Privacy Policy

1. Introduction

This Privacy Policy explains how Haalaaraa Technologies Private Limited (“Haalaaraa”, “we”, “us”, or “our”) collects, uses, shares, and protects your personal data when you use the SettleIns website and mobile application (together, the “Platform”).

SettleIns helps people discover and evaluate paying-guest accommodation and rental living spaces in India, connect with property owners and operators, and make better relocation decisions. By using the Platform, you confirm that you have read and understood this Policy. Where the law requires your consent for a specific use of your data, we ask for it separately, and you may withdraw it as described in Section 17.

2. Who We Are

The Platform is owned and operated by:

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Haalaaraa Technologies Private Limited is the Data Fiduciary responsible for your personal data. You can reach us at hello@settleins.com, and you can contact our Grievance Officer using the details in Section 23.

3. Scope of this Privacy Policy

This Policy applies to everyone who uses the Platform, including people searching for accommodation, people who contribute reviews or property information, and property owners and operators who interact with us.

This Policy does not govern how property owners, operators, payment gateways, or other third parties use your data once it reaches them, or the practices of any third-party website or service the Platform links to. Their own privacy policies apply to those dealings.

4. Information We Collect

We collect only the information needed to operate the Platform and provide our services.

Registration and Login. Our primary sign-in method is mobile-number authentication with a one-time password (OTP). We also support a secondary method using your mobile number together with a password. When you register, we collect your mobile number, full name, email address, date of birth, and gender. You may add optional profile information if you choose.

Profile. Your profile holds the registration details above and any optional information you add, such as your accommodation preferences.

Location. We handle three distinct types of location data:

• Device GPS location — collected only after you grant permission. For people searching, it is used to discover accommodation and locality information near you. For property owners, it is used to autofill listing and address details while creating a property listing. We do not collect location in the background.
• User-selected location — the area or workplace you choose while searching, used to show relevant search results and commute-related information.
• Approximate location from your IP address — used for security and anomaly detection, including helping protect the integrity of reviews and contributions, and to provide a relevant default experience.

Property Search. We store your search preferences, saved filters, favourite properties, shortlisted properties, and saved enquiry preferences, so you can resume and personalise your search.

Reviews. When you contribute, we collect your ratings, category ratings, and text reviews.

Enquiries and Booking Interest. When you submit an enquiry, callback request, or booking-interest request, we collect the details needed to act on it, including the property concerned, your requirement, and your contact details. Section 10 explains how this information is shared with the property owner or operator you choose.

Payments. When you make a payment through the Platform, your payment instrument is processed by our payment gateways. Tenant-side card and UPI processing is handled entirely by the gateway. We do not store your card numbers or CVV. We retain only transaction references, receipts, and settlement metadata, and owner payout details — such as a UPI ID or bank account information — only where required to make settlements to property owners.

Communications. We collect the content and records of communications you have with us or that we send to you through SMS, email, and push notifications, including support requests and your responses. Where you choose to contact a property owner using our click-to-chat feature, you are connected directly with that owner on WhatsApp.

Device Information. We collect technical information about the device you use, including device model, platform, app version, browser, push token, IP address, and device identifier.

Analytics Information. We collect usage and event information about how the Platform is used, as described in Section 12.

5. How We Collect Information

We collect information in three ways: information you provide directly (such as registration details, search activity, reviews, enquiries, and payments); information collected automatically through your use of the Platform (such as device, usage, approximate location, and analytics data); and information we receive from the service providers who help us operate the Platform (such as payment status from our payment gateways and message-delivery information from our communication providers).

6. Why We Use Your Information

We use your personal data to:

• create and secure your account and authenticate you using OTP or password-based sign-in;
• show you relevant accommodation, locality, and commute information;
• save and personalise your searches, filters, and shortlists;
• receive and act on your enquiries, callback requests, and booking-interest requests, and connect you with the property owner or operator you choose;
• process payments and maintain transaction records;
• publish and manage reviews and community contributions, and operate property verification;
• send you service communications by SMS, email, and push notification, such as OTPs, enquiry and transaction updates, and support responses;
• send any promotional communications we may introduce in the future only with the consent required, as described in Section 19;
• understand, maintain, secure, debug, and improve the Platform;
• detect and prevent fraud, misuse, and security incidents; and
• comply with our legal, tax, and regulatory obligations.

