Privacy Policy

Truth Estate (“we,” “us,” or “our”) — a private limited company incorporated in India and based in Gurugram, Haryana — is committed to protecting the privacy of everyone who uses our platform and services. This policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have.

It applies to all Truth Estate services, including our website at truthestate.in, Truth Intelligence, TruthGuide, and Private Office advisory services. For the purposes of India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), Truth Estate is the Data Fiduciary responsible for your personal data, and you are the Data Principal.

We collect information in two broad categories: information you provide directly, and information collected automatically when you use our services.

Information you provide

• Your mobile number, and — if you sign in with Google — your name, email address, and Google profile picture
• Your name and contact details when you request advice, book a call, unlock intelligence, or submit an enquiry
• Your property brief — budget, preferred locations, configuration, timeline, and what matters most to you — and any free-text notes you add
• Questions and messages you type into TruthGuide, the Truth Intelligence search, and the “Challenge our read” chat
• Homes you self-declare as owned or of interest, ratings, and feature requests
• Correspondence when you contact us directly

Information collected automatically

• A random device identifier we generate to recognise your browser and stitch together your activity
• Pages and reports viewed, features used, and interaction patterns (including session replay — see Analytics)
• Device type, browser, operating system, and referring page
• Your IP address and the approximate location it implies, recorded in server logs

We do notask for or store your card, UPI, or bank details, and we do not knowingly collect special or sensitive categories of data. Please don't type sensitive personal information into chat or free-text fields.

We collect information through the following methods:

• Forms and interactive journeys on our platform
• Signing in by mobile OTP or with your Google account
• TruthGuide, Truth Intelligence, and other conversational or search interactions
• Your browser's local storage and cookies set by the third-party tools we use
• Analytics tools that observe how the platform is used
• Direct communication via email, phone, or advisory sessions

We do not purchase personal information from third-party data brokers.

We use your information to:

• Create and secure your account and recognise you when you return
• Deliver personalised property research, shortlists, and recommendations
• Respond to your questions and advisory requests, and provide the services you pay for
• Generate answers in TruthGuide and Truth Intelligence, and improve their quality and accuracy
• Process payments and maintain invoices and financial records
• Understand how our services are used so we can improve them
• Communicate updates about research, services, or policy changes
• Keep the platform secure, prevent misuse, and meet legal obligations

We do not sell your personal information. We do not share it with developers, brokers, or any other party for their marketing purposes.

Under the DPDP Act, we process your personal data on the following bases:

• Your consent — given when you sign in, submit a brief or enquiry, or use features such as analytics and AI. You can withdraw consent at any time (see Your Rights)
• To provide what you ask for — where you voluntarily give us information for a specific purpose, such as unlocking a report or requesting advice, we process it to deliver that service
• Legal and legitimate uses — to comply with law (for example, tax and accounting records), to keep our platform secure, and for other uses permitted under applicable law

Withdrawing consent doesn't affect processing already carried out, and some data may be retained where the law requires it.

We use Supabase Auth to manage sign-in. We offer passwordless options, so there is no password for you to create or for us to store:

• Mobile OTP — we send a one-time code by SMS. Indian numbers are served through MSG91; international numbers through Twilio. These providers process your phone number to deliver the code
• Google Sign-In — with your permission, Google shares your name, email address, and profile picture with us to create your account

Your session is stored in your browser's local storage, not in a cookie, so you stay signed in on that device until you sign out.

To keep you signed in and remember your brief and preferences, our own code stores information in your browser's local storage rather than in cookies. This essential storage is needed for the platform to work and cannot be turned off while you use it; clearing your browser storage removes it.

The third-party tools we load — Google Analytics, Amplitude, Razorpay checkout, and Google Maps — may set their own cookies or storage in your browser to perform their functions and measure usage. We do not use advertising or cross-site ad-tracking cookies from ad networks.

You can clear or block cookies and site storage through your browser settings, and opt out of analytics as described below. Blocking essential storage may stop parts of the platform from working.

We use analytics to understand how our platform is used — which pages and reports are most useful, how people move through the site, and where they run into difficulty — so we can improve it. This involves three tools:

• Our own event log — we record key actions (such as viewing a report, signing in, or completing a payment) with a device identifier, the page, and the referring source, stored in our own database
• Google Analytics — aggregate usage measurement provided by Google
• Amplitude — product analytics, including session replay, which reconstructs how a page looked and how you interacted with it (movements, clicks, scrolls, and taps) to help us find and fix usability issues. Keystrokes in sensitive fields are masked where supported

We use analytics to improve the product, not to build advertising profiles, and we do not sell this data. You can limit analytics using your browser's privacy controls or by contacting us at [email protected].

Several features are AI-powered: TruthGuide and “Challenge our read” (chat), the Truth Intelligence search, and shortlist re-ranking. To generate responses, we send the text you type and the relevant research context to trusted AI providers:

• Google (Gemini) — powers TruthGuide, the “Challenge our read” chat, and shortlist re-ranking
• Anthropic (Claude) — powers the Truth Intelligence search

• We store your conversations and queries to provide the feature and improve its quality and accuracy
• We do not use your personal conversations to train general-purpose AI models, and our providers process this data under their own terms as our processors
• AI responses can be incomplete or wrong — verify anything important, and please don't enter sensitive personal information into AI features

We rely on a limited set of service providers (processors) to operate our platform. Each receives only the information needed for its function and is expected to protect it:

• Supabase — our database, authentication, and backend functions
• Google Cloud — website hosting (Cloud Run)
• Google Analytics & Amplitude — usage analytics and session replay
• Razorpay — payment processing; it handles your card/UPI/bank details directly under its PCI-DSS-compliant systems
• Google Maps & Places — maps and location search; your typed location queries are sent to Google, and a mapping CDN (CARTO) may serve fallback map tiles
• Google (Gemini) & Anthropic (Claude) — the AI features above
• MSG91 & Twilio — sending sign-in codes by SMS

We do not share your personal information with third parties for their own marketing purposes. Each provider processes your data under its own privacy policy.

Truth Estate is based in India, but some of our providers process data outside India. Our website is served from Google Cloud in Singapore, and providers such as Google, Anthropic, Amplitude, and Twilio may process data in the United States or other countries. Razorpay processes payments in India.

Where your personal data is transferred outside India, we do so in accordance with the DPDP Act and take reasonable steps to ensure it remains protected. By using our services, you consent to this processing and transfer.

We implement appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit using TLS, and encryption at rest by our infrastructure providers
• Row-level security in our database, so accounts can only access their own records
• Access controls restricting data access to authorised personnel
• Regular security reviews of our systems and processes

No system is completely secure. While we take reasonable precautions, we cannot guarantee absolute security. In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

As a Data Principal under the DPDP Act, you have the right to:

• Access — a summary of the personal data we hold about you and how we process it
• Correction & completion — correct, complete, or update inaccurate or incomplete information
• Erasure — ask us to delete your personal data, subject to legal retention requirements
• Withdraw consent — withdraw consent as easily as you gave it
• Grievance redressal — have your complaints addressed by us (see below)
• Nominate — nominate another person to exercise your rights if you die or become incapacitated

To exercise any of these rights, contact us at [email protected]. We will respond within a reasonable period and within any timeline required by law. You also have the right to complain to the Data Protection Board of India.

We keep your personal data only for as long as necessary for the purposes in this policy, unless a longer period is required by law. As a guide:

• Account & brief — kept while your account is active, and deleted or anonymised when you ask us to close it
• Enquiries & leads — up to 24 months after our last contact, unless part of an active engagement
• AI conversations — up to 24 months, then deleted or anonymised
• Analytics — generally up to 26 months
• Payment & invoice records — retained for about 8 years to meet Indian tax and accounting laws

When data is no longer needed, we securely delete or anonymise it.

Truth Estate is intended for adults making real estate decisions and is not directed at anyone under the age of 18. We do not knowingly collect personal data from children, and we do not knowingly track or serve targeted content to them. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

If you have a concern or complaint about how we handle your personal data, please contact our Grievance Officer:

• Grievance Officer, Truth Estate
• Email: [email protected]
• Gurugram, Haryana, India

We acknowledge grievances within 24 hours and endeavour to resolve them within a reasonable period, and within any timeline required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We may update this privacy policy periodically. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or platform notification.

We encourage you to review this policy periodically to stay informed about how we protect your information.

For privacy-related questions, requests, or concerns, contact us at [email protected].

Truth Estate · Gurugram, Haryana, India.