Privacy Policy
Last updated: 6 August 2026
Effective date: 6 August 2026
1. Data Controller Identity
GoaKeys operates the real estate matchmaking platform at goakeys1.netlify.app and acts as the Data Fiduciary (as defined under Section 2(i) of the DPDP Act, 2023) for all personal data collected through the platform.
Registered entity details will be provided here as soon as they are available. Until then, all lawful notices and communication may be addressed to:
- GoaKeys, Goa, India
- Email: keysgoa@gmail.com
- Platform: goakeys1.netlify.app
2. Contact
For any privacy-related inquiry, grievance, or exercise of your data principal rights, you may contact:
- Grievance Officer — keysgoa@gmail.com — responsible for resolving complaints under the DPDP Act 2023 and DPDP Rules 2025.
- Nodal Officer (IT Act) — keysgoa@gmail.com — designated for coordination under the Information Technology Act, 2000 and IT (Intermediary Guidelines) Rules, 2021.
- Legal — keysgoa@gmail.com — for notices, data protection agreements, and statutory correspondence.
3. Personal Data We Collect
We collect only the minimum personal data necessary to operate the platform. The categories of personal data collected, along with the legal basis for each, are set out below.
| Category | Data Collected | Legal Basis (DPDP Act 2023) |
|---|---|---|
| Account data | Email address, full name, role (buyer / seller / agent / builder) | Contract (Section 6(1)(a)) |
| KYC data | PAN (encrypted with AES-256-GCM), RERA registration number, phone number | Legal obligation (Section 6(1)(b)) + Consent (Section 6(1)(a)) |
| Property listings | All data you submit as part of a property listing (address, price, area, documents, photos, amenity details) | Contract (Section 6(1)(a)) |
| Communications | Messages exchanged between users on the platform | Contract (Section 6(1)(a)) |
| AI inputs | Anonymized property data used for automated valuation (AVM) and SEO optimization | Consent (Section 6(1)(a)) |
| Technical data | IP address, device information, browser type, and server logs | Legitimate interest / security (Section 6(1)(f)) |
4. Purposes & Legal Basis
The table below maps each purpose of processing to its legal basis under the DPDP Act, 2023. We never process personal data beyond the purposes disclosed here without obtaining fresh consent.
| Purpose | Description | Legal Basis |
|---|---|---|
| Account creation & authentication | Creating and managing your account, login, and session security | Contract; legitimate interest (security) |
| KYC verification | Verifying PAN and RERA details to prevent fraud and comply with real estate regulations | Legal obligation; consent |
| Listing & matchmaking | Publishing, matching, and recommending property listings | Contract |
| User-to-user communication | Enabling messaging between buyers, sellers, and agents | Contract |
| AI valuation & SEO | Generating automated property valuations (AVM) and search-optimized listings using anonymized data | Consent |
| Security & fraud prevention | Monitoring, logging, and protecting the platform against abuse and attacks | Legitimate interest |
| Legal compliance | Retaining records required by law (PMLA, Income Tax, CERT-In directions) | Legal obligation |
5. Processors (Sub-Processors)
We engage the following processors to operate the platform. Each is bound by a data processing agreement (DPA) that limits processing to our documented instructions. Full details, including the version date, are available on request at keysgoa@gmail.com.
| Processor | Purpose | Region | Safeguards |
|---|---|---|---|
| Netlify | CDN and static hosting | United States / Global | EU Standard Contractual Clauses (SCCs) |
| Render | Backend API hosting | Singapore | Data processing addendum |
| Neon | PostgreSQL database (primary data store) | Per configuration (India or regional) | DPA executed |
| Cloudinary | Media storage and optimization (property images) | United States | DPA executed |
| Groq | AI inference (AVM / SEO generation) | United States | DPA executed; data not used for training |
| Razorpay | Payment processing (subscriptions / featured listings) | India | RBI-compliant; data localization |
| Redis Cloud | Caching for performance | Per configuration (regional) | DPA executed |
| Mailgun / SendGrid | Transactional email delivery | United States | DPA executed |
6. Cross-Border Transfers
In the course of operating the platform, your personal data may be transferred to and processed in the following locations:
- Singapore — backend API hosting (Render).
- United States — CDN and static hosting (Netlify), media storage (Cloudinary), AI inference (Groq), and email delivery (Mailgun/SendGrid).
- India — payments (Razorpay) and the primary database where provisioned in an Indian region (Neon).
All cross-border transfers are made in accordance with Section 16 of the DPDP Act, 2023, subject to the Central Government's notified transfer conditions (currently subject to the transitional provisions of the DPDP Rules 2025), and are protected by data processing agreements, EU Standard Contractual Clauses, or equivalent safeguards. We do not transfer KYC data (PAN, RERA) outside secure processing arrangements and do not transfer payment data outside India.
