Privacy Policy

2. Who is responsible for your data

BrokerSaab LLP decides why and how personal data on the Platform is processed and is the “data fiduciary” for that data. Because the Platform connects owners, tenants and property staff, some of your information is necessarily visible to the other people on the same property (see “Who we share data with”). Owners and in-charges who receive tenant information through the Platform must use it only to manage that tenancy and must keep it confidential and secure, as required by our Terms & Conditions.

3. Information we collect

Account and profile

• Mobile number (used to log in with a one-time password), and your name.
• Email address, date of birth, profile photo and signature, if you choose to add them.
• Your role and preferences, such as whether you are an owner or a tenant and your preferred language.
• For staff accounts: official email address and the sections of the admin panel you are allowed to use.

Property information (owners and in-charges)

• Listing details: title, description, type, rent or price, area, rooms and beds, amenities, rules and policies.
• Address, PIN code and map location of the property, and photos, videos and floor-plan or inspection photos.
• Ownership or address-proof documents you upload, such as an electricity bill.
• In-charge and staff details you provide: name, phone, role, shift timings, attendance and salary records.

Tenancy information (tenants and residents)

• Name, phone and email, the room or bed assigned, rent, security deposit, lease dates and notice period.
• Rental agreements, move-in and move-out records, room transfers and room inventory or condition checks.
• Details of co-residents or members you add, and of a guardian or emergency contact.

Identity verification (KYC)

• Identity documents you upload, such as PAN and Aadhaar images, and, where your property requires it, a police-verification document.
• When you verify through DigiLocker: the verified name, date of birth, father’s name, address and photograph returned by the verification service, and a masked identifier (for example “XXXX XXXX 1234”). We do not store your full Aadhaar number.
• The outcome of verification (pending, verified or rejected), when and how it was verified.

Payments

• Payment requests (rent, deposit, electricity, maintenance and other charges), amounts, due dates, status and history.
• Proof you upload for offline payments (such as a screenshot or UTR/reference number) and approval or rejection notes.
• Owner payment-receiving details: UPI ID, bank account details and, where an owner uses online checkout, the owner’s own payment-gateway keys (stored encrypted).
• Payout details for property staff salaries, such as UPI ID, bank account or QR code.
• We do not receive or store your card number, CVV, UPI PIN or net-banking credentials. Online payments are completed on the payment gateway’s secure page.

Communications and support

• Support tickets and comments, notices, reminders, move-out and deposit-refund requests, reviews and ratings.
• Records of SMS, voice-call and email messages we send you (the message, time, delivery status).
• Enquiries you submit about a property, including your name, phone, email and message.

Device, usage and permissions

• Technical data such as IP address, device and app version, and logs needed to run and secure the service.
• An activity log of actions on your account (for example “logged in” or “submitted a property”), which we keep for 30 days.
• On the mobile app, only with your permission: approximate location once during setup to suggest your city; camera and photo library to attach photos or documents; notifications. You can refuse or withdraw any permission in your phone settings and keep using the rest of the app.
• On the website: essential cookies and similar storage to keep you signed in and remember your language and display choices.

We do not use third-party advertising trackers and we do not use your data for targeted advertising. We do not knowingly collect more data than the features you use require.

4. How we collect information

We collect information directly from you when you register, complete your profile, list a property, accept an invitation, upload documents, make or approve a payment, raise a request or contact us. We also receive information from other users of the same property (for example, an owner entering a resident’s details), from verification and payment service providers when you complete verification or payment, and automatically through your use of the Platform.

5. Why we use your information

• To create and secure your account and log you in with a one-time password.
• To list properties, manage tenancies, rooms and beds, prepare and store rental agreements and handle move-in and move-out.
• To verify identity and help owners meet their legal duties, including police tenant verification where applicable.
• To raise, track, remind and reconcile rent and other payment requests, and to generate receipts and reports.
• To send service messages by SMS, voice call, email and in-app notification: OTPs, rent reminders, notices, request updates and agreement alerts.
• To provide support, resolve tickets and disputes, and improve the Platform.
• To prevent fraud, abuse and misuse, and to keep a record of important actions for security and audit.
• To comply with law, enforce our terms and respond to lawful requests from authorities or courts.

Our basis for processing is your consent (for example, when you tick the box at login or consent to DigiLocker verification), the need to provide the service you asked for, our legal obligations, and limited legitimate uses that are permitted by law, such as fraud prevention and security. You can withdraw consent at any time (see “Your rights”), although some features cannot work without the related data.