7. Lawful Grounds for Processing

We process personal data on the lawful grounds available under Indian law, including the DPDP Act and the Information Technology Act, 2000 and the rules made under it. These grounds are:

• Your consent — for example, for device GPS location and certain optional profile information, and for any promotional communications we may introduce in the future. You may withdraw consent at any time (Section 17), which will not affect processing already carried out and may limit certain features.
• Legitimate uses permitted under the DPDP Act — including where you voluntarily provide your personal data for a specified purpose and have not objected to its use for that purpose, such as submitting an enquiry so that we can connect you with an operator.
• Compliance with legal obligations — including tax, accounting, and lawful requests from authorities.

8. Community Contributions and Property Verification

SettleIns includes information contributed by community members about properties. To help keep this information reliable, we may review contributions, verify information, contact property owners to confirm details, and edit, reject, or remove contributions. After verification, we may display a “SettleIns Verified” or similar indicator on a property.

These indicators reflect the verification steps we have taken at a given time. They are intended to help you make decisions, but we do not guarantee that any community-contributed or verified information is complete, current, or accurate, and you should confirm important details directly with the property owner before making commitments.

9. Verification Calls

As part of property verification, we may contact property owners and operators by phone to confirm details. We do not currently record these calls. Any future introduction of call recording or AI call summarisation is listed in Section 20 and is not active today.

10. How We Share Information

We do not sell your personal data. We share it only as described below.

Sharing your enquiry with the property owner or operator you choose. This is the most important sharing you should understand. When you submit an enquiry, callback request, or booking-interest request, you are asking us to pass your request to the specific property owner or operator you have selected so they can respond to you. At the point of submission, we tell you that your details will be shared, and we proceed only when you choose to submit. We share only the minimum information necessary to respond to your request — such as your name, mobile number, and the details of your enquiry — and not your full profile, browsing history, or saved searches. Once the property owner or operator receives your information, they independently decide how they use it, including how they contact you, and they are separately responsible for that use. If you use our click-to-chat feature, you connect with the owner directly on WhatsApp and share the information you choose to send there. If a property owner or operator misuses your information, please tell us at grievance@settleins.com.

Service providers. We share data with the third-party providers who help us run the Platform, as listed in Section 11, who may process it only to provide their services to us.

Payment gateways. Your payment instrument details, including tenant-side card and UPI details, are processed by our payment gateways under their own terms and are not stored by SettleIns, as described in Sections 4 and 11.

Legal and protective disclosures. We may disclose personal data where required by law or a lawful authority request, or where reasonably necessary to protect the rights, safety, or property of SettleIns, our users, or others, or to detect and prevent fraud and security issues.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to the recipient honouring commitments consistent with this Policy.

11. Third-Party Service Providers

We rely on trusted third parties to operate the Platform. They process personal data on our behalf for the purposes described in this Policy:

• Amazon Web Services (AWS) — cloud hosting and storage.
• AWS SES — email delivery.
• MSG91 — SMS delivery.
• OTPless — sign-in and authentication.
• Firebase — push notifications.
• GetEpay and PhonePe — payment processing.
• Google Maps and Ola Maps — maps, location, and place information.
• Amplitude, Google Tag Manager, and Google Analytics (only where configured through Google Tag Manager) — analytics, as described in Section 12.

12. Cookies, Analytics and Similar Technologies

We and our analytics providers use cookies and similar technologies — including software development kits and identifiers — to keep you signed in, remember your preferences, secure the Platform, and understand how it is used. We use Amplitude for product and event analytics, Google Tag Manager to manage tags, Google Analytics (where configured through Google Tag Manager) for usage analytics, and Firebase for push notifications.

You can control cookies and similar technologies through your browser or device settings, and you can manage push notifications through your device settings. Disabling some of these may affect how the Platform works.

