process the minimum data necessary to provide the core service (your account and security). Every consent you give is logged and reversible in Settings.

How we share it

We do not sell your personal data, and we do not share it for advertising. When you ask us to connect you with a developer, that developer first sees only a masked summary (an intent band, budget range and locality) — never your identity. Your name and contact are released to them only after they accept the enquiry and only if you have granted contact-sharing consent.

We use processors strictly to operate the service, each under contract and only for the purpose named:

• Answering your questions: the text of your question and the records needed to answer it are sent to OpenAI (United States). Your name, phone and email are not.
• Payments: Razorpay (India).
• Email and SMS: Resend and MSG91, for one-time codes and the alerts you have opted into.
• Voice callbacks: Exotel (India).
• Hosting and delivery: the database is in Bengaluru (DigitalOcean); the website runs on Vercel behind Cloudflare; Sentry receives error reports, which can include your IP address and the page you were on.

Some of these processors operate outside India. The Act permits such transfers except to countries the Central Government restricts, and we do not transfer to any restricted country.

Your rights

Under the DPDP Act you can, at any time:

• Access and export the personal data we hold about you (Section 11).
• Correct or erase your data and close your account (Section 12).
• Withdraw any consent you have given, in one click, in Settings.

Export and erasure are available from your account settings. Withdrawing any consent stops that processing going forward.

Retention & security

We keep your data only as long as your account is active or as required to meet legal obligations, then delete or anonymise it. Access to personal data is restricted and tenant-isolated at the database level; consent and sensitive actions are recorded in an append-only audit log.

Grievance officer & contact

For any privacy question or to exercise your rights, write to Sarrthak Dahiya at Gautam.t@varatech.in. We acknowledge every grievance within 24 hours and resolve it within 15 days. Full details — the officer’s name, postal address, what to include, and how to escalate to the Data Protection Board of India — are on our grievance redressal page.

Changes

We may update this policy; material changes will be notified in-app. Continued use after an update means you accept the revised policy. See also our Terms of Service.