Privacy Policy

1. Scope of this policy

This Privacy Policy applies to the Propifo website (propifo.com), the Propifo Nucleus workspace, and all connected services operated by Throne Matrix Pvt Ltd ("Propifo", "we", "us"). By using the platform or submitting any form, you agree to the practices described here. This policy should be read together with our Terms & Conditions.

2. Information we collect

We collect only what we need to serve you:

• Identity & contact details: name, phone number, email address, and city, submitted through consultation, booking, enquiry, complaint, or payment forms.
• Property & project details: site address, property type, carpet area, budget range, timeline, design preferences, and photos you choose to upload.
• Account information: if you sign in (including with Google), your email, display name, and profile photo as provided by the sign-in provider.
• Transaction information: service selected, amount, payment status, GST receipt data, and Razorpay payment or order reference IDs.
• Support information: complaint descriptions, ticket numbers, chat transcripts, and call notes.
• Technical information: IP address, browser and device type, pages visited, referring URL, and approximate location derived from IP.
• Optional location data: precise GPS coordinates only where you explicitly grant permission (for example, employee attendance punch-in inside Propifo Nucleus).

We do not knowingly collect sensitive personal data such as biometric, health, caste, or religious information, and we ask you not to submit it through our forms.

3. How we use your information

• To respond to your consultation requests, enquiries, and service bookings;
• To schedule site visits, prepare quotes, and deliver the services you engage us for;
• To process payments and issue GST-compliant receipts and invoices;
• To handle complaints, warranty claims, and support tickets;
• To send transactional updates by email, SMS, WhatsApp, and phone;
• To send relevant offers and updates, where you have not opted out;
• To detect fraud, prevent abuse, and secure our platform;
• To analyse aggregated usage and improve our website and services;
• To comply with tax, accounting, and other legal obligations.

We do not sell, rent, or trade your personal data.

4. Legal basis for processing

We process personal data on the basis of the consent you give when submitting a form or creating an account, the necessity of performing a contract you have entered into with us, our legitimate interests in operating and securing the platform, and our legal obligations under Indian tax and corporate law. You may withdraw consent at any time, though this may prevent us from continuing to provide certain services.

5. When we share information

We share personal data only in these limited situations:

• Service delivery partners: vetted contractors, designers, engineers, and home-service professionals assigned to your project receive only the details needed to serve you.
• Technology providers: Supabase (secure database, authentication, and file storage), Razorpay (payment processing), Resend (transactional email delivery), Cloudflare Turnstile (bot protection), and Google (sign-in and analytics).
• Legal and regulatory: where disclosure is required by law, court order, or a lawful government request.
• Business transfer: in a merger, acquisition, or restructuring, with the same protections continuing to apply.

All partners are bound by confidentiality obligations and may use your data only for the purpose we specify.

6. Payment data & Razorpay

Online payments are processed by Razorpay, a PCI-DSS compliant payment gateway. Your full card number, CVV, UPI PIN, OTP, and net-banking password are entered directly on Razorpay's secure interface and are never seen, transmitted, or stored by Propifo. We retain only the payment reference ID, amount, service description, payment status, and the details required to issue your GST receipt.

7. Cookies & analytics

We use a small number of cookies and similar technologies:

• Essential cookies keep you signed in and maintain your session and security tokens. These cannot be disabled while using the platform.
• Preference storage remembers choices such as sidebar state or dismissed banners, stored locally in your browser.
• Analytics cookies help us understand aggregate traffic and page performance so we can improve the site.

You can block or delete cookies through your browser settings. Blocking essential cookies will break sign-in and payment flows.

8. How long we keep data

• Enquiries and leads that do not convert: retained for up to 24 months, then deleted or anonymised.
• Active customer and project records: retained for the duration of the engagement plus the applicable warranty period.
• Invoices, receipts, and tax records: retained for at least 8 years, as required by Indian tax law.
• Support tickets and complaint records: retained for 3 years after closure.
• Account data: retained until you request deletion, subject to the legal retention periods above.

9. How we protect your data

Data is transmitted over HTTPS/TLS encryption and stored in access-controlled databases protected by row-level security policies, so each user and staff member can access only the records they are authorised to see. Uploaded documents are held in private storage buckets accessible only through signed, time-limited links. Admin access is role-based, and staff accounts in Propifo Nucleus require explicit admin approval before activation. Despite these measures, no system is completely secure, and you share information at your own risk.

10. Your rights under the DPDP Act

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed;
• Request correction of inaccurate, incomplete, or outdated data;
• Request erasure of your data where it is no longer needed for the purpose collected;
• Withdraw consent for processing or marketing communications;
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity;
• Raise a grievance with us and, if unresolved, escalate to the Data Protection Board of India.

To exercise any right, email connectpropifo@gmail.com from your registered email address. We respond within 30 days and may ask you to verify your identity first.

11. Children's privacy

Propifo services are intended for users aged 18 and above. We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will delete it promptly on becoming aware.

12. Third-party links

Our platform may link to third-party websites, listings, or payment pages. This policy does not cover those services, and we are not responsible for their privacy practices. Please review their policies before sharing information with them.

13. Employee data (Propifo Nucleus)

Propifo Nucleus is our internal workspace for employees and authorised partners. It processes staff profile details, attendance records (including optional GPS location captured at punch-in with consent), HR and payroll records, task and lead activity, and internal chat messages. Access is restricted by role, employees are notified of location capture before granting permission, and data is used solely for legitimate employment and operational purposes.

14. Changes to this policy

We may update this policy as our services or the law evolve. The current version is always published on this page with a refreshed "Last updated" date. Material changes will be communicated by email or an on-site notice where appropriate.

15. Grievance officer & contact

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, we have appointed a Grievance Officer for all privacy-related concerns: