This policy summarises how Bank Seal Assets Pvt. Ltd. ("we", "us") collects and processes personal data through banksealproperty.com. It is written to comply with the Digital Personal Data Protection Act 2023 (DPDP) and the IT Rules 2011/2021.
1. What we collect
From buyers
- Account: name, email, phone, hashed password
- Activity: listings viewed, saved, marked as interest, contact reveals
- Plan: subscription tier and payment metadata (Razorpay transaction id)
- Device: IP address, user agent, timestamp (for fraud + rate-limiting)
From sellers
- Application: name, email, phone, seller type, city
- Verification: RERA number, bank ID, GST number, KYC documents (uploaded files)
- Operational: listings, leads, follower broadcasts
2. How we use it
- To run the platform — authentication, contact gating, follower notifications, payment processing
- To verify seller identity before approval
- To compute aggregate metrics (city demand, AI scores) — never published in personally-identifiable form
- To meet legal obligations (income tax, DPDP Act, IT Rules takedowns)
3. What we do NOT do
- Sell personal data to third parties
- Run remarketing pixels for paid-plan users (paid plans are completely ad-free)
- Store Aadhaar numbers in plain text
- Share buyer contact details with sellers without your active consent (a contact-reveal click)
4. Data residency
All personal data is stored on servers located within India. Transactional emails sent via Resend may transit US-based infrastructure; we are evaluating an India-region transactional email provider for full residency.
5. Your rights under the DPDP Act
- Right to access: request a copy of the data we hold about you
- Right to correction & erasure: request correction of inaccurate data, or deletion of data we no longer have a legal basis to keep
- Right to nominate: appoint someone to exercise your rights in case of incapacity
- Right to grievance redressal: see grievance officer contact
Email privacy@bankseal.com with proof of identity to exercise any of the above.
6. Cookies & tracking
We use a session cookie (signed via jose, 7-day expiry) and the standard Google Analytics 4 cookies (only when consented). Free buyers see Google AdSense banners which set their own cookies; paid buyers do not.
7. Retention
- Account data: kept while the account is active + 1 year for tax/legal records
- Listing data: retained even after deactivation, in line with auction-record retention norms
- Payment metadata: retained per Income Tax Act requirements (typically 8 years)
- KYC documents: retained for the life of the seller relationship + 5 years
8. Breach notification
Any personal-data breach affecting you will be notified to the Data Protection Board of India and to you within 72 hours of detection, per the DPDP Act.
9. Updates
Material changes to this policy will be announced via in-app notification and email. The "Last reviewed" date at the top reflects the current version.