6. KYC and DigiLocker verification

Identity verification protects owners, tenants and the community from impersonation and fraud, and helps owners meet their legal obligations for the people who live in their property.

• Government-approved verification. Aadhaar-based verification is done through DigiLocker, the Government of India’s digital document service run under the Ministry of Electronics and Information Technology (MeitY). We reach DigiLocker through an authorised verification partner. You are taken to DigiLocker, sign in there and choose to share your details. We never ask for your DigiLocker password or Aadhaar OTP, and they never pass through our servers.
• Your consent, every time. DigiLocker verification starts only when you choose “Verify via DigiLocker” and approve the sharing on DigiLocker. You may instead upload a document image for manual review where the property permits it.
• No full Aadhaar number. We store only the masked identifier returned by the verification service, the verified name, date of birth, father’s name, address and photograph, and the verification status. We do not store your full Aadhaar number, and we do not use Aadhaar for any purpose other than verifying identity for your tenancy or ownership.
• PAN checks. A PAN may be checked against the government database through the same verification partner to confirm the name matches.
• Restricted access. KYC documents are visible only to the person they belong to, to the owner or in-charge of the property where that person lives or owns, and to authorised BrokerSaab staff who need them. Every download of an ID document is logged. Once a document is verified it is locked and cannot be silently replaced or deleted.
• Purpose limitation. Owners and in-charges may use KYC information only for managing the tenancy and meeting legal requirements such as police verification. Copying, sharing or misusing it is prohibited and may lead to account termination and legal action.

7. Rent collection and payments

BrokerSaab is a technology platform. We help owners raise payment requests and help tenants pay and track them. We are not a bank, a payment aggregator or an escrow service, and we do not hold, collect or settle your rent.

• Direct to the owner. Rent and other charges are paid directly to the owner’s own account, by UPI or bank transfer, or through online checkout that uses the owner’s own payment-gateway account, so the money settles directly with the owner.
• Online payments. Card, UPI and net-banking details are entered on the payment gateway’s secure page and handled by the gateway under its own security standards and privacy policy. We receive only the confirmation: order and payment reference, amount and status. We verify the gateway’s signature before marking a payment as paid.
• Offline payments. If you pay by UPI or bank transfer outside the Platform, you can upload proof. The owner, in-charge or our staff then approve or reject it. Until it is approved, it is shown as awaiting approval.
• Records. We keep payment requests, statuses, proofs and approval history so that owners and tenants have a clear record, and so disputes can be resolved. Owners’ gateway keys are stored encrypted and are never shown back in the app.
• Deposits and refunds. Security deposits are held by the owner, not by us. The Platform tracks the refund request, any deductions and the tenant’s confirmation of receipt.

8. Who we share data with

We share personal data only as needed to deliver the service, and never sell it.

Other people on the same property

• Owners and in-charges can see the details of the tenants and residents of their property, such as name, phone, room, rent, payment status, agreement and KYC status or documents.
• Tenants can see the owner’s and in-charge’s name and contact number and the details of their own tenancy.
• Staff you invite as in-charge see only the property sections the owner has granted them.
• Guardians you add can receive limited information about the resident they are linked to.

Service providers (processors)

We use trusted providers who process data only on our instructions and under confidentiality and security obligations:

• Identity-verification partner connected to DigiLocker and PAN verification.
• Payment gateway chosen by the owner for online checkout.
• Cloud media storage for photos, videos and uploaded documents.
• SMS, voice-call and email providers that deliver OTPs, reminders and notices.
• Hosting and infrastructure providers that run the Platform.

Authorities and legal reasons

We may disclose data to police or other authorities where required for tenant verification or by law, court order or lawful request; to protect rights, safety or property; or to investigate fraud or a breach of our terms.

Business changes

If BrokerSaab LLP is involved in a merger, acquisition or sale of assets, your data may be transferred to the successor, who must honour this policy or give you notice and a choice.

9. How we keep your data secure

We use reasonable security practices appropriate to the sensitivity of the data, including:

• Encryption of data in transit between your device and our servers using HTTPS/TLS.
• One-time passwords that are stored only as irreversible hashes, expire quickly, and are rate-limited with lock-out after repeated wrong attempts.
• Encryption of third-party credentials we hold, such as an owner’s payment-gateway secret keys.
• Secure on-device storage of your sign-in session in the mobile app.
• Role-based access: people see only what their role and property allow, and staff access to admin sections can be narrowed.
• Audit trails for sensitive actions, including every download of an identity document, and a locked record once a KYC document is verified.
• Data minimisation: no full Aadhaar number, no card or bank-login details of tenants.

