Privacy Policy
Last updated: July 2026 — aligned with India's Digital Personal Data Protection Act (DPDP)
MySondham ("we", "us") respects your privacy. This Policy explains what personal data we collect, why we collect it, how masking works, and your rights under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
1. Data we collect
- Account data: name, email and/or phone (one verified channel), password hash, role (customer, broker, builder), profile fields, and session tokens.
- Property data: listing details, photos, pincode, coordinates, and moderation metadata.
- Deal data: masked customer references, stage history, agreed terms, encrypted deal messages, and uploaded documents.
- Verification data: consent records, OTP confirmations, and traffic-light outcomes. Raw third-party verification reports are not shown to owners and are purged per retention rules below.
- Technical data: IP address, user agent, and logs needed for security and fraud prevention.
- Payment data: transaction references via Razorpay — we do not store full card numbers.
2. How we use data
We process personal data to:
- Operate accounts, listings, search, and the twelve-stage deal engine
- Assign Certified Deal Partners and send relay notifications (WhatsApp, email)
- Moderate media, verify locations, and prevent fraud
- Process subscriptions and listing unlock payments
- Run tenant verification only after recorded consent
- Comply with law and enforce our Terms
3. Consent ledger
Before processing personal data for verification, marketing alerts, or other consent-gated features, we record an entry in our consent_ledger with the user ID, consent type, purpose, timestamp, IP address, and user agent. No verification check runs without a valid consent record.
4. Identity masking
In deal flows, customers are identified to brokers by masked references (MSCUST-XXXXXXXX), not raw phone numbers. Broker identity is masked from customers until Agreement Signed (stage 9). WhatsApp and in-app relay messages do not expose participant contact details. Phone numbers in search indexes are hashed (SHA-256) — plaintext phone exists only in our secured Postgres database.
5. Retention and auto-purge
| Data category | Retention |
|---|---|
| Lead signals (raw social content) | 90 days, then purged |
| Verification reports | 90 days, then purged |
| OTP attempt logs | 30 days |
| Deal messages | 3 years (legal hold) |
| Consent ledger | 5 years (regulatory) |
Automated purge jobs run daily. We do not retain raw verification dossiers for owner download.
6. Sharing with third parties
We share data only as needed with:
- Razorpay — payment processing
- AuthBridge / IDfy — tenant KYC, only after consent
- Meta WhatsApp Cloud API / AWS SES — relay notifications
- AWS (S3, RDS, etc.) — hosting and storage, region ap-south-1
We do not sell personal data to advertisers.
7. Your rights (DPDP Act)
You may:
- Access personal data we hold about you
- Request correction of inaccurate data
- Withdraw consent for consent-based processing (where applicable)
- Request erasure, subject to legal retention requirements (e.g. deal records, consent ledger)
- Nominate another person to exercise rights on your behalf in certain circumstances
Contact ennpearl@mysondham.com to exercise these rights. We will respond within timelines prescribed by law.
8. Security
We use encryption in transit (TLS), encrypted deal messages, bcrypt password hashing, JWT access tokens (15 minutes), Redis-stored refresh tokens (30 days), rate limiting, and role-based access controls. No system is perfectly secure; report concerns to us promptly.
9. Children
The Platform is not directed at anyone under 18.
10. Changes
We will update this Policy when our practices change. The "Last updated" date reflects the current version.