Privacy Policy

Last updated: 2026-07-05 · Policy version 1.0

ROOMNOW INFOTECH (“we”, “us”, or “our”) operates the RoomNow.in platform (the “Platform”). We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) for personal data described in this notice.

1. Personal data we collect

• Account data: name, email, mobile number, role (tenant or property owner), profile photo.
• Verification / KYC: identity and property documents you upload.
• Listing data: property details, photos, address, and pricing (owners).
• Transaction data: plan, payment status, and gateway reference IDs (not full card/UPI credentials).
• Usage data: pages viewed, searches, unlocks, device type, referrer (only if you consent to analytics cookies).
• Communications: OTP delivery metadata, support correspondence.

2. Purposes and lawful basis

• Account creation, authentication, and platform features — consent and performance of service.
• Subscriptions, contact unlocks, and payments — consent and contract.
• KYC and fraud prevention — consent and legal obligation where applicable.
• Sharing contact details after unlock — specific consent at the time of unlock.
• WhatsApp lead alerts to owners — consent as part of contact-sharing consent.
• Analytics — consent (optional cookies).
• Legal compliance, dispute resolution, and enforcement — legal obligation / legitimate uses under the DPDP Act.

3. Consent

We obtain your free, specific, informed, and unambiguous consent before processing personal data for the purposes above, except where the DPDP Act permits processing without consent. You may withdraw consent at any time from your dashboard (where available) or by contacting us. Withdrawal does not affect prior lawful processing.

4. Children

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children without verifiable parental consent. If you believe a child has provided data, contact us to request deletion.

5. Sharing and data processors

We share personal data only as needed:

• Between tenants and property owners when a contact unlock occurs (with your consent).
• Razorpay — Payment processing (India).
• MSG91 / Fast2SMS — SMS OTP and WhatsApp notifications (India).
• Hosting and infrastructure providers that store data in India.
• Government or regulatory authorities when required by law.

We do not sell your personal data.

6. Cross-border transfer

Primary storage and processing is in India. Where data is transferred outside India through subprocessors, we do so in compliance with applicable DPDP rules and contractual safeguards.

7. Retention

We retain personal data only as long as needed for the purposes above, your account is active, or as required by law. Analytics data is deleted after 365 days. Rejected KYC documents are removed after 90 days. You may request erasure via your dashboard or by contacting us.

8. Your rights (Data Principal)

Under the DPDP Act you may:

• Access and obtain a copy of your personal data (download from dashboard).
• Correct inaccurate data (profile settings).
• Request erasure (delete account from dashboard).
• Withdraw consent for optional processing.
• Nominate another person to exercise your rights in case of death or incapacity.
• Lodge a grievance with us (see below) and, if unsatisfied, with the Data Protection Board of India.

9. Security

We use reasonable technical and organisational measures including encryption in transit (HTTPS), access controls, private storage for KYC documents, and audit logging. No method is completely secure.

10. Personal data breach

If a personal data breach is likely to affect you, we will notify the Data Protection Board and affected Data Principals in accordance with the DPDP Act and applicable rules.

11. Grievance redressal

For privacy questions, access/correction/erasure requests, or complaints, contact our Grievance Officer. We will acknowledge and endeavour to resolve grievances within 30 days.

12. Changes

We may update this Policy. Material changes will be notified on the Platform. Continued use after an update may require renewed consent where mandated by law.