Privacy Policy

Last updated: 24 October 2026

[Registered company name] (operating Denszo) ("we") runs Denszo and decides why and how your personal data is used (a "data fiduciary" under India's Digital Personal Data Protection Act, 2023). This page says what we collect, why, who sees it, how long we keep it and how to use your rights. It goes with the Terms.

1. What we collect, and why

Account: your name, email, and sign-in details (a hashed password, or your Google account link). Mobile number if you give or confirm one. To run your account and keep it secure.
Sign-in codes: a one-time code is sent to your email, or by SMS or WhatsApp to confirm your mobile once. Only a hash of the code is kept, and it is deleted after 1 day(s).
Listings and profile: photos, descriptions, prices, the area you post from, your shop details and any ownership document you add. To show your ads and let buyers find them. Photos you upload are public on the ad.
Messages and offers: chat and offers between you and another user, and reviews you write. To deliver them, and to deal with reports and fraud. Message text is never put in emails or push notifications.
Location: the area you choose, and, if you tap "near me", your device location rounded to about 1 km, kept in a cookie for a day. Never an exact position.
Searches and views: what you search for and which ads are seen, to improve search and show demand. Phone numbers and emails typed into search are masked. Who ran a search is removed after 90 days.
Alerts you opt into: if you tick "Tell me about new ads" on a search we keep its category and area (to about 1 km) so we can notify you. Only then.
Identity and business checks (optional): which ID you chose and a photo of it, only to check your name; we never ask for the ID number. For Aadhaar, only a masked copy (last 4 digits). The photo is deleted once it is reviewed; we keep the result, the ID type and the reason.
Payments: what you bought, amount, invoice and refund records. Card and UPI details go to Razorpay and are not stored by us.
Device and security data: IP address, browser type and request logs, used for rate limits, fraud prevention and fixing faults.
Reports and moderation: reports you file or that are made about you, and what we decided.

2. Basis: your consent, and what the law lets us do

We use your data with your consent, which you give when you tick the box at sign-up and when you switch on a feature (for example, alerts or a loan or insurance Check). You can withdraw consent at any time (section 8); then we stop, though that may mean you can no longer use the feature or account. We may also use data where the law allows it without consent: to comply with a law or court or government order, to prevent fraud and protect users, to give a service you asked for, or in an emergency.

3. Who sees your data

Other users: your name (first name on reviews), shop, ads, area, ratings and trust marks. Your mobile number is masked on your ads; a signed-in visitor can reveal it by tapping Call, and you can switch that off in Account → Privacy so buyers reach you by chat only. Your email, your ID and documents and your address are never shown.
Sellers who pay to reach buyers get a count, never who you are. You receive a notice about their ad.
Loan and insurance partners receive your name and mobile number only when you tap Check on that partner's offer.
Our moderators and staff see what their job needs (reports, verification documents, disputes), through role-based access.
Service providers who process data for us under contract: Razorpay (payments); an SMS and WhatsApp gateway (APITxT, MSG91) for sign-in codes; an email provider; push-notification services of your browser; Google, if you sign in with Google or where Google ads are shown; and our hosting and database provider.
Authorities: where a law, court or government agency lawfully requires it.

We do not sell your personal data. Some providers (for example Google) may process data outside India; we use them only where the law permits.

4. Cookies and similar storage

Needed: your sign-in session, security, and your chosen language and place.
Location: the rounded "near me" fix (one day) or the place you chose (up to a year). Signing out clears the saved draft and recent places on that device.
Advertising: where Google AdSense units are switched on, Google may set its own cookies to show ads. You can manage them in Google's ad settings or your browser.

5. How long we keep it

Account and listings: while your account is open. Expired ads are hidden, then archived.
Sign-in code records: 1 day(s).
Search log: who searched is removed after 90 days; the rows go after 730 days.
ID and ownership documents: deleted once reviewed.
Invoices and payment records: as the tax and company laws require (generally between 6 and 8 years).
If an account is closed while suspended, or after we took down one of its ads, we keep a one-way scrambled code (a hash) of its email, mobile number or Google ID, never the value itself, so closing the account cannot be used to dodge the suspension. We keep it as long as needed to prevent fraud.
Reports, takedown and moderation records, and the details needed to prevent fraud or answer a legal order: kept after a listing or account ends, and for at least 180 days after you delete your account where the IT Rules require it.

After that we erase the data or remove anything that identifies you.

6. Security

Data travels over HTTPS. Passwords and codes are stored only as hashes, secrets are encrypted, uploaded files are checked, access is limited by role and every request is checked on the server. Rate limits guard sign-in and uploads. No system is perfectly safe. If a breach affects your data we will tell you and the Data Protection Board of India as the law requires.

7. Children

Denszo is for people 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has an account, write to us and we will delete it.

8. Your rights

You may ask us to:

give you a summary of the personal data we hold and who we shared it with;
correct or complete it (most details can be edited in Profile);
erase it and close your account, subject to the records we must keep (section 5). You can do this yourself: Profile → the ⋯ menu → Close my account. Paid plans are cancelled and refunded for the unused days. Your name, email, mobile number, photos and saved items are removed and your ads come down; a person who joins again starts a new account and completes every check again;
withdraw consent, including turning off alerts and hiding your number (Account → Privacy);
settle a complaint, and name another person to exercise these rights for you if you die or cannot act.

Write to the Grievance Officer below from the email on your account. We confirm your identity, then reply within the time the Complaints process sets (and no later than the law allows). If you are not satisfied, you may complain to the Data Protection Board of India, after first raising it with us.

9. Changes

If we change this policy in a way that matters we will tell you in the app or by email, and ask for consent again where the law needs it. The date at the top shows the current version.

10. Contact

Grievance Officer (data and privacy): [Name of Grievance Officer], [grievance email].
[Registered company name] (operating Denszo), [Registered office address].