No system is completely secure. Please keep your phone and OTP private and tell us immediately if you suspect misuse. If a personal data breach affects you, we will notify you and the authorities as required by law.

10. How long we keep data

• Account and profile data: for as long as your account is active, and afterwards only as described below.
• One-time passwords: for a few minutes; used or expired codes are not reused.
• Activity log: 30 days.
• Tenancy, agreement, payment, deposit, KYC and dispute records: for as long as needed to provide the service and meet legal, tax, accounting and limitation requirements, generally up to eight years after the tenancy ends or the last transaction, unless the law requires longer or a dispute or legal claim is pending.
• Enquiries from people who are not registered: for as long as needed to respond and follow up.

When data is no longer needed, we delete it or irreversibly anonymise it.

11. Your rights and choices

Under the Digital Personal Data Protection Act, 2023 and other applicable law you may:

• Ask for a summary of the personal data we hold about you and how it is processed.
• Ask us to correct inaccurate or incomplete data, or update it yourself in your profile.
• Ask us to erase your data and your account (subject to the legal retention described above).
• Withdraw your consent at any time, for example for DigiLocker verification, optional permissions or communications.
• Nominate another person to exercise your rights if you die or become incapacitated.
• Complain to us, and to the Data Protection Board of India if you are not satisfied with our response.

To exercise a right, email or call us using the details below from the mobile number or email on your account so we can confirm it is you. We respond within a reasonable time, normally within 30 days.

12. Deleting your account

You can ask us to delete your account at any time from Settings → Delete my account in the mobile app or on your account page on the website. Our team reviews the request, because we must make sure no open rent, deposit or tenancy obligation is left behind. If approved, your account is closed, you are signed out and your personal details are removed or anonymised.

Some records are retained after deletion where the law or a legitimate need requires it: payment and deposit history, signed agreements, KYC verification records and records of a dispute or investigation. These are kept securely, used only for those purposes and deleted at the end of the retention period. Full steps are on our Delete Account page.

13. Children

The Platform is for people who are 18 or older and legally able to enter into a contract. We do not knowingly create accounts for children. A resident who is a minor may be added to a tenancy only by a parent or legal guardian, who gives consent on the minor’s behalf and is responsible for the information provided. If you believe a child’s data has been given to us without proper consent, contact us and we will delete it.

14. Messages and notifications

We send service messages that are part of the product: OTPs, rent due and overdue reminders, notices from your property, request and agreement updates and security alerts. These go by in-app notification, SMS, voice call and email and are sent through registered telecom templates. They are essential to the service and cannot be switched off while you hold an active tenancy or listing. We do not send third-party advertising. Where we offer optional updates, you can opt out at any time.

15. Third-party sites and services

The Platform may link to or hand you over to other services, such as DigiLocker or a payment gateway’s checkout page. Those services have their own privacy practices that we do not control. Please read their policies before you share data with them.

16. Where data is processed

We run the Platform for users in India and store data on secured infrastructure. Some service providers may process data on servers in other countries. Where that happens, we require appropriate safeguards and transfer data only as permitted by Indian law.

17. Our other services

This policy covers the Platform. If BrokerSaab LLP offers other services in future (for example software or web development, digital marketing, application testing or IT consulting), we will tell you what personal data each one collects and why, in a separate notice or an update to this policy, before that data is collected. We will not use the identity, KYC, tenancy or payment information you provide on the Platform to market those services to you unless you have agreed to it.

18. Changes to this policy

We may update this policy as our features or the law change. We will post the new version here with a new version number and date, and for material changes we will notify you in the app or by message. We may ask you to accept the updated policy again. Continued use after the effective date means you accept the update.

19. Governing law and disputes

This policy is governed by the laws of India. If you have a concern about your data, please contact us first so we can resolve it quickly. Any dispute that cannot be resolved that way will be settled only by the competent courts at Pune, Maharashtra, which have exclusive jurisdiction (the parties do not agree to arbitration), without affecting any right you have under law to approach a consumer commission, the Data Protection Board of India or another statutory forum.

Disputes between an owner and a tenant, for example about rent, deposit, damage or notice, are between those parties and are governed by their rental agreement and applicable law. See our Terms & Conditions for how the Platform supports resolution and when courts are involved.

20. Contact us and grievance redressal

For questions, to exercise your rights, or to raise a complaint about how your data is handled, contact our Grievance Officer: