Privacy Policy

1. DEFINITIONS

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
• "Data Principal" means the individual to whom the Personal Data relates — i.e., you, the User.
• "Data Fiduciary" means the Company (PHS BPRD PVT LTD), which determines the purpose and means of processing your Personal Data.
• "Data Processor" means any entity that processes Personal Data on the Company's behalf (e.g., our cloud hosting or payment processing vendors).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, sharing, and erasure.
• "Consent Manager" has the meaning assigned under the DPDP Act — a registered platform through which you may manage, review and withdraw your consent, where such a mechanism is made available by the Company or required by law.
• "Significant Data Fiduciary" means a Data Fiduciary notified as such by the Central Government under the DPDP Act, subject to additional obligations (data protection officer, data protection impact assessments, independent audits). The Company shall comply with these additional obligations if and when it is so notified — see Clause 13A.
• "Platform", "App"/"HOMESNAP", "Website", "Product", "Service", "Order", "Booking" carry the same meaning as defined in Our Terms & Conditions.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Third Parties

• Truecaller: If you choose to register/log in using Truecaller's verification, We receive your verified mobile number and any associated profile information you have permitted Truecaller to share (name, profile photo, etc., depending on your Truecaller app settings).
• Payment Gateways/Banks: Transaction status and confirmation references (not your full card, UPI PIN, or bank credentials).
• Referrals: If an existing User refers you, We may receive your name and mobile number from the referring User, solely to extend a referral benefit; you may ask Us to delete this record if you do not wish to proceed.

We do not knowingly purchase or otherwise acquire Personal Data about you from third-party data brokers for advertising purposes.

3. HOW WE COLLECT INFORMATION

We collect information when you:

1. 1. register or log in on HOMESNAP or the Website (including via Truecaller or OTP);
2. 2. browse Products or place an Order/Booking;
3. 3. upload a photograph, measurement, or document for a quotation or Service request;
4. 4. contact customer support (including via chatbot);
5. 5. interact with push notifications, SMS, WhatsApp, or email communications;
6. 6. use device sensors/permissions you have granted (camera, storage, location); and
7. 7. automatically, through cookies, SDKs and analytics tools embedded in HOMESNAP and the Website (e.g., Firebase Analytics).

4. LAWFUL BASIS AND PURPOSE OF PROCESSING

We use your information to:

1. 1. create and authenticate your account;
2. 2. process and fulfil Orders and Bookings, including delivery and Service coordination;
3. 3. process payments and issue invoices;
4. 4. verify your identity and prevent fraud;
5. 5. provide customer support, including through AI-assisted chat tools;
6. 6. generate quotations, estimates, and product recommendations (including AI-generated ones — see Clause 5);
7. 7. send transactional communications (Order confirmations, OTPs, delivery updates);
8. 8. send promotional communications, only where you have opted in;
9. 9. improve and personalise the Platform, App performance, and product catalogue;
10. 10. detect, investigate and prevent fraud, abuse, or security incidents;
11. 11. comply with applicable law, regulatory requests, and enforce our Terms & Conditions; and
12. 12. resolve disputes and grievances.

4.1 Lawful basis

We process your Personal Data only where: (a) you have given specific, informed, and freely given consent for that processing (the default basis for most of the purposes above, particularly promotional communications and AI-based features); or (b) processing falls within a "legitimate use" specifically recognised under Section 7 of the DPDP Act — for example, where you have voluntarily provided your Personal Data for a specified purpose and have not indicated you do not consent to its use (e.g., providing your address to complete a delivery), or where processing is necessary to comply with a legal obligation (e.g., retaining GST invoices), or to respond to a medical emergency or ensure safety during a disaster.

We do not rely on a general or open-ended notion of "legitimate use" beyond what Section 7 of the DPDP Act specifically permits, and where in doubt, We default to seeking your consent.

5. AI AND AUTOMATED PROCESSING

Where the Platform uses AI/ML-based tools — such as a customer-support chatbot, an image-based product/estimate recommender, or fraud-detection systems — your queries, uploaded photographs, and relevant Order/browsing history may be processed by such tools, including where hosted by third-party AI service providers, strictly to generate the requested output (e.g., a material estimate from an uploaded site photo).

• We do not use AI tools to make purely automated decisions with legal or similarly significant effect on you (e.g., permanently suspending your account, denying a refund outright) without a meaningful avenue for human review upon request.
• AI-generated recommendations, estimates, and chatbot responses are indicative only and do not constitute professional advice (see Terms & Conditions, Clause 9).
• Data shared with AI tools is limited to what is reasonably necessary for that specific feature. We do not permit our AI/ML vendors to use your Personal Data to train publicly-available or third-party AI models unless (a) the data has been fully and irreversibly anonymised, or (b) you have given specific, separate consent. Where a vendor's own terms differ, We will disclose this to you before you use that specific feature.

6. HOW WE SHARE YOUR INFORMATION

We do not sell your Personal Data, and We do not share it with another User without your express consent, except as strictly necessary to fulfil an Order or Booking you have placed (e.g., sharing your delivery address with the assigned delivery partner or technician). We share information only as follows:

6.1 With Third-Party Service Providers (Processors)

Each recipient is contractually and/or by platform policy restricted to using your data only for the stated purpose, and not for its own independent marketing, unless you separately and specifically consent to that recipient's own privacy policy (e.g., opting in directly with Truecaller for its own services).

6.2 For Legal Reasons

We may disclose your information where required to comply with a valid court order, government/regulatory request, or law enforcement request made under applicable law, or to establish, exercise, or defend our legal rights, or to protect the life, safety, or vital interests of a User, employee, or member of the public. We will assess each such request for legal validity before disclosing data and, where legally permitted, We will attempt to notify you.

6.3 Business Transfers

If the Company undergoes a merger, acquisition, restructuring, or sale of assets, your information may be transferred to the successor entity, subject to that entity honouring the commitments made in this Privacy Policy, or providing you with notice and an opportunity to exercise your rights (including erasure) in respect of any material change.

6.4 With Your Specific Consent

We may share information with other third parties only where you have given specific, informed consent for that particular sharing (e.g., sharing your contact details with a named partner for a specific promotional offer). Such consent is separate from, and does not automatically follow from, your general acceptance of this Policy.

7. CROSS-BORDER DATA TRANSFER

Your Personal Data is primarily stored and processed on servers located in India. However, certain of our Third-Party Service Providers (e.g., Firebase/Google, some AI tool providers) may process or store limited categories of data (such as device/usage analytics and crash logs) on servers located outside India, strictly in accordance with the DPDP Act's provisions on transfer of Personal Data outside India.

As of the date of this Policy, the DPDP Act permits such transfers by default, except to countries specifically restricted by the Central Government by notification. Where such a transfer occurs, We require, through contract or the vendor's binding platform policies, that the recipient maintain a standard of protection for your Personal Data that is not materially lower than what is required of Us under this Policy and Indian law.

7A. Payment Data Localisation

In accordance with Reserve Bank of India (RBI) directions on storage of payment system data, all data relating to payment transactions (card, UPI, and bank transaction details) is stored exclusively on servers located within India by our payment gateway partners, regardless of where the payment gateway's parent entity is headquartered.

8. DATA RETENTION

We retain your Personal Data only for as long as reasonably necessary for the purpose it was collected, applying the following indicative periods, subject always to a shorter period where you validly exercise your erasure right under Clause 13, or a longer period where required by law:

Where retention is based on a legal requirement, We will inform you of that requirement if you ask Us to erase data that We are not yet permitted to delete.

9. COOKIES AND TRACKING TECHNOLOGIES (WEBSITE)

Our Website uses cookies and similar technologies (e.g., via Firebase/Google Analytics, or Cloudflare Web Analytics) to:

• keep you logged in;
• remember your preferences and cart contents;
• understand how you use the Website to improve performance; and
• measure the effectiveness of our content.

On your first visit, the Website will present a cookie notice allowing you to accept or reject non-essential cookies (such as analytics cookies); strictly necessary cookies required for the Website to function (e.g., session/login cookies) cannot be disabled through this notice but can be blocked via your browser settings, which may affect functionality such as staying logged in or cart persistence.

10. HOMESNAP APP PERMISSIONS

HOMESNAP may request the following device permissions, used only for the stated purpose and requested at the point the relevant feature is first used (not all at install):

You may withdraw any permission at any time via your device settings; this may limit certain features but will not prevent you from using the core Platform. Denying a permission will never result in restricted access to unrelated features.

11. DATA SECURITY

We implement reasonable security practices and procedures under Section 43A of the Information Technology Act, 2000 and the DPDP Act, including:

• encryption of data in transit (HTTPS/TLS) and, where applicable, at rest;
• hashing/encryption of account passwords (never stored in plain text);
• access controls limiting internal access to Personal Data on a strict need-to-know basis, with logging of access to sensitive records;
• secure storage of payment references (full card/bank/UPI data is never stored by Us directly — it is handled by PCI-DSS compliant, RBI-regulated payment gateway partners); and
• periodic review of our security practices, and of the practices of our key Data Processors, in line with the IT Act, 2000 and DPDP Act requirements.

No method of transmission or storage is 100% secure. While We take reasonable and appropriate steps to protect your Personal Data, We cannot guarantee absolute security, and you also play a role in protecting your account by keeping your login credentials and OTPs confidential (see Terms & Conditions, Clause 5–6).

12. DATA BREACH NOTIFICATION

In the event of a personal data breach that compromises your Personal Data, We shall, as required under the DPDP Act and its Rules:

1. 1. notify the Data Protection Board of India in the manner and within the timeline prescribed under applicable Rules; and
2. 2. notify you, without undue delay, describing the nature of the breach, the likely consequences, and the measures taken or proposed to mitigate the risk, through the contact details registered with your account (email, SMS, and/or App notification).

13. YOUR RIGHTS AS A DATA PRINCIPAL

Subject to the DPDP Act and its Rules, you have the right to:

1. 1. Access — obtain a summary of the Personal Data We process about you, the processing activities undertaken, and the identities of Data Processors with whom it has been shared;
2. 2. Correction and Updation — request correction of inaccurate or incomplete Personal Data, and completion of incomplete Personal Data;
3. 3. Erasure — request deletion of your Personal Data once it is no longer necessary for the purpose it was collected, subject to legal retention requirements described in Clause 8;
4. 4. Withdraw Consent — withdraw consent at any time for any processing based on consent, as easily as it was given, without affecting the lawfulness of processing carried out before withdrawal;
5. 5. Grievance Redressal — raise a grievance regarding processing of your Personal Data with Our Grievance Officer (see Clause 17), and if unresolved, escalate to the Data Protection Board of India;
6. 6. Nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, through the mechanism made available on HOMESNAP/the Website (or, where not yet available, by written request to the Grievance Officer).

To exercise these rights, please contact Us using the details in Clause 17, or through the "Privacy" / "Account Settings" section within HOMESNAP, where available. We will respond to a verified request within a reasonable time and, in any event, within the timelines prescribed under the DPDP Rules. We may need to verify your identity before processing such requests, using proportionate means, and We will not ask for more information than is reasonably necessary for that verification.

13A. SIGNIFICANT DATA FIDUCIARY OBLIGATIONS

The Company is not, as of the date of this Policy, notified as a "Significant Data Fiduciary" under the DPDP Act. If the Company is so notified in the future, it shall, within the timeline prescribed by law, appoint a Data Protection Officer based in India, conduct periodic Data Protection Impact Assessments and independent data audits, and undertake such other measures as prescribed, and this Policy will be updated accordingly.

14. MARKETING COMMUNICATIONS AND OPT-OUT

We may send you promotional communications (SMS, WhatsApp, email, push notifications) about offers, new Products, or Services, only where you have opted in, or as otherwise permitted under applicable law (including TRAI's regulatory framework for commercial communications and registration on the National Customer Preference Register / NDNC, where applicable). You may opt out at any time by:

• using the "unsubscribe" link in emails;
• replying "STOP" to SMS communications;
• adjusting notification settings within HOMESNAP; or
• contacting Our support team directly.

Opting out of promotional communications will not affect your receipt of essential transactional messages (e.g., OTPs, Order/delivery updates), which are necessary to operate your account and cannot be disabled while your account remains active.

15. CHILDREN'S DATA

The Platform is intended for use by individuals who are competent to contract under the Indian Contract Act, 1872, and, in any event, who are 18 years of age or older. We do not knowingly collect Personal Data from children (individuals below 18 years of age) without verifiable parental/guardian consent obtained in a manner consistent with the DPDP Act. If We become aware that We have inadvertently collected a child's Personal Data without such consent, We will take prompt steps to delete it. In accordance with the DPDP Act, We do not undertake tracking, behavioural monitoring, or targeted/behavioural advertising directed at children, and We do not process children's data in any manner likely to cause them harm.

16. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites or integrate third-party services (e.g., payment gateways, map services, social media plugins). This Privacy Policy does not apply to those third parties, and We are not responsible for their privacy practices. We encourage you to read their respective privacy policies before sharing information with them.

17. GRIEVANCE OFFICER / DATA PROTECTION CONTACT

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, We have appointed a Grievance Officer to address your questions, complaints, or concerns regarding this Privacy Policy and the processing of your Personal Data:

Grievance Officer: Krishna Agarwala Email: phsbprd@gmail.com Phone: 8822060652 Address: Barpeta Road, Assam, India

We will acknowledge your grievance within 24 (twenty-four) hours of receipt and will endeavour to resolve it within 15 (fifteen) days of receipt, in line with the timelines prescribed under the IT Rules, 2021, or such other timeline as may be prescribed under the DPDP Rules once notified. If you remain dissatisfied with Our response, you may approach the Data Protection Board of India or other competent authority.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or for other operational reasons. Where a change is material — for example, a new category of data collected, a new purpose of processing, or a new category of third party with whom data is shared — We will notify you via App push notification, Website banner, and/or email, in addition to updating the "Last Updated" date, and, where required by the DPDP Act, We will seek your fresh consent before the change takes effect. Your continued use of the Platform after a non-material change constitutes acceptance of the revised Policy, to the extent permitted by law.

19. GOVERNING LAW AND JURISDICTION

This Privacy Policy shall be governed by the laws of India. Subject to any mandatory statutory jurisdiction available to consumers, and to the jurisdiction of the Data Protection Board of India over matters within its statutory mandate, courts/competent authorities at Guwahati, Assam shall have jurisdiction over any disputes arising from this Privacy Policy.

20. CONTACT US

PHS BPRD PVT LTD Website: phsconstructionarena.com App Name: HOMESNAP Principal Place of Business: Achyut SRMK Altair, Lokhra,Guwahati Assam, India Customer Support: 8822060652 Grievance Officer: Krishna Agarwala Grievance Email: phsbprd@gmail.com GSTIN: 18AAPCP8741D1Z1 CIN: U46633AS2025PTC028370