Privacy Policy

Version 1.0 · Last updated 2026-05-27

RDN ("we", "us") is the Data Fiduciary for personal data processed through the RDN platform (website, web app, and mobile apps). This notice complies with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable rules.

1. Data we collect

• Account: phone number (mandatory), name, email (optional), role, society affiliation.
• Property listings (owners): address, photos, amenities, pricing.
• Dealer applications: KYC documents, bank details (encrypted).
• Communications: in-app chat messages, masked call metadata (not call recordings).
• Device + usage: device push token, app version, IP, coarse location (city), interaction telemetry.
• Payments: transaction status and amount; card / UPI details are handled by Razorpay and are not stored by us.

2. Purposes

• Provide and operate the RDN platform (account, search, listings, leads, chat).
• Identity verification (OTP via MSG91), dealer KYC.
• Masked communication routing (Exotel).
• Payments and commission settlement (Razorpay).
• Notifications: push (FCM), email (AWS SES), WhatsApp (Interakt).
• Fraud prevention, abuse detection, grievance handling, legal compliance.
• Aggregate analytics. We do not sell personal data.

3. Legal basis

We process your data on the basis of your consent obtained at signup and when you grant additional permissions, and on legitimate uses recognised under Section 7 of the DPDP Act (e.g., performing a service you requested, complying with law).

4. Where your data is stored

• AWS Mumbai region (RDS Postgres, S3) — primary storage.
• Cloudflare R2 (UAT period only) — primary storage during pilot.
• Firebase Cloud Messaging (Google, US-hosted) — push notification delivery.
• Sentry (US or EU region) — crash reports (PII scrubbed before send).
• MSG91, Razorpay, Exotel, Interakt — Indian vendors for OTP, payments, calls, WhatsApp.

5. Retention

We retain data for the periods set out in our Retention Policy. Highlights: OTPs ~5 minutes, sessions 30 days, chats 2 years post-listing-close, property listings 7 years, financial transactions 7 years (legal requirement), audit logs 1 year.

6. Your rights (DPDP Sections 11–15)

• Access & portability: request a JSON export of your data from Profile → Data export.
• Correction: edit your profile in-app.
• Erasure: delete your account from Profile → Delete account. Active leads, transactions, and legally required records are retained per Section 8(7) and purged after the retention period.
• Nominate: set a nominee for post-mortem account handling in Profile.
• Withdraw consent: Profile → Manage consent.
• Grievance redressal: see Section 9.

7. Children

RDN is intended for users aged 18 and above. We do not knowingly process personal data of children. If you believe a child has provided us data, contact the Grievance Officer for prompt removal.

8. Security

Sensitive fields (phone, KYC, bank details) are encrypted at the application layer (AES-256-GCM) before storage. TLS in transit. Restricted database IAM. PII scrubbed from application logs and crash reports.

9. Grievance Officer

For data protection grievances, contact our designated Grievance Officer:

• Name: [Grievance Officer Name — to be designated]
• Email: grievance@rdn.example.com
• Phone: +91-XX-XXXX-XXXX

We will acknowledge within 7 days and resolve within 30 days. If unsatisfied, you may approach the Data Protection Board of India.

10. Changes

We may update this notice. Material changes will prompt a fresh consent in-app.