Privacy Policy
The short version
- For your own account details, Meenira is responsible for them (the “Data Fiduciary”).
- Your buyers’ and property owners’ details belong to your business. You are their Data Fiduciary; we only process them for you, on your instructions (we are your “Data Processor”).
- We never sell personal data, never use one broker’s buyers for another broker, and do not use your data or your buyers’ data to train AI models.
- Our servers and our AI models run in AWS’s Mumbai region. WhatsApp (Meta), email (Resend) and payments (Razorpay) are handled by those companies and may be processed outside India.
- Questions or requests: meenira@meenira.com.
1. Who we are
Meenira Realty is a product of Meenira (OPC) Private Limited (CIN U63120HR2026OPC151838), Gurgaon, Haryana, India (“Meenira”, “we”, “us”).
Registered office: Gurgaon, Haryana, India
Email: meenira@meenira.com · WhatsApp: +91 89173 17880
This policy explains how we handle personal data under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025.
2. Our two roles under the DPDP Act
Your account data: we are the Data Fiduciary
When you sign up and use Meenira Realty, we decide how your account details are used. For this data we are the Data Fiduciary and you are the Data Principal.
Your buyers’ and owners’ data: you are the Data Fiduciary, we are your Data Processor
The people who message your WhatsApp number, your leads, the property owners in your listings and the files you upload are your business’s data. You decide why and how they are used, so you are the Data Fiduciary for them. We process that data only to run your assistant and console, on your instructions and under our Terms of Service. These Terms and this policy are our data processing agreement with you; no separate agreement is needed.
As your processor we do not use your buyers’ data for our own purposes, and we never use it for any other broker.
3. What we collect about you (the broker)
- Sign-up details: your business name, your name, email address, Indian mobile number, city and, if you give it, your RERA number.
- Password: stored only as a one-way scrypt hash. We cannot read it.
- Your assistant’s profile: the name, business, city, RERA number, phone, language and other details you enter so the assistant can introduce you to buyers.
- Billing status: your trial dates, whether your email is confirmed, your billing state and your Razorpay subscription id. We never see or store your card or UPI details: you enter them on Razorpay’s own page.
- Sign-in and security records: when you last signed in, failed sign-in counts and lockouts, your session records (we store only a hash of the session cookie) and an audit log of account and billing actions. These audit records do not contain your email or mobile number.
- Network address: the console uses your IP address in memory to limit repeated sign-up and sign-in attempts. It does not write it to its database. Our hosting and content-delivery providers may record standard request data such as IP address and browser type in their logs, which are kept for 90 days.
- Messages you send us: emails and WhatsApp messages to our support contact.
4. Data the assistant handles for you
When you connect your WhatsApp Business number and add listings, we process the following on your behalf:
- Buyers and sellers who message you: their WhatsApp number, WhatsApp profile name, the text of messages in both directions, and whether a message came from a Click-to-WhatsApp ad (the ad reference only).
- Lead details: what the buyer tells the assistant, such as intended use, budget, timeline, how they will pay, who decides, size and location needs; the lead’s stage, score, open questions, hand-offs to you and the reason a lead was lost.
- Consent records: the purpose (enquiry, callback or marketing), channel, source, the wording or evidence, and when consent was given, expired or withdrawn, including opt-outs (“STOP”).
- Visits, tasks, deals and introductions: site-visit bookings and reminders, follow-up tasks, deal stages with the values you declare, and the record of who introduced which buyer to which property.
- Attachments: if a buyer sends an image, voice note, document or location, the assistant does not download or read it. It records that one was sent and hands the chat to you.
- Your listings and inventory files: property facts, documents details, and private fields such as floor price, owner name and contact, plot number and mandate terms. Private fields are never shown to buyers and never put into the AI’s instructions. Files you upload for import (spreadsheets, PDFs, Word files, images) may contain owners’ names and phone numbers; they are stored in your account only.
- An activity record: an append-only log of what the assistant and your account did, chained so that later edits are visible.
The assistant is built never to ask buyers for PAN, Aadhaar, bank details or OTPs.
Phone calls are not part of Meenira Realty yet. When they are offered, we will update this policy before they are switched on for your account.
5. How we use data
Your account data
- To create and run your account, sign you in and keep it secure.
- To send account and billing emails: confirming your email, trial reminders 3 days and 1 day before the trial ends, a notice if your account moves to limited mode, and password resets.
- To manage your trial and subscription with Razorpay.
- To answer your questions and support requests.
- To meet our legal obligations, such as tax and accounting records, and to respond to lawful requests.
Your buyers’ data
- To reply to buyers who message your number, qualify them, offer site-visit slots and hand serious or tricky chats to you.
- To show you your leads, visits, listings and activity in the console, and to send you lead alerts and reminders.
- To check every outgoing message against consent, opt-out and time-of-day rules before it is sent.
- To turn your inventory files into draft listings that you review before buyers can see them.
We do not sell personal data, use it for advertising, share it with other brokers or use it to train AI models.
6. Consent and legal basis
- Your account: we process your details on the basis of the consent you give when you sign up, and for legitimate uses the DPDP Act allows, such as complying with law. You can withdraw consent at any time (see section 12); we will then stop the service and delete your account data, except what the law requires us to keep.
- Your buyers: as Data Fiduciary, you are responsible for having a lawful basis for your buyers’ data and for any notice and consent the law requires. The assistant helps: it records a buyer’s own enquiry as consent for replies about that enquiry, says in its first message that it is an AI assistant and how to stop, and honours “STOP” at once.
- Marketing: promotional messages need the buyer’s separate opt-in and a sender registered under TRAI’s DLT rules. Promotional sending is switched off in Meenira Realty today.
7. How the AI works with your data
- Replies to buyers are written by an AI model running on Amazon Bedrock in AWS’s Mumbai region. For each reply it receives the buyer’s message, the recent conversation, what is known about the lead, and the public facts of your listings.
- When you import inventory, text is read on our own servers (including text recognition for images, done locally). Images, plans and brochures may also be sent to a vision model on Amazon Bedrock in Mumbai to read tables and layouts.
- Search over your documents uses an index computed on our own servers, kept separately for your account.
- We do not use your data or your buyers’ data to train or fine-tune AI models.
- AI can make mistakes. Prices and figures in replies are checked in code against your listings, and anything about price, legal or title questions is handed to you. See the Terms.
9. Where data is processed
- Our servers, databases and uploaded files are in AWS’s Mumbai region (ap-south-1), India.
- Our AI models are called in the same Mumbai region.
- Meta (WhatsApp), Resend (email) and Amazon CloudFront’s global network may process data outside India. Razorpay is an Indian company; it may use its own providers, which we do not control.
The DPDP Act allows transfers outside India except to countries the Government restricts by notification. We will not transfer data to a restricted country.
10. How long we keep data
| Data | How long |
|---|---|
| Your email and mobile number | Until your login is deleted. They are stored only on your login, so deleting it erases them |
| Sign-in sessions | End after 12 hours without use, or 7 days at most |
| Email confirmation links | Work once, for 24 hours; the record is deleted 30 days after the link expires |
| Password reset links | Work once, for 30 minutes; the record is deleted a day after it expires |
| Counters used to stop repeated attempts (by IP address or mobile) | Held in memory only, for up to 24 hours |
| A buyer’s consent to replies about their enquiry, or to a callback | Expires 7 days after the buyer’s last message (enquiry) or 7 days after it was given (callback). The record of it is kept with the lead |
| A buyer’s opt-out (“STOP”) | All consents are withdrawn and no contact is allowed for at least 90 days; the opt-out record is kept with the lead |
| Leads, messages, visits, deals, listings, inventory files and the activity record | For as long as your account exists. Leads are not deleted inside the product (they are marked lost). On your written request, or after your account is closed, we delete them within 30 days (billing records are kept as the law requires). |
| Billing and payment-event records (no contact details) | 8 years, as Indian tax law requires |
Deletion of account and buyer data is done by our team on request today; there is no self-service delete or export button yet. We may keep data longer where a law requires it.
11. How we protect data
- All traffic uses HTTPS.
- Passwords are hashed with scrypt; five wrong passwords lock a login for 15 minutes, and repeated failures from one network are blocked.
- Sessions are stored on the server; the cookie holds a random value and we keep only its hash.
- Each broker’s data is separated by account in every query, and tested for it.
- Messages from WhatsApp and Razorpay are accepted only with a valid signature.
- Your email and mobile number are kept out of logs and audit records.
- We do not handle card or UPI details.
If a personal data breach affects you or your buyers, we will tell you without undue delay so you can act, and we will notify the Data Protection Board of India and affected people where the DPDP Act and Rules require it.
12. Your rights and how to use them
Under the DPDP Act you can:
- Access a summary of the personal data we hold about you and how we use it, and who we have shared it with.
- Correct, complete or update it.
- Erase it, unless the law requires us to keep it.
- Withdraw consent at any time, as easily as you gave it. This does not affect what was done before.
- Raise a grievance with us, and then with the Data Protection Board of India.
- Nominate another person to exercise your rights if you die or become unable to.
How: email meenira@meenira.com with the subject “DPDP request” from the email address on your login, and say what you want. We may ask you to confirm your identity. We will respond within We acknowledge requests within 7 days and resolve them within 30 days.
You can also export your own leads and listings by asking us; a self-service export is not available yet.
13. If you are a buyer or property owner
If you messaged a broker who uses Meenira Realty, that broker is responsible for your data. Please contact the broker directly to use your rights.
- To stop messages at any time, reply STOP. The assistant will stop contacting you.
- If you write to us instead, we will pass your request to the broker and help them act on it.
15. Children
Meenira Realty is a business service for adults. You must be 18 or older to sign up. The assistant is not meant for conversations with children; if you know a buyer is under 18, do not use the assistant to process their data without the verifiable parental consent the DPDP Act requires. If you believe we hold a child’s data in error, write to us and we will delete it.
16. Changes to this policy
We will update this page when our practices or the law change, and change the date at the top. If a change is significant, we will tell you by email or in the console before it applies.
17. Grievance Officer and complaints
Grievance Officer: Tapas Kar, support@meenira.com
Write to support@meenira.com with the subject “Grievance (DPDP)”, or address post to the registered office above.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India under the DPDP Act.