1. Introduction
This Privacy Policy describes how AskRera ("we", "us", "our"), operated by Eskay Tech, a company incorporated in Singapore, collects, uses, and protects information when you use the Service. We follow the Digital Personal Data Protection Act, 2023 (DPDP Act) and related Indian regulations.
By creating an account or buying a report, you consent to the processing described in this policy. You may withdraw your consent for non-essential processing, such as analytics and advertising cookies, at any time as described in the cookies section below. Withdrawing consent does not affect purchases you have already made or processing that is needed to deliver them.
2. Information we collect
We collect a limited set of information, organised in three buckets:
- Account data: your email address and authentication session tokens. If you sign in with Google, Google shares your Google account identifier, email address, name, and profile picture URL with us under the openid, email, and profile scopes. We use this only to create and authenticate your account and to display your name and picture to you; we do not use it for advertising and we do not sell it. You can revoke AskRera's access at any time at myaccount.google.com/permissions. If you sign in with an email one-time code instead, we store your email address and send a 6-digit code to it that is valid for 10 minutes.
- Usage data: searches you run, projects you view, reports you purchase, and basic device and IP metadata for security and abuse prevention.
- Billing data: when you buy a report, our payment processor (Stripe) collects card or UPI details directly. We store only the purchase record, amount, and a Stripe payment reference; never card numbers or UPI details.
We do not knowingly collect data from children under 18. If you believe a minor has used the Service, contact us and we will delete the account.
3. Public RERA filings
AskRera ingests publicly available MahaRERA filings — registrations, quarterly progress reports, sales figures, and litigation and encumbrance disclosures — as published by MahaRERA. This data is published by the regulator under its own rules and is not personal data of yours. It may, however, contain personal data of promoters and signatories as published by them in their regulatory filings.
4. How we use your information
We use the information we collect to:
- provide and operate the Service, including running searches and delivering reports you purchase;
- authenticate you, secure your account, and prevent abuse or fraud;
- process report purchases and meet our tax and accounting obligations;
- improve the Service, including measuring quality and debugging issues;
- measure the performance of our advertising, as described in the cookies section;
- communicate transactional notices (account, billing, security) and, with your consent, product updates.
5. AI model processing
Report narratives are generated by sending structured data from public MahaRERA filings to a third-party large language model provider. Only the public project record is sent; your searches, email address, and account details are never included. We select providers whose terms do not permit training on API inputs, and we never send your personal data to them.
We do not sell your searches or use them to train any third-party model.
7. Retention
We retain account data while your account is active, and for a reasonable period after closure to satisfy legal, tax, audit, and dispute-resolution requirements. Purchase records are retained for as long as tax and accounting rules require. We take a nightly backup of our database and keep each backup for 7 days before it is overwritten, so a deletion is reflected in our backups within 7 days.
8. Your rights
Under the DPDP Act, you have the right to access a summary of your personal data, correct inaccurate data, request erasure, withdraw consent for non-essential processing, and nominate another individual to exercise these rights on your behalf if you are unable to. To exercise any of these rights, email [email protected]. We will respond within the period prescribed by applicable law.
If you are not satisfied with how we handle your request, you may escalate the matter to the Data Protection Board of India.
9. Security
We use TLS in transit, encryption at rest, isolated databases per environment, and role-based access control to protect your data. Despite these measures, no system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board of India in accordance with the DPDP Act.
11. International transfers
AskRera is operated from Singapore, and some of our processors are located outside India. Where your data is processed outside India, we rely on contractual safeguards to ensure it continues to receive a level of protection consistent with Indian law.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified by email or in-product notice. The "last updated" date at the top of this page indicates when the policy was last revised.
13. Contact and grievances
AskRera is operated by Eskay Tech Pte. Ltd. (UEN 202552807D), registered at 68 Circular Road, #02-01, Singapore 049422.
For privacy questions or to lodge a grievance, write to [email protected]. We will acknowledge your grievance within 48 hours and resolve it within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
For complaints about a purchase, write to [email protected]. Consumers in India may also approach the National Consumer Helpline or the consumer commission having jurisdiction where they reside.