Privacy Policy
Version 28 September 2026. This is a working draft that reflects how the Platform actually handles data today. It is not legal advice and must be reviewed by a qualified Indian lawyer before go-live, and is written to align with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and its rules as they come into force.
1. Who We Are and Who This Covers
Qlooto Real Estate ("the Platform," "we," "us") is operated by Qlooto Technologies, Noida, Uttar Pradesh, India, which is the Data Fiduciary for the personal data described here.
This Policy covers anyone who visits or registers on the Platform ("you," a "Data Principal" under the DPDP Act).
2. What We Collect
| Category | What | Why |
|---|---|---|
| Account data | Email address, password (hashed, never stored in plain text), pseudonymous handle, chosen avatar | To create and secure your account |
| Consent records | Which version of the Terms and this Policy you agreed to, whether you ticked the optional marketing box, and when | Legal record of consent |
| Profile answers (optional) | What you choose to tell us after signing up: city you're looking in, localities you're interested in, buying stage, whether you're a first-time buyer / upgrading / investor / NRI, budget range, when you plan to buy, configuration, what matters most to you, a short bio, any commercial-interest disclosure | To set up your dashboard and show you relevant projects and discussions, and — in aggregate — to understand who uses the Platform (see §6) |
| Activity | Projects, localities and developers you follow; posts, votes and flags; when you were last active | To run the Platform's core features and to measure whether it's useful to people |
| How you found us | The campaign details in the link you first arrived through (for example "utm_source=facebook"), the website that referred you (the site name only, not the full address), the first page you landed on, when you first visited, and your device type and browser | To understand which channels and ads bring people to the Platform (see §5) |
| Verification data | A purchase/booking document, submitted voluntarily | To confirm a project/unit-type match — processed and deleted in the same request; never stored (see §4) |
| Content you post | Questions, answers, milestone reports, structured ratings, pricing reports, optional photos | The Platform's core purpose |
| Technical data | IP address and device/browser details, used transiently for security and rate-limiting; basic error logs | Security, abuse prevention, reliability |
What other people can see. Your public profile shows your handle, avatar, reputation level, the month you joined, your bio and commercial-interest disclosure if you add them, your contribution and "found helpful" counts, the projects where your purchase is verified (the project only — never the unit type), and your posts. Your buying stage, what you're looking for and the places you follow are private unless you switch them on from your profile. Your budget, purchase timeline, buyer type and email are never shown. Profiles are not listed in search engines, and suspended or deleted accounts have no public profile.
We do not ask for your real name, phone number or home address, and we do not store your IP address against your account. If you put personal details into a post, our moderation treats that as content to remove.
3. What We Don't Do
- We do not sell personal data to anyone.
- We do not share your data with developers or brokers.
- We do not accept payment from developers or brokers for data, placement or visibility.
- We never use anything from a verification document for marketing, advertising or analytics.
- We never reveal which real person is behind a handle.
4. Verification Documents — "Extract, Then Delete"
This is the most sensitive data category, so it has its own explanation:
- When you submit a verification document, it is sent over an encrypted connection and held only in temporary, encrypted storage for the duration of that request.
- A check confirms whether the document matches the project/unit type you're verifying.
- The raw document is deleted before the request completes — not archived, not queued for later deletion, not kept as a backup.
- Only the result is kept: verified or not, and for which project/unit type.
By design there is no store of verification documents to lose, breach, or be compelled to produce.
5. Cookies and Similar Technology
We use these first-party cookies:
| Cookie | Purpose | How long |
|---|---|---|
qlooto_session |
Keeps you signed in. Essential — the Platform cannot work without it. | Up to 30 days, or until you sign out |
qlooto_ft |
Remembers how you first arrived (the campaign details in the link and the referring site's name), so that when you sign up we can record which channel brought you. It holds no name, email or IP address. | 90 days |
qlooto_tracking |
Remembers your answer to the cookie notice below (allow or not). | 180 days |
qlooto_signup |
Set for a few minutes after you sign up, so that — only if you allowed the ad tags below — one signup can be counted. It holds nothing about you. | 30 minutes |
Advertising measurement (only with your consent). We may use the Meta Pixel and the Google tag (Google Analytics / Google Ads) to see which of our ads bring people to the Platform. They load only if you press "Allow" in the cookie notice; if you don't, they never run. When they run, Meta and Google receive the pages you visit, technical details of your browser and device, and — if you sign up — the fact that a signup happened (not your email, handle or anything you post). They set their own cookies and process this under their own policies. They never run on admin, developer or news-desk pages. You can change your answer at any time with "Change your cookie choices" at the top of this page.
Update emails. If you opted in to update emails, links in them may pass through a Qlooto address (qlooto.com/e/…) so we can count how many times each link is clicked. We count clicks per link only, not who clicked.
6. How We Use Your Data
- To run the Platform: your account, what you follow, your posts, notifications, and verification results.
- To keep it safe and fair: moderation, preventing abuse and spam, and enforcing the Terms. Our team may keep short internal notes and labels on an account for this purpose (for example, a record of a harassment report). These are visible only to Platform administrators.
- To understand our audience in aggregate: we look at combined figures — for example, how many users are looking in a given city or budget range, or which channels bring people who go on to use the Platform. Moderators do not have access to this; it is limited to the Platform's founders.
- To contact you: account and security emails (always), activity notifications (you can turn these off in Settings → Notification preferences), and — only if you opted in — updates and offers (see §7).
