Privacy policy

1. Who we are

This policy covers the website and services operated by Just Prop, a real-estate brokerage. For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP), we are the Data Fiduciary for the personal data described below. Contact details for our Grievance Officer are at the end.

2. What we collect, and why

We collect only what a brokerage needs to do its job. Specifically:

• Contact details — name, phone number, email, country. Purpose: so an advisor can call you back and so we can send you the cost sheet, documents and receipts you ask for. Legal basis: your consent, given when you submit an enquiry form.
• Enquiry content — the project you enquired about, your budget, timeline and any message. Purpose: so the advisor picking up your file already knows what you have been shown, and so we do not re-pitch you something you have declined.
• Behavioural data — projects viewed, shortlisted and compared, searches saved, calculators used. Purpose: to rank what we show you, and to prioritise which enquiries an advisor calls first. Some of this is collected before you sign in, against an anonymous cookie identifier, and merged into your account if you later create one.
• Account data — your login, session cookie and password hash, if you create an account.
• Transaction data — booking, payment milestone, loan application and document status, where you transact through us. Purpose: to service the transaction and to meet our own record-keeping obligations.
• Technical data — IP address, device and browser type, and pages requested, in server logs.

3. What we do not do

We do not sell your personal data. We do not sell or rent your phone number to a list of brokers, which is the standard practice on classifieds-model property portals and is the reason a single enquiry there produces twenty calls. We do not run a bureau (credit) check without your separate, explicit, written consent. We do not store raw bank statements or KYC scans on our own servers — loan documents go directly into the lender's encrypted portal.

4. Who we share it with

Your data goes to a third party in exactly four situations:

• The developer or their authorised channel partner for the specific project you enquired about, so they can register the enquiry against our mandate — this is what allows us to be paid and you not to be.
• A lender, only when you ask us to submit a loan application, and only the data that application requires.
• Processors acting on our instructions — cloud hosting, communication (SMS, WhatsApp, email) and analytics providers, each bound by contract to use the data only for us.
• A public authority, where we are legally obliged to disclose.

5. How long we keep it

Enquiry and behavioural data: three years from your last interaction, then deleted or anonymised. Account data: until you close the account. Transaction records for a registered booking: eight years, because tax and brokerage-regulation record-keeping requires it. Server logs: 90 days.

6. Your rights under the DPDP Act

You may, at any time and free of charge:

• Ask for a summary of the personal data we hold about you and who we have shared it with.
• Ask us to correct anything inaccurate or incomplete.
• Ask us to erase your data. We will do so within 30 days, except where a registered transaction obliges us to keep the record.
• Withdraw your consent — including on a per-channel basis, from your notification preferences. Withdrawal is as easy as giving consent was, and it takes effect immediately for future processing.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
• Complain to the Data Protection Board of India if you are not satisfied with how we handled your request.

7. Cookies

We set a session cookie when you sign in, an anonymous identifier so your shortlist and recently-viewed survive before you have an account, a city preference cookie, and a notification-channel preference cookie. We do not set third-party advertising cookies. Blocking cookies will sign you out and lose an anonymous shortlist, but the site otherwise works.

8. Security

Passwords are stored as salted scrypt hashes, never in plain text. Sessions are signed, HTTP-only and expire after 30 days. Access to enquiry data inside our team is role-scoped — an advisor sees their own assigned files, a developer sees only enquiries against their own projects, and every read of another role's data is logged.

9. Children

Our services are not directed at anyone under 18 and we do not knowingly process a child's personal data. If you believe we have, tell the Grievance Officer and we will erase it.

10. Changes

If we change this policy in a way that materially affects how we use data you have already given us, we will tell you on the channels you have consented to before the change takes effect, and where the law requires it we will ask for fresh consent rather than assume it.

11. Grievance Officer

Write to hello@justprop.in with "DPDP request" in the subject line, or call 1800-266-5787 between 9:30 AM to 6:30 PM. Postal address: Ramdaspeth, Nagpur, Maharashtra 440010. We acknowledge within 72 hours and resolve within 30 days.

You can change what we may contact you on at any time from your notification preferences.