Privacy Policy

Account data — your email address, name, phone (if you provide it), and password (stored as a bcrypt hash, not in plain text). If you sign in with Google, we receive the verified email and display name your Google account exposes.

Property data you submit — the property name, address, RERA number, builder name, and any documents you upload for verification. This data is used to run AI checks against public sources (RERA, land records, public sentiment) and, if you request, to brief an expert advocate.

Payment data — handled entirely by Razorpay. We never see or store your card number, UPI ID, CVV, or OTP. We store only the Razorpay payment id, the amount, and the package you bought.

Usage analytics — anonymous events about how you navigate the app (pages viewed, packages selected, verifications run). Sent to Google Analytics 4 only after you click Accept on the cookie banner. See “Cookies and analytics” below.

• To run AI verification on the properties you submit.
• To dispatch expert reviews to property advocates when you request one.
• To send you transactional emails — receipts, password resets, expert review status.
• To improve the product (which features get used, where users get stuck).
• To prevent abuse and fraud.

We do not use your data to train external AI models, sell it to third parties, or send marketing emails without your explicit opt-in.

PropertyAI uses Google Analytics 4 to measure how the product is used. GA4 sets a first-party cookie (_ga) that's scoped to our domain only.

We use Google Consent Mode v2: until you click Accept on the banner, no analytics cookies are set. If you click Decline, we still load GA but with all storage denied — meaning no cookies, no client-side identifiers, no cross-session linking. Decline is re-prompted after 30 days; Accept is sticky until you change it.

We never use ad-targeting cookies. ad_storage, ad_user_data, and ad_personalization remain denied at all times.

We send specific data to specific third parties for specific reasons:

• Razorpay — payment processing. They see what they need to charge your card / UPI; they don't see your property data.
• Resend — transactional email delivery (receipts, password resets). They see your email address and the email content.
• Google — Analytics (anonymous, consent-gated) and Sign in with Google (OAuth, only when you choose that method).
• Property advocates — when you specifically request an expert review, the assigned advocate sees the property details, your concerns, and any documents you attach. Our advocate panel currently covers Lucknow, Uttar Pradesh only; we expand district-by-district.

We do not share your data with any other third party without your explicit consent or a binding legal order from an Indian court.

India's Digital Personal Data Protection Act 2023 gives you specific rights. We honour all of them:

• Access — see what data we hold about you. Email privacy@propverifyai.com.
• Correction — fix anything that's wrong. Most fields are editable in Settings; for the rest, email us.
• Deletion — we delete your account and all data tied to it within 30 days. Some payment records are retained for the statutory accounting period (8 years).
• Withdrawal of consent — change your cookie choice anytime. Withdraw analytics consent by clearing your browser data; the banner will re-prompt on next visit.
• Grievance — file a complaint with our Data Protection Officer at dpo@propverifyai.com.

• Account + property data: as long as your account is active, plus 30 days after deletion.
• Payment records: 8 years (Indian tax / accounting requirement).
• Analytics events in GA4: 2 months (we've set the minimum retention available).
• Email logs: 90 days for delivery troubleshooting.

All data in transit is encrypted via HTTPS. Passwords are stored as bcrypt hashes (never reversible to plaintext). Payment data is tokenised by Razorpay and never touches our servers. Backups are encrypted at rest.

If you suspect a security issue, please email security@propverifyai.com. We respond within 48 hours.

PropertyAI is not directed at users under 18. We don't knowingly collect data from minors. If you believe a minor has created an account, email us and we'll delete it.

We'll update this page when our practices change. Material changes (anything that expands what we collect or who we share with) trigger an in-app notice and an email to all active users.