Privacy policy
Last updated 6 August 2026 · Digital Personal Data Protection Act, 2023 (India)
This is a working draft, not a filed legal document. Pinly is a prototype. Every square-bracketed placeholder below must be completed and the whole document reviewed by counsel before launch. The inventory shown in the app is fictional.
1.Who is responsible for your data
Pinly is operated by [registered legal entity name], registered at [registered address], [CIN / registration number]. Under the DPDP Act we are the Data Fiduciary for the personal data described here; you are the Data Principal.
2.What we collect
We ask for the minimum a developer needs to call you back about a specific project, and nothing more.
- Your name — so the site team knows who they are speaking to.
- Your mobile number, verified by OTP. This is the account identifier; there is no password.
- Your intent — the project you enquired on, budget band, configuration (BHK), preferred locality, possession timeline, and whether you are buying to live in or to invest.
- Email address, only if you give one for brochures or visit confirmations.
- Activity on Pinly — searches, projects viewed, shortlist, compares, visit requests and reviews.
- Device and log data — IP address, device and browser type, and timestamps. Used for security, fraud detection and to prove when a consent was given.
- Approximate location, only for the session and only if you grant the browser permission, to sort results by distance.
We do not ask for and do not want your PAN, Aadhaar, bank details, salary slips or any financial document. If a developer or an agent asks for those through a Pinly channel, report it to the grievance officer below.
3.Why we process it, and on what basis
- Your consent (s.6, DPDP Act) — to share your enquiry with a developer, and separately to send you marketing on WhatsApp, SMS or email. Each is a distinct consent, recorded separately, and each can be withdrawn on its own.
- Performance of the service you asked for — to run your account, show your shortlist, and confirm a site visit slot.
- Legitimate uses (s.7) — fraud prevention, security, and compliance with a legal obligation or a court order.
4.When your details reach a developer
Your name and phone number are shared with one developer — the developer of the specific project you enquired on — and only after you have explicitly consented on that enquiry.
- · Before that consent exists, no developer, sales agent or channel partner can see any part of your contact details on any Pinly screen or API.
- · We record the consent text you agreed to, its version, the timestamp, your IP and your device — so it can be produced later if you dispute a call.
- · One consent covers one project. Enquiring on a second project is a second consent.
- · We do not sell your details, and we do not release them into a broker pool.
- · Calls placed through Pinly use a masked number, so your real number is not exposed in the developer's call logs.
5.Who else processes your data
Data Processors acting only on our instructions and under contract: our cloud hosting provider, our SMS/WhatsApp/email delivery providers, our payment gateway (for developer billing, not for you), and our analytics and error-monitoring tools. They may not use your data for their own purposes. Personal data is stored on servers in India; if a processor is located outside India, the transfer is limited to what the DPDP Act and any notification under s.16 permit.
6.Marketing, calls and messages
Transactional messages — an OTP, a visit confirmation, a price change on something you shortlisted — follow the service you asked for. Promotional messages go out only on a separate marketing consent, on DLT-registered templates, and respect the TRAI DNC register. Every promotional message carries an opt-out, and Account → Notifications turns each channel off independently.
7.How long we keep it
- Enquiry and lead records — 24 months after your last interaction with that enquiry, then deleted or irreversibly anonymised.
- Account and shortlist — while your account is open. Delete the account and it goes within 30 days, other than what we must retain by law.
- Consent records — kept for [retention period, to be set with counsel] even after withdrawal, because the record is the only proof of what you agreed to and when.
- Server and security logs — 180 days.
8.Your rights under the DPDP Act
- Access — a summary of the personal data we hold about you, what we do with it, and the identities of everyone we shared it with.
- Correction and completion — fix anything inaccurate or incomplete, or update it.
- Erasure — have your personal data deleted, except where a law requires us to keep it.
- Withdraw consent — as easily as you gave it, from Account → Privacy. Withdrawal is not retrospective: a developer who already received your enquiry keeps their own copy and becomes responsible for it, and you can ask them directly to erase it.
- Grievance redressal — complain to us first (see below). If we do not resolve it, you may approach the Data Protection Board of India.
- Nominate — name someone to exercise these rights for you in the event of death or incapacity.
9.How to exercise them
Use Account → Privacy in the app, or write to the grievance officer. We acknowledge within 72 hours and aim to resolve within 30 days, or the period prescribed under the DPDP Rules if that is shorter.
Grievance Officer
Name: [officer name — to be appointed]
Email: [grievance email]
Post: [registered address]
Phone: [contact number]
No grievance officer has been appointed for this prototype. These placeholders are deliberate.
10.Children
Pinly is not for anyone under 18. We do not knowingly create an account for a child, and we do not run behavioural advertising or tracking directed at children. If you believe a child's data has reached us, tell the grievance officer and we will delete it.
11.Security
Data is encrypted in transit, access to lead data is role-restricted and logged, phone numbers are masked on calls placed through the platform, and developer accounts see only the leads assigned to them. No system is perfect; if a breach affects your data we will notify you and the Data Protection Board as required.
12.Changes
If this policy changes materially we will tell you in the app before the change takes effect, and the date at the top will move. Continuing to use Pinly after that means the new version applies.
See also the terms of use, which carry the RERA disclaimer that applies to every listing on Pinly.