13. Data Retention

We retain personal data only for as long as it is needed for the purposes for which it was collected, and for the additional period required to meet our legal and operational obligations. In deciding how long to keep data, we take into account:

• operational needs, such as maintaining your account, searches, and contributions while you use the Platform;
• legal and tax obligations, including retaining transaction, receipt, and settlement records for the periods required under applicable Indian law;
• fraud prevention and security, where retaining certain records helps us detect and prevent misuse;
• dispute resolution, where data may be needed to address complaints, claims, or legal proceedings; and
• archival requirements, where limited records are kept in backups for business continuity.

When personal data is no longer required for these purposes, we delete, anonymise, or de-identify it within a reasonable period. Some information may persist in secure backups for a limited time before being overwritten in the ordinary course.

14. Security Measures

We maintain security measures designed to protect personal data, including transmission over HTTPS, encryption of data in transit and at rest, secure password hashing using bcrypt for password-based sign-in, role-based access controls, audit logging, and managed backups.

No method of transmission or storage is completely secure. While we work to protect your data, we cannot guarantee absolute security. Please keep your account credentials confidential and notify us at hello@settleins.com if you suspect any unauthorised use of your account.

15. Cross-Border Processing

We primarily process personal data in India. Some of our service providers may process data on servers located outside India. Where this happens, we take reasonable steps to ensure your data remains protected and we comply with applicable requirements under Indian law relating to such processing.

16. Children's Privacy

The Platform is intended for users who are 18 years of age or older, and we collect date of birth at registration to support this. We do not knowingly collect the personal data of children. Under the DPDP Act, processing a child's personal data requires verifiable parental consent and is subject to additional protections. If you believe a child has provided us personal data, please contact us at hello@settleins.com and we will take appropriate steps.

17. Your Rights

Subject to applicable Indian law, you may:

• access a summary of the personal data we hold about you and how we process it;
• correct or update inaccurate or incomplete personal data, including by editing your profile;
• withdraw consent you previously gave, such as for location or optional profile information;
• request deletion of your account and personal data, as described in Section 18;
• request a copy of your personal data through a manual data export request; and
• manage your communication preferences, and opt out of any promotional communications if we introduce them in the future.

To exercise these rights, contact us at hello@settleins.com or our Grievance Officer (Section 23). We may need to verify your identity before acting, and we will respond within the time required by applicable law. Some rights are subject to legal limits and exemptions.

18. Account Deletion

You can request deletion of your account and associated personal data by contacting us at hello@settleins.com. When you make a request, we will delete or anonymise your personal data, except where we are required or permitted to retain certain information — for example, transaction and tax records, or data needed for fraud prevention, security, or dispute resolution, as described in Section 13. Information you have already shared with a property owner or operator through an enquiry, and content you have posted publicly, may continue to exist independently of your account. We will tell you what, if anything, we must retain and why.

19. Service and Marketing Communications

We currently send only service and transactional communications — such as OTPs, enquiry and booking updates, transactional emails, support responses, and account notifications — by SMS, email, and push notification. These communications are a necessary part of providing the Platform, and you cannot opt out of essential service communications while you hold an account or have an active request.

We do not currently send promotional or marketing campaigns. If we introduce promotional or marketing communications in the future, we will send them only in accordance with applicable law and with any consent required, and we will provide a way to opt out.

20. Future Features (Not Yet Live)

The following capabilities are planned and are not available today. They are listed for transparency, and this Policy will be updated before any of them becomes operational:

• WhatsApp Business API messaging;
• Google Sign-In and Apple Sign-In;
• photo and video uploads in reviews;
• DigiLocker-based verification;
• AI call summarisation;
• call recording;
• automated deletion schedules;
• subscription marketplace; and
• owner data exports.

21. Changes to this Privacy Policy

We may update this Policy from time to time. When we make material changes, we will post the updated Policy on the Platform with a new “Last updated” date and, where appropriate or required by law, notify you through the Platform or by other reasonable means. Your continued use of the Platform after an update takes effect indicates your acknowledgement of the updated Policy, to the extent permitted by law.

22. Contact Details

For any questions or requests about this Policy or your personal data:

23. Grievance Officer

In accordance with applicable Indian law, our Grievance Officer is:

We will acknowledge and address grievances within the timeframes required by applicable law.