Privacy Policy

Nilam Insights Private Limited ("Nilam Insights", "we", "us", "our") operates the Nilam Insights mobile application and the associated web portal. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

This policy covers all of the following, together referred to as the "Service":

• the Nilam Insights Android application, published on Google Play;
• the Nilam Insights iOS application, where made available;
• the web portal at portal.nilam.io and the website at nilam.io;
• the backend systems and APIs that support the above.

By creating an account or using the Service, you confirm that you have read and understood this policy. Where the law requires your consent, we ask for it separately and you may withdraw it at any time — see Section 10.

Nilam Insights Private Limited is the data fiduciary (also referred to as the data controller) responsible for your personal data.

Grievance Officer

Under the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices) Rules, 2011, we have appointed a Grievance Officer to handle complaints about how your personal data is handled.

When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. We only collect data we actually need to run the Service. The tables below are the complete list.

3.1 Account and profile data

3.2 Property and document data

3.3 Site visit data (field executives)

When a customer provides consent for a site visit, the field executive carries out a site inspection using the mobile app. The following data are collected and shared with the customer:

Photographs and videos captured during a visit are stamped with the Nilam Insights logo, the property address, the GPS coordinates and the capture time. This is a deliberate anti-tampering measure so that a site record cannot later be passed off as belonging to a different place or date. The stamp is part of the stored image.

Location is collected only while the app is in use, and only in connection with capturing site evidence. We do not track your location in the background, and we do not build a movement history or location profile of you.

3.4 Device and usage data

We do not use any advertising or analytics tracking SDK in the mobile app. We do not sell your personal data, we do not share it with data brokers, and we do not use it for behavioural advertising or profiling.

The mobile app asks for the permissions listed below. Android and iOS both ask you to approve each one the first time it is needed, and you can revoke any of them later in your device settings.

We do not request background location, contacts, SMS, call logs, calendar, or the list of installed apps.

We use your personal data for the following purposes, and for no others:

• Account and access — to create and maintain your account, verify your mobile number by OTP, and sign you in.

• Delivering the Service — to record properties, store land documents, schedule and record site visits, and generate reports.

• Location and photo stamping — to give a site record evidentiary value by tying it to a verified place and time.

• Service notifications — to notify you by WhatsApp, email, SMS or in-app message when a document is ready, a visit is completed, a payment is due, or your account status changes. These are service messages, not marketing.

• Contracts and payments — to prepare agreements, invoices and receipts, and to record payments.

• Security and fraud prevention — to detect and prevent unauthorised access, fraud and misuse, and to keep an audit trail of who did what.

• Support and improvement — to fix faults, improve reliability and understand which features are used. This work is done on aggregated data wherever possible.

• Legal obligations — to comply with applicable law and to establish, exercise or defend legal claims.

Marketing

We will send you marketing or promotional messages only if you have separately opted in. You can withdraw that consent at any time from your account settings or by writing to contact@nilam.io. Withdrawing marketing consent does not affect service messages, which are necessary to operate your account.

We process personal data under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules, and, where applicable, under the CCPA/CPRA, the UK GDPR, the EU/EEA GDPR and PIPEDA.

Payment data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment method and confirmation of payment.

We do not sell your personal data. We share it only with the following categories of recipient, and only to the extent needed for the purpose shown.

Every service provider is bound by a written agreement requiring them to process your data only on our instructions, to keep it secure, and not to use it for their own purposes.

Your personal data is stored on Microsoft Azure infrastructure located in India.

Some of our service providers — for example WhatsApp and Google Maps — are international companies and may process limited data (such as a mobile number or a map coordinate) outside India. Where that happens we rely on appropriate technical, organisational and contractual safeguards, including the European Commission's Standard Contractual Clauses, and PIPEDA and GDPR requirements where applicable, and we transfer only the minimum data needed. We do not transfer personal data to any territory that the Government of India has restricted under Section 16 of the Digital Personal Data Protection Act, 2023.

Where required by applicable law, you may request information regarding the safeguards used for international transfers of your personal data by contacting us using the details provided in this Privacy Policy. By using our Services and providing your personal data, you acknowledge that your personal data may be transferred to, stored and processed in countries outside your country of residence, including India, where data protection laws may differ from those of your home jurisdiction. We will, however, take appropriate steps to ensure that your personal data receives a level of protection consistent with applicable legal requirements and this Privacy Policy.

We keep personal data only as long as we need it. Specific periods:

After a retention period ends, we delete the data or irreversibly anonymise it so it can no longer be linked to you.

You have the following rights over your personal data, as applicable under the Digital Personal Data Protection Act, 2023 and, where they apply to you, the CCPA/CPRA, the UK GDPR, the EU/EEA GDPR and PIPEDA:

• Right to information — to be told what personal data we hold about you, what we do with it, and who we have shared it with.

• Right of access — to receive a copy of the personal data we hold about you.

• Right to correction — to have inaccurate or incomplete data corrected or completed.

• Right to erasure — to ask us to close your account and stop processing your personal data. Because we are required to keep property and financial records (see Section 9), your account is archived rather than erased immediately; it is deleted when those retention periods end. See Section 11.

• Right to restrict processing — to ask us to pause processing while a dispute about accuracy or lawfulness is resolved.

• Right to data portability — to receive your data in a structured, machine-readable format, or to have it sent to another provider.

• Right to object — to object to processing we carry out on the basis of our legitimate interests.

• Right to withdraw consent — to withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing that already took place, and there is no penalty for withdrawing.

• Right to grievance redressal and nomination — to complain to us, and to nominate another person to exercise these rights on your behalf if you die or become incapacitated.

How to exercise a right

Email contact@nilam.io from the email address registered on your account, or write to the Grievance Officer at the address in Section 2. We will verify your identity and respond within 10 days. There is no charge. If we cannot act on your request, we will tell you why and explain how to escalate.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

You can ask us to close and archive your account, and stop all further processing of your personal data, at any time.

Online, without signing in

Use the account deletion request form. You do not need to sign in or install the app to submit it. We verify the request and confirm by email or WhatsApp within 48 hours.

By email

Email contact@nilam.io from your registered email address, or from the mobile number registered on your account, asking us to archive or disable your account. The data from the archived account will not be used for marketing or promotional purposes.

What happens next

• We verify that the request is genuinely from you.
• Your account is deactivated immediately and you can no longer sign in.

What we must keep, and why

Some records cannot be deleted on request because the law requires us to keep them, or because another party has a legitimate interest in them:

• Invoices, receipts and payment records — kept for 8 years under Indian tax and companies legislation.
• Signed agreements and acknowledgements — kept for the limitation period applicable to the contract.
• Property records, land documents and site visit evidence belonging to an organisation account — these belong to that organisation, not to your personal account, and are retained under Section 9. Ask the organisation's administrator if you want them removed.
• Records subject to an ongoing legal claim, investigation or regulatory hold — kept until the matter concludes.

Anything we retain for these reasons is locked down: it is no longer used to contact you or to provide the Service, and access is restricted to the staff who need it for the legal purpose.

• Encryption in transit — all traffic between the app or browser and our servers is encrypted in transit using TLS 1.2 or higher.

• Encryption at rest — databases, file storage and backups are encrypted at rest using AES-256.

• Private file storage — documents, photographs and videos are held in private storage. They are never publicly readable. Access is granted through short-lived signed links that expire after 15 minutes.

• Authentication — sign-in is by one-time password sent to your registered mobile number. Session tokens are held in the device's secure keystore.

• Access control — role-based access control means each user sees only the records their role and organisation permit.

• Audit logging — sign-ins and significant actions are logged so that unauthorised access can be detected and investigated.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required by law, without undue delay.

The Service is intended for use by adults in a professional or property-owner capacity. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18.

Under the Digital Personal Data Protection Act, 2023, we may only process the personal data of a child under 18 with the verifiable consent of a parent or lawful guardian. We do not offer such a consent mechanism, and accounts may only be created by persons aged 18 or over.

We do not carry out behavioural monitoring, tracking or targeted advertising directed at children.

If you believe a child has provided us with personal data, contact us at contact@nilam.io and we will delete it promptly.

The Nilam Insights mobile app does not use cookies or any advertising identifier. The section below applies to nilam.io and portal.nilam.io when accessed through a web browser.

We do not use advertising cookies or third-party tracking cookies. You can refuse or delete cookies in your browser settings; if you block strictly necessary cookies, parts of the portal will not work.

The Service may contain links to websites we do not operate. We are not responsible for their content or their privacy practices. We recommend you read the privacy policy of any site you visit through such a link.

We may update this Privacy Policy from time to time. When we do, we will update the effective date and version number at the top of this document and publish the revised policy at https://nilam.io/privacy_policy/.

If a change materially affects how we use your personal data, we will give you advance notice by email, by in-app message, or by a prominent notice on the Service, before the change takes effect. Where the change requires your consent, we will ask for it.

We recommend that you review this policy periodically.

If you have any question, concern or complaint about this Privacy Policy or about how we handle your personal data:

Nilam Insights Private Limited · Chennai, Tamil Nadu, India · Version 2.0 · Effective 07 September 2026