Your privacy is a right,
not a checkbox.

Account & Identity — When you register, we collect your name, email address, and optionally a profile photo. If you sign in via Google OAuth, we receive the data permitted by your provider's own consent screen. Your phone number, if provided, is encrypted using AES-256-GCM before storage and is never exposed in plaintext outside our systems.

Roommate Preferences — To compute compatibility scores, you may optionally share lifestyle preferences: sleep schedule, dietary habits, smoking status, and interests. These are never shared with third parties and are only matched against other users with your explicit opt-in.

Location Data — We request your GPS coordinates solely to power commute distance calculations, transit heatmaps, and hyperlocal service recommendations. By default, coordinates are rounded to ~1 km radius (approximate mode) before storage. You can switch to precise mode in your Privacy Center, or withdraw location consent at any time.

Listing & Review Content — Room listings, area safety reviews, and photos you upload are associated with your account for display and moderation purposes.

Technical Metadata — We log IP addresses, browser/device identifiers, and session timestamps for security, fraud prevention, and rate-limiting. These logs are retained for a maximum of 24 months and are never used for profiling or advertising.

Under India's Digital Personal Data Protection Act, 2023 (Sections 4–6), we process your personal data only under the following grounds:

• Consent (Section 6) — Analytics cookies, marketing communications, precise location access, and push notifications. You provide consent via our Cookie Banner or Privacy Center. Consent is granular, specific, and freely withdrawable at any time.
• Performance of Contract (Section 4(1)(b)) — Processing your profile, listings, and OTP authentication is necessary to provide the SettleIn service you signed up for.
• Legitimate Use (Section 7) — Security logging, fraud prevention, and platform abuse detection fall under legitimate use where we have taken care to balance your privacy interests.
• Legal Obligation — We may retain or disclose data as required by applicable Indian law or a lawful court order.

We do not sell your personal data. We do not process special categories of data (health, biometrics, financial records) unless explicitly required and separately consented to in a future service.

• Match you with compatible rooms and roommates based on your stated preferences and location.
• Compute commute times, safety scores, and neighbourhood intelligence for search results.
• Send OTP codes, booking confirmations, and security alerts essential to your account.
• Recommend local services (tiffin, laundry, housekeeping) from verified providers in your area. You must have active notification consent for optional marketing messages.
• Detect and prevent fraudulent listings, fake accounts, and platform abuse.
• Improve our algorithms and UI — but only with aggregate, anonymised data or with your analytics consent.

We never use your data for automated individual profiling that produces legal or similarly significant effects without your explicit consent, as prohibited under Section 4(2) of the DPDP Act.

• Other SettleIn Users — Your public roommate compatibility profile (name, tags, sleep schedule) is visible to logged-in users. Your email address and phone number are never exposed in public listings.
• Service Providers (Data Processors) — We use Supabase (database hosting, EU-US Privacy Shield compliant), and Vercel (frontend hosting). These are data processors acting under our instructions, bound by contractual data processing agreements.
• Local Service Operators — When you book a tiffin or laundry service, we share your delivery address and contact number with the verified local operator fulfilling your order. This is strictly for order fulfillment.
• Legal & Regulatory — We disclose data to law enforcement or regulatory bodies only when required by a specific, lawful legal instrument. We will notify you of such requests unless prohibited by law.

No personal data is ever sold, rented, or traded with advertisers, data brokers, or third-party marketing platforms.

The Digital Personal Data Protection Act, 2023 grants you the following rights, exercisable immediately via your Privacy Center or by contacting us at privacy@settlein.in:

• Right to Access (Section 11) — Request a copy of all personal data we hold about you. Download it instantly as a ZIP archive from your Privacy Center.
• Right to Correction (Section 12) — Request correction of inaccurate or incomplete personal data. Update your profile directly or contact us.
• Right to Erasure (Section 12) — Request deletion of your account and all associated personal data. We soft-delete your account immediately (with a 30-day recovery window) and permanently purge all data after 30 days.
• Right to Grievance Redressal (Section 13) — Lodge a complaint with our Grievance Officer (details in Section 8). We respond within 48 hours and resolve within 30 days.
• Right to Withdraw Consent (Section 6(4)) — Withdraw any consent at any time via the Privacy Center. Withdrawal does not affect processing carried out before withdrawal.
• Right to Nominate — You may nominate another individual to exercise your rights in the event of your death or incapacity. Contact us to register a nominee.

We use four categories of cookies. Only Essential cookies are loaded without consent. All others require your explicit agreement via our Cookie Banner.

• Essential — Authentication session tokens, CSRF protection, and load balancing. These cannot be switched off as the site cannot function without them.
• Functional — Remember your search filters, preferred city, and UI theme preferences across sessions.
• Analytics — Aggregate, anonymised page-view and feature-usage data to help us improve SettleIn. No individual user is tracked across sites.
• Marketing — Allow us to show you relevant listings on partner platforms. We do not engage in cross-site behavioural advertising without your explicit consent.

You can change your cookie preferences at any time via the Privacy Center → Consents tab.

• Active Account Data — Retained for the duration of your account. You can delete your account at any time.
• Security & Audit Logs — Login events, consent changes, and audit records are retained for up to 24 months (or your chosen preference, minimum 12 months) then automatically purged by our nightly cleanup job.
• Soft-Deleted Accounts — After you request deletion, your account and all associated data enter a 30-day recovery window. During this period the data is hidden from all platform surfaces. After 30 days, all personal data is permanently and irreversibly erased from our production database and backups.
• Anonymised Analytics — Aggregate statistics derived from your usage (with your analytics consent) may be retained indefinitely, but they cannot be linked back to you.
• Backup Retention — Database backups containing personal data are rotated every 7 days. After account deletion, your data is absent from new backups and purged from existing ones within the 30-day window.

As required by Section 13 of the DPDP Act, 2023, SettleIn has appointed a Grievance Officer to address privacy concerns:

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once constituted under the DPDP Act, 2023.

For general queries, contact us at hello@settlein.in. For data export or deletion, use your Privacy Center.