Privacy Policy

Last updated: 26 July 2026

In short: we collect your name, mobile number and email so you can log in, list a property, or contact an owner. We never sell your data. We share an owner's contact details only when a seeker pays to unlock them, and we share your details with that owner in return. You can ask us to correct or delete your data at any time by writing to [email protected].

1. Who we are

RentalSpaces ("RentalSpaces", "we", "us") is a rental property marketplace operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], India (CIN [CIN] · GSTIN [GSTIN]). We are the "Data Fiduciary" for the personal data described in this policy, as that term is used in India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

Questions about this policy, or about your data, go to our Grievance Officer: [GRIEVANCE OFFICER NAME], [email protected]. We aim to acknowledge within 48 hours and resolve within 30 days.

2. What we collect, and why

Data	Why we need it	Legal basis
Mobile number	To sign you in via OTP, and to connect seekers with owners	Necessary to provide the service you asked for
Name and email	To identify you on listings and enquiries, and to send receipts	Necessary to provide the service
Property details and photos you upload	To publish your listing	Your consent, given when you publish
Payment records (amount, time, reference)	To confirm contact unlocks and Managed Rental Assistance orders	Legal obligation (tax and accounting records)
Usage data — pages viewed, device type, approximate location from IP	To keep the site working, prevent abuse, and improve what we show you	Our legitimate interest in operating a safe service

We do not store your card, UPI or netbanking details. Payments are handled by Razorpay Software Private Limited, a PCI-DSS compliant payment gateway. We receive only a payment reference and status from them.

3. When we share your data

We share personal data in four situations, and no others:

When contact is unlocked. If you pay to unlock an owner's or agent's contact details, we show you their name and phone number — and we give them yours, so they can respond. This exchange is the service; if you would rather not share your details, do not unlock a contact.
With service providers who run parts of the platform — our payment gateway (Razorpay), our SMS/OTP provider (MSG91), our email provider, and our hosting provider. They may process your data only on our instructions.
When the law requires it — in response to a lawful order from a court, tax authority or law-enforcement agency.
If the business is sold or merged — in which case we will tell you before your data moves, and the buyer will be bound by this policy.

We do not sell your personal data, and we do not share it for third-party advertising.

4. Cookies and analytics

We use cookies to keep you signed in and to remember your search preferences. We also use Google Analytics 4 and Google Tag Manager to understand which pages people find useful. These set cookies that record how you use the site. You can block cookies in your browser settings — the site will still work, but you may be signed out between visits.

5. How long we keep it

Account data — while your account is open, and for 12 months after you close it, in case you return.
Listings — while published, and for 12 months after you remove them.
Payment and invoice records — 8 years, as required by Indian tax law.
OTP logs — 90 days, for fraud investigation.

6. Your rights under the DPDP Act

You can ask us to:

Show you the personal data we hold about you, and who we have shared it with.
Correct anything inaccurate, incomplete or out of date.
Erase your data, where we are not required by law to keep it.
Withdraw consent you previously gave — this does not undo processing already carried out.
Nominate someone to exercise these rights on your behalf if you die or become incapacitated.

Write to [email protected] and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

7. Keeping your data safe

We serve the whole site over HTTPS, store passwords using one-way hashing, and limit internal access to personal data to staff who need it. No system is perfectly secure, and we cannot guarantee that a determined attacker will never succeed. If a breach affects your personal data, we will notify you and the Data Protection Board as required by the DPDP Act.

8. Children

RentalSpaces is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, tell us and we will delete it.

9. Changes to this policy

If we change how we handle your data, we will update this page and change the date at the top. Where the change is significant, we will tell you by email or on-site notice before it takes effect.

10. Contact

[LEGAL ENTITY NAME], [REGISTERED ADDRESS], India
General queries: [email protected]
Billing: [email protected]
Grievance Officer: [GRIEVANCE OFFICER NAME], [email protected]