Privacy Policy

Welcome to Avnester. This Privacy Policy ("Policy") explains how Avnester ("we", "us", "our") collects, uses, shares, and protects your personal information when you access or use the Avnester website, mobile applications, and related services (collectively, the "Platform").

By using the Platform, you consent to the collection and use of your information as described in this Policy. If you do not agree with this Policy, please do not use the Platform. We encourage you to read this Policy carefully and check back periodically for updates.

Account Information: When you register on the Platform, we collect your name, email address, phone number, and any other details you provide during sign-up or profile completion (e.g. city, property preferences, role such as buyer, seller, agent, or builder).

Listing and Inquiry Data: If you create property listings, we collect listing details (property type, location, price, area, images, descriptions). If you send inquiries or contact listing owners, we collect the content of those messages and associated contact details.

Usage Data: We automatically collect information about how you use the Platform, including pages visited, search queries, listings viewed, clicks, time spent, device type, browser, operating system, IP address, and referring URLs.

Location Data: With your consent, we may collect approximate location data from your device to provide location-based search results and recommendations.

Push Notification Data: If you enable push notifications on our mobile app, we collect a device token (a unique identifier assigned by Apple Push Notification service or Firebase Cloud Messaging) and associate it with your user account. This token is used solely to deliver push notifications to your device. Device tokens are stored securely and deleted when you log out or disable notifications.

Cookies and Tracking Technologies: We use cookies, local storage, and similar technologies to recognise your device, remember your preferences, and analyse Platform usage. See the Cookies section below for details.

We use the information we collect to: provide, maintain, and improve the Platform and its features; process your registrations, listings, inquiries, and transactions; personalise your experience, including property recommendations and search results; communicate with you about your account, inquiries, and Platform updates; send promotional or marketing communications (with your consent, where required by law); detect, prevent, and address fraud, abuse, and security issues; comply with legal obligations and enforce our Terms and Conditions; and analyse usage trends and improve Platform performance and user experience.

Listing Owners and Agents: When you send an inquiry or request contact details, your name, contact information, and message may be shared with the listing owner, agent, or builder so they can respond to you.

Service Providers: We share information with trusted third-party service providers who help us operate the Platform (e.g. hosting, analytics, payment processing, email delivery). These providers are contractually bound to use your data only for the purposes we specify and to protect it appropriately.

Legal Requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your information may be transferred to the acquiring entity.

We do not sell your personal information to third parties for their own marketing purposes.

We retain your personal information for the specific periods listed below, depending on the type of data:

User accounts: Active period plus 30 days following a deletion request. Listings: Active period plus 90 days after expiry. Leads and inquiries: 3 years. Search events and usage data: 90 days. Audit logs: 7 years. Invoices and billing records: 8 years (as required under GST law). Conversations: Active period plus 1 year following account deletion. Flagged or removed content: 180 days after removal (as required under the IT (Intermediary Guidelines) Rules, 2021).

When your information is no longer needed for the purposes described above, we will delete or anonymise it in accordance with applicable law.

Under the Digital Personal Data Protection (DPDP) Act, 2023 and applicable Indian law, you have the following rights regarding your personal data:

Right to Access: You may request a summary of your personal data that we hold and details of how it has been processed. Right to Correction: You may request correction or updating of any inaccurate or incomplete personal data. Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements (e.g. GST invoices must be retained for 8 years). Right to Grievance Redressal: You may raise a complaint with our Grievance Officer (see below), who will acknowledge within 24 hours and resolve within 15 days. Right to Nominate: You may designate a person to exercise your data rights on your behalf in the event of your incapacity or death.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India. To exercise any of these rights, please contact our Grievance Officer using the details in the Grievance Officer section below.

We use cookies and similar technologies to: keep you logged in and remember your preferences; understand how you use the Platform and which features are most popular; deliver relevant content and improve Platform performance; and support analytics and measurement.

You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Platform.

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected such information, we will take steps to delete it promptly. If you believe a child under 18 has provided us with personal information, please contact us.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (HTTPS/TLS), secure storage, access controls, and regular security reviews.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security.

We process your personal data on the following legal bases under the DPDP Act, 2023 and applicable Indian law:

Contract performance: Processing necessary to provide you the Platform services you have signed up for (e.g. account management, listing creation, lead delivery). Consent: Where you have given explicit consent (e.g. location access, marketing communications, analytics cookies). Legitimate interest: Where processing is necessary for our legitimate business interests (e.g. fraud prevention, Platform improvement, security). Legal obligation: Where processing is required to comply with applicable laws (e.g. GST invoicing, IT Act intermediary obligations, RERA compliance).

All personal data collected through the Platform is stored in India, on servers located in the AWS Asia Pacific (Mumbai) region (ap-south-1). We do not transfer your personal data outside India.

Our infrastructure is hosted on Amazon Web Services (AWS), which maintains industry-standard security certifications and compliance with Indian data localisation requirements.

We use the following categories of third-party service providers to operate the Platform. These providers process your data only as instructed by us and are bound by appropriate data processing agreements:

Cloud hosting and infrastructure: Amazon Web Services (AWS), India region. Payment processing: Razorpay, for processing subscription and credit payments. Email delivery: Amazon Simple Email Service (SES), for transactional and notification emails. Push notifications: Amazon Simple Notification Service (SNS), for delivering push notifications to your mobile device via Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM). Authentication: Amazon Cognito, for user registration and login. Analytics: Anonymous session-level analytics processed on our own infrastructure.

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines) Rules, 2021, and the Digital Personal Data Protection Act, 2023, we have established a grievance redressal mechanism.

To file a grievance, please use our Grievance Redressal Form at /grievance.

We will acknowledge your complaint within 24 hours and endeavour to resolve it within 15 days. If you are not satisfied with the resolution, you may escalate your complaint to the Data Protection Board of India established under the DPDP Act, 2023.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated Policy on the Platform and update the "Last updated" date at the top. For material changes, we may notify you by email or through a notice on the Platform.

Your continued use of the Platform after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree, please stop using the Platform.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at support@avnester.com.

For data protection and privacy-related grievances, please use our Grievance Redressal Form at /grievance.