7. Marketing and Advertising — Only With Your Consent
At signup (and at any time afterwards in Settings → Notification preferences) you can choose to tick an optional box allowing Qlooto to send you updates and to use your activity on the Platform to show you relevant ads on Facebook and Instagram. It is unticked by default and you never have to tick it to use the Platform.
If you opt in, we may include you in audience lists we upload to Meta Platforms (which runs Facebook and Instagram) using its "Custom Audiences" tool, so that we can show you our ads or find people with similar interests ("lookalike audiences"). For these uploads:
- We share only your email address, converted into a one-way code (SHA-256 hashing) before it leaves our systems, together with the country (India), coded the same way. Meta uses the code only to match people who already have an account with it, and states that it deletes the codes after matching.
- We never share your handle, your posts, your profile answers, your verification status, or anything from a verification document.
- Only the Platform's founders can create these lists, and every upload is recorded in our internal audit log.
If you do not opt in, or later withdraw, you are never included in these uploads. You can withdraw at any time by unticking the box in Settings → Notification preferences; this takes effect for every upload after that moment. Audiences already uploaded to Meta expire under Meta's own retention rules.
8. How Long We Keep Data
- Verification documents: deleted immediately, as above.
- Account, profile, activity and "how you found us" data: kept while your account is active.
- When you delete your account (Settings → Delete account), we immediately erase your password, avatar choice, profile answers, marketing consent, "how you found us" data, the things you follow, your notifications and sessions, your consent records, and any internal team notes about you, and your account stops showing your handle or email anywhere. The IT Rules, 2021 require us to keep an account's registration details for 180 days after it is deleted, so your handle and email are kept in a sealed record, used only to answer a lawful request from a government agency, and erased automatically when the 180 days are up. Your posts stay on the Platform, shown under an anonymous "deleted-…" name, because removing them would break other people's discussions. You can ask the Grievance Officer to remove specific content where technically and legally feasible.
- Backups: encrypted backups follow a fixed rotation schedule; deletions take effect in the live system immediately and in backups when they rotate out.
9. Your Rights (DPDP Act)
You may:
- Access your data — download a full copy yourself at any time from Settings → Download my data (JSON, spreadsheet or PDF), or ask us.
- Correct inaccurate data — most of it you can edit yourself on your profile and in Settings.
- Erase your account and personal data — Settings → Delete account, or ask us (see §8 for exactly what happens).
- Withdraw consent — marketing consent at any time in Settings → Notification preferences; withdrawing consent to the Terms/this Policy means closing your account.
- Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
- Complain — to our Grievance Officer first (§10), and if you are not satisfied, to the Data Protection Board of India.
To make a request by email, write to privacy@qlooto.com from the address on your account. We may ask you to confirm your identity before acting on a request made by email.
10. Grievance Officer / Data Protection Contact
Manoj Singh, Grievance Officer
Qlooto Technologies, B-75, Sector 63, Noida, Uttar Pradesh 201301
Complaints: grievance@qlooto.com
Data-rights requests (access, correction, erasure, nomination) and questions about your personal data: privacy@qlooto.com
All our contact addresses are on the Contact page.
We acknowledge grievances within 24 hours and resolve them within 7 days, as the IT Rules, 2021 (as amended in 2026) require, and act on data-rights requests within the timelines the DPDP Act and its rules set.
11. Service Providers We Use
| Service | Purpose | Data involved | Location |
|---|---|---|---|
| Hosting (Hostinger VPS, managed with Coolify) | Running the Platform and its database | All of the above, as the underlying infrastructure | [ confirm server region ] |
| Transactional email (Resend) | Sending account, notification and — if you opted in — update emails | Email address, email content | United States |
| Content-safety scanning (OpenAI moderation API) | Automatically screening uploaded images before they are published | The image, only at the moment of upload | United States |
| Meta Platforms (Custom Audiences) | Showing our ads to people who opted in (§7) | Hashed email and hashed country only, and only for users who opted in | Outside India |
| Meta Platforms (Meta Pixel), if enabled | Measuring which ads bring visitors and signups (§5) | Pages visited, browser/device details, a signup event — only for visitors who allowed it in the cookie notice | Outside India |
| Google (Google tag — Analytics / Ads), if enabled | Measuring which ads bring visitors and signups (§5) | Pages visited, browser/device details, a signup event — only for visitors who allowed it in the cookie notice | Outside India |
| Error tracking (Sentry), if enabled | Diagnosing technical failures | Technical/device data; configured to avoid personal content | [ confirm region ] |
Where a provider processes data outside India, we transfer it only as permitted under the DPDP Act and any restrictions the Government notifies. [ Confirm each provider and region before launch; remove any that are not in use. ]
12. Children
The Platform is for adults. We do not knowingly collect data from anyone under 18. If we learn that a user is a minor, we will suspend the account and delete its personal data.
13. Security
- Passwords are hashed (bcrypt) and never stored or logged in plain text.
- Sessions use secure, HTTP-only cookies; only a one-way hash of each session token is stored.
- Verification documents are encrypted at rest for the brief moment before deletion (§4).
- Administrative access is limited to the Platform's founders and moderators, with every administrative action recorded in an audit log; moderators cannot see marketing or audience data.
14. Data Breach Notification
If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as the DPDP Act and its rules require.
15. Changes to This Policy
We will announce material changes on the Platform before they take effect. The version you agreed to is recorded against your account. Changes that affect marketing or advertising never switch you into marketing use: that always requires your separate opt-in (§7).
Open items before go-live: confirm hosting and error-tracking regions and the final provider list (§11); full legal review against the DPDP Act rules as notified.