Privacy Policy

Who we are

Urban Dwaar Prop. Sarthak Vinayak Niwate is a MahaRERA-registered Real Estate Agent (Registration No. A031182602887) operating in Maharashtra, India. We are an independent real estate advisory helping home buyers and investors evaluate RERA-registered projects across Mumbai, Thane, Navi Mumbai, and Pune. We are a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

What data we collect

We collect the following categories of personal data:

• •Name, collected when you submit an enquiry form
• •Mobile phone number, same source
• •Property interest and budget range, same source
• •WhatsApp conversation content, if you contact us via WhatsApp
• •Page visit data (anonymised), via Google Tag Manager
• •IP address, retained for security rate-limiting, auto-deleted after 30 days

Why we collect it (purpose)

We collect your name and phone number solely to:

• •Respond to your property enquiry
• •Connect you with an Urban Dwaar advisor
• •Send you information about properties you expressed interest in

How long we keep it (retention)

We retain your personal data for a maximum of 12 months from the date of your last interaction with us. After 12 months with no further contact, your personal identifiers (name and phone number) are permanently deleted from our systems.

Anonymised analytics data (page views, conversion events) may be retained longer for business analysis, this data cannot be used to identify you.

Your rights under DPDP Act 2023

You have the following rights regarding your personal data:

• •Right to access: Know what data we hold about you
• •Right to correction: Ask us to correct inaccurate data
• •Right to erasure: Request permanent deletion of your personal data
• •Right to withdraw consent: Withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal.
• •Right to grievance: Raise a complaint with us or with the Data Protection Board of India

To exercise any of these rights, use the form below or contact our Grievance Officer.

Data rights request form

Use this form to submit any data rights request.

IGRS transaction data

Urban Dwaar accesses property registration transaction data from Maharashtra's public IGRS portal at igrsmaharashtra.gov.in. We process and display only non-personal attributes of transactions (amounts, dates, property descriptions, SRO details). We do not collect, store, or display the names of buyers or sellers from registration records.

The underlying registration records are public documents under Section 57 of the Registration Act, 1908. Urban Dwaar's access to this data is in compliance with Section 57 and the National Data Sharing and Accessibility Policy (NDSAP), 2012.

Transaction Intelligence Data

What we collect when you purchase a transaction report

When you unlock transaction data on Urban Dwaar, we collect and store:

• •WhatsApp number (hashed): When you enter your WhatsApp number in the unlock modal, we store a one-way cryptographic hash of your phone number. We never store your raw phone number on Urban Dwaar's servers. The hash is used to identify your purchases across devices and sessions. It cannot be reversed to recover your phone number.
• •Payment information: Your payment is processed by Razorpay, an RBI-licensed payment aggregator. Razorpay collects and stores your card, UPI, or banking details directly. Urban Dwaar never sees or stores your payment credentials. We receive and store: Razorpay order ID, Razorpay payment ID, the amount paid (in paise), GST collected, and the timestamp of payment. This information is required for GST compliance under the Central Goods and Services Tax Act, 2017.
• •Purchase record: We store which society or project report you purchased, the tier (Data Peek, Society Report, Negotiation Brief), and the validity period (365 days from purchase date). This is used to grant you access when you return to the site.
• •Session cookie: After payment, we set an HttpOnly session cookie in your browser. This cookie contains a signed, encrypted record of your purchases. It is stored only in your browser; we do not maintain a server-side session. The cookie expires after 365 days.
• •WhatsApp messages: If you interact with Aryan, our WhatsApp advisory agent, your WhatsApp messages are processed to provide responses and transaction report delivery. Message content is not sold or shared with third parties.

What we do NOT collect or store

We do not store buyer names, seller names, or any personally identifiable information from IGRS property registration records. IGRS records contain names of parties to property transactions. We deliberately exclude these from our database. No name from any IGRS record is ever displayed on Urban Dwaar.

We do not store your raw phone number anywhere on Urban Dwaar's servers.

We do not create user accounts or store passwords.

How we use your WhatsApp number

Your WhatsApp number (hashed) is used for:

• •Delivering your transaction report after payment
• •Sending a payment receipt and access instructions
• •Restoring your access on a new device when you visit urbandwaar.com/restore
• •Sending property-related advisory updates from Aryan (you can opt out by replying STOP to any message)

We do not use your WhatsApp number for unsolicited marketing. We do not sell or share your WhatsApp number with third parties, advertisers, or developers.

Razorpay data sharing

To process your payment, we share with Razorpay: the amount, currency, and a reference number. Razorpay's privacy policy governs how they handle your payment credentials.

Your rights under the Digital Personal Data Protection Act, 2023

Under DPDPA 2023, you have the right to:

• •Access: Request confirmation of what data Urban Dwaar holds about you, identified by your WhatsApp number.
• •Correction: Request correction of inaccurate data we hold.
• •Erasure: Request deletion of your data. Upon a verified erasure request, we will delete your purchase records, hashed phone number, and lead data. We cannot delete GST-relevant payment records for the legally mandated retention period (currently 8 years under GST law), but we will dissociate them from your identifier.
• •Grievance redressal: You can raise a grievance by WhatsApp message to Aryan or by email to us. We will acknowledge within 48 hours and resolve within 30 days.

To exercise any of these rights, send a WhatsApp message to +91 98333 00864 with the text "DATA REQUEST" or email support@urbandwaar.com from the email associated with your Razorpay payment.

Data retention

• •Purchase records: 365 days from the purchase date (your access validity period). After expiry, purchase records are anonymised (hashed phone removed).
• •Payment records (for GST): 8 years as required by the Central GST Act.
• •WhatsApp lead data: 2 years from the date of collection, or until you request deletion.
• •Session cookies: Expire after 365 days or when you clear your browser data.

IGRS data

All property transaction data displayed on Urban Dwaar is sourced from the Inspector General of Registration and Stamps (IGRS), Maharashtra. This data is in the public domain under Section 57 of the Registration Act, 1908. Urban Dwaar does not own this data. We have organised, cleaned, and structured it for easier access. We do not modify prices, dates, or any registered values.

Cookies and analytics

We use Google Tag Manager (GTM) and Meta Pixel to measure how visitors use our website. These tools collect anonymised data about page visits and form submissions. No personally identifiable information is shared with these platforms.

You can opt out of Google Analytics tracking at: tools.google.com/dlpage/gaoptout

We set one transactional HttpOnly cookie named ud_session after a successful payment. This cookie is used to maintain your purchase access across page loads on the same browser. It is not used for advertising or tracking. It expires after 365 days.

Data security

We store personal data in Supabase, a SOC 2 Type II certified cloud database platform. Access to personal data is restricted to:

• •The Urban Dwaar advisor (via password-protected admin panel)
• •Server-side functions that process form submissions

All data transmission is encrypted via HTTPS (TLS). Admin access requires authentication and sessions expire after 8 hours.

Grievance Officer

For any privacy-related concerns or to exercise your data rights, contact our Grievance Officer:

For data protection queries specifically, you may also message Aryan on WhatsApp with the text DATA REQUEST.

If your concern is not resolved, you may contact the Data Protection Board of India at: dpbi.gov.in (once operational)

Changes to this policy

We may update this policy as our practices evolve or as required by law. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated via our website.