Privacy Policy

Homalaya (homalaya.com) is run by Ira Internet Services Private Limited (CIN U63122JH2026PTC028411), registered office 847/2, At Sindoor, Hazaribagh, Jharkhand 825301, India. We decide why and how your personal data is used, so under the Digital Personal Data Protection Act, 2023 we are its "Data Fiduciary".

This policy covers the Homalaya website, the app you can install from it, and the messages we send you. Our Terms & Conditions cover how Homalaya may be used.

• Your phone number, when you sign in with a one-time code sent by WhatsApp or SMS.
• Your name, email address, profile photo and Google account ID, when you sign in with Google.
• The name shown on owners' listings as “Posted by”. Unless an owner sets another name, it is the name on their billing details.
• Property details you list: type, size, rent or price, deposit, amenities, availability, description and photos.
• Text that appears in your photos, which our automated checks read to spot contact details and unsafe content.
• Your property's private address and exact map pin. These are never shown publicly; listings show only an approximate area.
• Your device's location, only if you tap “I'm at the property – use my location” while placing your property's pin. It is used once, to place the pin.
• Enquiry details: your name, phone number, message and callback or visit preferences, when you contact an owner.
• Billing details for invoices: name, address, state, PIN code and, if you give one, GSTIN.
• Payment records: amount, order and status. Your card, UPI and bank details go to Cashfree and are never seen or stored by us.
• Your saved homes, saved searches and alert choices.
• Reports you send about a listing: the reason you chose.
• Browser notification subscriptions, if you turn on alerts on a device. These are stored encrypted.
• Technical data: IP address, browser and device type, sign-in sessions and security logs.
• Only if you allow it: an anonymous browser ID, the pages and listings you view, your searches, and Facebook's ad click and browser IDs.
• Messages you send us, such as support requests and complaints.

We do not ask for Aadhaar, PAN, bank account details or identity documents. Please do not include them in photos or descriptions.

• To create and secure your account and sign you in.
• To publish owners' listings with the details they choose to show, and to let renters and buyers search them.
• To pass your enquiry to the owner you contacted and, where an owner turns on “Tenants can WhatsApp me”, to let signed-in renters or buyers contact them.
• To take listing payments, issue GST invoices and handle refunds.
• To send the messages you asked for: sign-in codes, enquiry and payment updates, listing reminders, saved-search alerts and browser notifications.
• To check listings and photos for fraud, duplicates and unsafe content. Automated tools approve photos that pass their checks and read listing text for unsafe content; anything they flag is held for a person to review.
• To keep Homalaya secure, fix problems and prevent abuse.
• Only if you allow it: to understand how Homalaya is used and to measure our ads with Meta.
• To meet legal obligations, such as keeping tax records and answering lawful requests from authorities.

We do not sell your personal data, and we do not use it for any purpose not listed here.

When you sign in, you agree to this policy and our Terms & Conditions for the purposes above. We record when you agreed and to which version. Some data you give us for one purpose, such as an enquiry to an owner, is used only for that purpose.

Analytics and ad measurement need a separate yes. If you arrive from one of our ads, Homalaya asks you; anyone can allow or refuse them at any time under “Privacy choices” at the bottom of every page. Until you allow them, nothing is measured. Refusing changes nothing else on Homalaya.

Other people on Homalaya

• Anyone can see a live listing's details, photos, approximate location and the owner's display name. Never its private address, exact pin or phone number.
• When you send an enquiry, the owner of that listing receives your name, phone number and message, so they can reply.
• If an owner turns on “Tenants can WhatsApp me”, signed-in renters or buyers can see their number on that listing.
• When you tap to call or WhatsApp an owner, they see your name, phone number and, if your account has a verified email, your email, so they know who contacted them.
• AI assistants such as ChatGPT and Claude can look up live listings through Homalaya's public connection for AI assistants (MCP). They get the same public listing details anyone can see, never an owner's name, phone number, private address or exact pin.

Companies that run parts of Homalaya for us

They work under contract, only on our instructions and only for this work. The law calls them our “Data Processors”.