7. Data Retention Periods
We retain personal data only for as long as necessary to fulfil the purpose of collection, after which it is securely deleted or anonymized. The applicable retention periods are:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data | Until account deletion, plus a 30-day soft-delete recovery window | Account lifecycle |
| KYC data (PAN, RERA) | 5 years after account deletion | Prevention of Money Laundering Act (PMLA) |
| Audit / AI processing logs | 5 years | Audit and accountability |
| Payment records | 7 years | Income Tax Act |
| Grievance records | 3 years after resolution | DPDP grievance redressal |
| Technical logs | 180 days | CERT-In directions (May 2022) |
8. Your Rights as a Data Principal
Under the DPDP Act, 2023, you have the following rights. You can exercise them from your account settings, or by writing to keysgoa@gmail.com.
- Right to Access — obtain a summary of your personal data being processed. API:
GET /api/v1/user/export - Right to Correction — correct or update inaccurate or incomplete personal data. API:
PUT /api/v1/user/profile - Right to Erasure — request deletion of your personal data. Accounts are soft-deleted first, with a 30-day window to reverse the request. API:
DELETE /api/v1/user/account - Right to Portability — obtain your personal data in a structured, machine-readable format for transmission to another fiduciary. API:
GET /api/v1/user/export - Right to Object / Withdraw Consent — withdraw consent to processing (such as AI processing) at any time from your account settings. Withdrawal does not affect the lawfulness of processing performed before withdrawal.
- Right to Grievance Redressal — file a grievance with our Grievance Officer. API:
POST /api/v1/grievance
Requests are processed free of charge and within the timelines prescribed under the DPDP Rules 2025. We may require you to verify your identity before acting on a request. Where we refuse a request, we will provide the reasons for refusal and the process to contest the decision.
9. Grievance Redressal
- All grievances may be submitted to the Grievance Officer at keysgoa@gmail.com or via the in-platform grievance form.
- Every grievance is acknowledged within 24 hours of receipt.
- Grievances are resolved within 15 days of receipt, as required under the DPDP Act, 2023 (Section 13) and the DPDP Rules, 2025.
- If you are not satisfied with our response, you may file an appeal with the Grievance Appellate Board (GAB) established by the Central Government under Section 44 of the DPDP Act, 2023.
10. Breach Notification
In the event of a personal data breach, we will:
- Notify the Data Protection Board of India (DPBI) and affected data principals within 72 hours of becoming aware of the breach, in accordance with the DPDP Rules 2025.
- Describe the nature, extent, and timing of the breach, the likely impact, and the measures taken to mitigate it.
- Where feasible, provide affected users with actionable steps to protect themselves.
We maintain a breach response plan, including detection, containment, and notification procedures, and review it on a regular basis.
11. AI Processing
- GoaKeys uses AI (via Groq) to provide automated property valuations (AVM) and SEO optimization for listings.
- AI processing of property data requires explicit consent, obtained separately at the time you use these features.
- Only anonymized property data is used for AI processing; personal identifiers are stripped before processing.
- Your data is not used to train AI models. Processors are contractually prohibited from training on your data.
- You may withdraw consent for AI processing at any time from your account settings. AI-generated outputs are assistive only and must be independently verified.
12. Children
GoaKeys is not directed at, and does not knowingly collect personal data from, individuals under the age of 18. Accounts are subject to an age gate under our Terms of Service. If we learn that we have inadvertently collected personal data from a person under 18 without verifiable parental consent (as required under Section 9 of the DPDP Act, 2023), we will delete such data promptly. If you believe a child has provided us personal data, contact us at keysgoa@gmail.com.
13. Security
- Encryption: PAN data is encrypted with AES-256-GCM at rest.
- Transport: All traffic is protected with TLS 1.2 or higher.
- Access controls: Role-based access control and least-privilege principles restrict data to authorized personnel only.
- Audits: We conduct regular security reviews and penetration tests of the platform.
- Hashing & anonymization: Passwords are stored using strong one-way hashing; AI inputs are anonymized before processing.
14. Cookie Policy
- We use essential cookies only: session management, CSRF protection, and authentication.
- We do not use tracking, advertising, or analytics cookies.
- First-time visitors see a cookie consent banner and are asked to accept essential cookies before full functionality is enabled.
- Because all cookies are strictly necessary, refusing them may prevent parts of the platform from functioning.
15. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes (for example, to the categories of data collected, purposes of processing, or sub-processors) will be:
- Notified to you by email at your registered address, and
- Announced through an in-app banner on your next visit.
The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the platform after material changes are notified constitutes acceptance of the revised policy.