GharAI

Privacy Policy

Effective: 25 April 2026 · Compliant with DPDP Act 2023 (India)

1. Who we are

GharAI ("we", "us") is a service operated from Vijayawada, Andhra Pradesh, India. We connect homeowners with KYC-verified contractors and material suppliers, and offer free home-planning tools. For data-protection queries write to privacy@gharai.co.

2. What we collect

  • Account: name, email, phone (verified via a one-time SMS code), Clerk user ID.
  • Project data: plot dimensions, facing, location, budget, project requirements you post, quotes you receive, and messages exchanged with contractors.
  • Payments: Razorpay order/payment IDs only — we never see card numbers, CVV, or UPI PIN.
  • Usage: page views, clicks on key actions (project posted, quote received, contact unlocked) via PostHog. IP and rough city are derived from request headers.
  • Contractor / supplier KYC (if you sign up as one): PAN and GSTIN verification status, work-sample photos, bank-account proof for payouts.

3. Why we process it (lawful basis under DPDP)

  • Consent: sending you marketing emails, displaying your project name in a public testimonial.
  • Legitimate use: account security, fraud prevention, contractor verification, abuse / rate-limit detection, dispute resolution.
  • Legal obligation: tax records (7 years for GST/income-tax filings).

4. Who we share with

  • Clerk Inc. (USA) — account authentication and sign-in.
  • 2Factor.in (India) — delivers the one-time SMS code used to verify your mobile number during contractor/supplier verification.
  • Sandbox.co.in (India) — verifies PAN and GSTIN details for contractor / supplier KYC.
  • Neon Inc. (Singapore region) — primary database. All your project data resides here.
  • OpenRouter / Google Gemma — AI inference for our free planning tools. The conversation history (no name, no email) is sent at request time and not retained beyond the request by us.
  • Razorpay — payment processing.
  • Vercel Inc. (USA) — hosting + edge logs.
  • PostHog (US Cloud) — product analytics.
  • Cloudflare — DNS + DDoS protection for gharai.co.

We never sell your personal data.

5. Where we store it

Primary storage is Neon Postgres in ap-southeast-1 (Singapore). Backups are encrypted at rest. Cross-border transfers to US-hosted services above are governed by their own data-protection commitments and are necessary for service delivery.

6. How long we keep it

  • Account & project data — until you delete your account, or after 36 months of inactivity.
  • Payment receipts & invoices — 7 years (tax law).
  • KYC verification records — 5 years after the relationship ends (PMLA / RBI).
  • Analytics events — 12 months rolling.

7. Your rights under DPDP 2023

  • Access: request a copy of your data.
  • Correction: ask us to fix inaccurate data.
  • Erasure: ask us to delete your account and data.
  • Withdraw consent: for any processing that relies on consent.
  • Grievance: escalate via the contact below.
  • Nominate: a person to exercise these rights on your behalf.

Email any of these requests to privacy@gharai.co. We respond within 30 days.

8. Cookies & tracking

We use first-party cookies for sign-in (Clerk session) and a single PostHog cookie for analytics. No third-party advertising or retargeting cookies. You can disable PostHog from the footer of any signed-in page (coming soon — meanwhile, browser DNT is honoured).

9. Children

GharAI is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has signed up, write to us and we'll erase the account.

10. Grievance Officer

As required under Section 8 of the DPDP Act:

Name: Ramu Badugu
Email: grievance@gharai.co
Address: GharAI, Vijayawada, Andhra Pradesh, India

11. Updates

Material changes will be emailed to you and posted here at least 14 days before they take effect.