• Cashfree Payments: payments and refunds. It receives your phone number and, if your account has one, your email.
• MSG91: WhatsApp and SMS messages, including sign-in codes.
• Cloudflare: delivering the website, security, photo storage, and automated checks of photos and listing text.
• Hosting providers: the servers and database Homalaya runs on.
• Amazon Web Services: sending email, and storing our service settings.
• Google: sign-in with Google, maps, and nearby places around a listing's approximate location.
• Meta: measuring our ads, only if you allow analytics and ad measurement.
• Sentry: error and performance reports, set up to remove phone numbers, sign-in codes and session tokens before they are sent.

Authorities

When the law requires it, for example a lawful request to prevent or investigate a crime, or a court order.

If Homalaya's business is sold or merged, your data would pass to the new owner under this policy, and we would tell you first.

Your data may be stored and processed outside India, on our own servers and by some of the companies above, such as Cloudflare, Google, Meta and Sentry. Indian law allows this unless the Government restricts transfers to a country, and we follow any such restriction. Download my data lists every company your data goes to.

• Needed to run Homalaya, always on: sign-in cookies, and browser storage that keeps your listing drafts, recent choices and settings on your device.
• Only if you allow analytics and ad measurement: an anonymous browser ID, and Facebook's click and browser IDs (_fbc, _fbp).

Change your choice at any time under “Privacy choices” at the bottom of any page.

• Your account: until you delete it.
• Listings: until you delete them or your account. Ended listings are kept so you can renew them without starting again; a listing nobody has touched for three years is deleted.
• Enquiries: while the listing exists; deleting a listing deletes its enquiries. If you delete your account, your name, phone number, message and visit or callback preferences are removed from enquiries you sent.
• Text our automated checks read in a photo: 30 days, or until the photo is removed if that is sooner.
• Reports you send about a listing: until the listing is deleted or removed, then within a day.
• Payment records and invoices: as long as tax and company law require, currently up to 8 years, even after your account is deleted.
• The phone number and email of a deleted account: 180 days, as the IT Rules 2021 require. Nothing else uses them.
• Sign-in codes: 7 days. Sign-in sessions and message delivery records: 30 days. Analytics events: 90 days. Security audit logs: 180 days.
• Encrypted backups: one year, as the DPDP Rules 2025 require for personal data and logs, then deleted.

Deleting a listing or your account removes its data from Homalaya straight away. Copies in encrypted backups are deleted as those backups expire, within a year.

• Connections to Homalaya, and between our systems, are encrypted.
• Exact addresses and map pins are never shown publicly, and location data inside photos (EXIF/GPS) is removed when photos are processed.
• Photos stay private until we approve them.
• Backups and browser notification subscriptions are encrypted.
• Staff access is limited by role and protected by single sign-on, and we log which staff member viewed personal data.

No system is perfectly secure. If a breach affects your data, we will tell you without delay, and report it to the Data Protection Board of India and CERT-In as the law requires.

• See your data: download a copy of everything we hold about you, and who we have shared it with, from Account settings › Download my data. You can also ask our Grievance Officer.
• Correct or update it: edit your listings and billing details in your account, or email us about anything else.
• Delete it: delete a listing from My listings, or your whole account from Account settings › Delete account. Both take effect straight away.
• Withdraw consent: change “Privacy choices”, turn off notifications, or delete your account. What happened before stays lawful, and without some data we may not be able to provide some services.
• Nominate someone to use these rights for you if you die or cannot act yourself: email our Grievance Officer with their name and contact details.
• Complain: to our Grievance Officer first and, if you are not satisfied, to the Data Protection Board of India.

Delete your account

To identify you, we ask for the phone number or email address on your account. We answer every request within the time in section 12.

Homalaya is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18, and we do not track or target ads at children. If you think a child has used Homalaya, tell our Grievance Officer and we will delete their data.

For any question or complaint about your data, or to use any of your rights, contact our Grievance Officer:

Rajaram Dangi, Grievance Officer
Email: [email protected]
Ira Internet Services Private Limited, 847/2, At Sindoor, Hazaribagh, Jharkhand 825301, India

We acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

When this policy changes we update this page and its date. If a change matters for how we use your data, we tell you on Homalaya and, where needed, ask for your agreement again.