Who we are
CiyaR (“we”) operates the CiyaR website and apps, a property marketplace based in Coimbatore, Tamil Nadu. For the personal data described here, we are the Data Fiduciary under the DPDP Act. Listers (owners, agents, builders) who receive your application data act on their own behalf for the rental or sale they are conducting.
Data we collect
- Account: name, mobile number (verified by OTP), email (optional), role, language and theme preference.
- Searches and activity: saved homes, saved searches, enquiries, visit bookings, applications, offers and messages exchanged through CiyaR.
- Documents you upload: ID (Aadhaar must be masked — we keep only the last 4 digits), income proof, references, property documents (Patta, EC, tax receipt) and payment proofs.
- Listings: property details, photos and an approximate or exact location you choose.
- Technical: device and log data (IP address, browser, pages viewed, errors) needed to run and secure the service.
We do not collect more than we need for the purposes below, and we do not buy personal data from third parties.
Why we use it
- To run your account and show you relevant listings and alerts.
- To pass your enquiry, visit request, application or offer to the lister you chose.
- To verify listers and listings and prevent fraud, spam and misuse (for example rate-limiting enquiries and detecting duplicates).
- To generate agreements, receipts and records you ask for.
- To send service messages (OTP, visit reminders, application updates). Marketing messages only with your separate consent.
- To comply with law and respond to lawful requests from authorities.
Consent and withdrawal
Where we rely on consent, we ask for it clearly and for a specific purpose — for example, when you share documents with a named lister for a named property. You can withdraw consent at any time from your account (for example, withdrawing an open application). Withdrawal is as easy as giving consent; it does not affect processing done before withdrawal, and some features may stop working without the data.
Document vault and access log
- Documents are stored encrypted in a private bucket and opened only through short-lived signed links.
- Only the lister you consented to (and CiyaR staff with a specific need, such as verification or a dispute) can view them.
- Every view and download is logged — who, when and why — and you can see that log in your account.
Who sees your data
- Listers you contact see your name and the details of your enquiry or application. Your phone number is shared only when you choose to share it.
- The public sees listing content and, for agents and builders, their professional profile (name, firm, RERA number, service areas, reviews). Owners' personal details are never shown publicly.
- Service providers (processors) who host or operate the service for us under contract — see below.
- Authorities when required by law.
We do not sell or rent your personal data to anyone, and we do not share it with advertisers.
How long we keep it
- Rejected or withdrawn applications: documents are deleted 90 days after the application is closed.
- Residents (tenancies made through CiyaR): documents are kept for the tenancy plus 3 years after move-out, then purged automatically.
- Account data: while your account is active; on deletion we erase or anonymise it, except records we must keep by law (for example payment receipts and tax records).
- Logs: security and access logs are kept for a limited period for fraud prevention and audits.
Your rights
Under the DPDP Act you can:
- Access a summary of the personal data we hold about you and who we have shared it with;
- Correct, complete or update inaccurate data;
- Erase data that is no longer needed (subject to legal retention);
- Withdraw consent and nominate someone to exercise your rights if you die or become incapacitated;
- Raise a grievance with us, and if unresolved, with the Data Protection Board of India.
Most of this can be done from your account settings; otherwise write to the grievance officer below. We respond within the time limits set under the DPDP Rules.
Children
CiyaR is meant for adults. We do not knowingly process personal data of children (under 18) without verifiable consent of a parent or guardian, and we do not track or target advertising at children. Students under 18 looking for a hostel should ask a parent or guardian to make the enquiry.
Cookies
We use only what the site needs: a session cookie to keep you signed in, and small preferences for theme (light/dark) and language. We do not use advertising or cross-site tracking cookies.
Processors and where data is stored
- Amazon Web Services, Mumbai region (ap-south-1) — hosting, database and encrypted file storage in India.
- Keycloak (self-hosted on our infrastructure) — sign-in and identity management.
- SMS / WhatsApp and email delivery providers — only the contact details and message needed to deliver a notification.
- Map tiles from OpenStreetMap — your browser requests map images; we do not send your personal data to them.
No owner look-ups from land records
We do not build owner-lookup features from land or registration records, and we never publish owners' names from such records. Land-record checks (Patta, EC) happen only for a listing, at the owner's request and with their consent. See data sources.
Security and breaches
We use encryption in transit and at rest, role-based access, audit logs and regular reviews. If a personal data breach affects you, we will inform you and the Data Protection Board as required by law.
Grievance officer and contact
Grievance Officer: [Name to be appointed], CiyaR, Coimbatore, Tamil Nadu. Email: [email protected]. For general support, see contact us.
We may update this policy; material changes will be notified in the app or by email before they take effect.