Privacy Policy
1. Who we are
SafeLease ("SafeLease", "we", "us", "our") is an AI-assisted rental hazard verification service operated as a sole proprietorship by Pratik Limbachiya, based in Surat, Gujarat, India. We provide hazard reports on residential rental properties based on photos and information submitted by users through our website at safelease.in.
For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDPA"), we act as the Data Fiduciary for the personal data you provide to us. You, as the user, are the Data Principal.
2. What data we collect
2.1 Data you provide directly
- Email address — when you join the waitlist or purchase a report.
- Name — if you provide it during checkout or support requests.
- Phone number — optional, only if you purchase the Inspector Visit tier where a scheduled site visit is needed.
- Property details — the address, rent, locality, and photos of the unit you're evaluating. We recommend you do not upload photos containing identifiable people or personal documents.
- Payment information — for paid reports (starting at ₹299), payment is processed through Razorpay. We receive confirmation of payment status, the Razorpay payment ID, and the last 4 digits of your card where applicable. We do not store your full card number, CVV, UPI PIN, or banking credentials — these stay with Razorpay.
2.2 Data collected automatically
- Technical data — IP address, browser type, device type, operating system, pages visited, and timestamp. This is logged at the server level for security and debugging.
- Cookies and similar — we use only essential cookies needed to run the site (such as session cookies and form submission tokens). We do not currently use advertising cookies or cross-site trackers.
3. Why we collect this data (purpose)
Under DPDPA Section 5, we must tell you the specific purpose for which your data is collected. Here's our full list:
| Data | Purpose | Legal basis |
|---|---|---|
| Deliver your report, send waitlist updates, respond to support requests | Consent | Contract | |
| Property photos & details | Generate the hazard report you paid for | Contract (performance of service) |
| Payment information | Process your ₹299 (or ₹1,499) payment and issue refunds if approved | Contract | Legal obligation (accounting) |
| Phone (Inspector tier only) | Coordinate the scheduled in-person inspection | Consent |
| Technical / server logs | Security, fraud prevention, debugging | Legitimate use (Section 7 DPDPA) |
4. How we use AI to generate your report
When you upload property photos, we send them to third-party AI providers (such as OpenAI or Anthropic, depending on availability) to analyse visible conditions like mould, damp patches, structural cracks, pest evidence, and exposed wiring. These providers process the images on servers outside India, typically in the United States.
- We send only the photos and minimal text context needed for the analysis — not your email, name, or payment details.
- Our AI provider agreements prohibit them from using your submissions to train their models.
- We do not upload your photos to any public internet location.
By purchasing a report, you consent to this cross-border processing for the specific purpose of generating your report. See Section 9 for more on cross-border transfers.
5. Who we share your data with
We share your data only with these categories of recipients, and only for the purposes listed above:
- Razorpay Software Private Limited — our payment processor. See Razorpay's Privacy Policy.
- Formspree — handles waitlist email submissions. See Formspree's Privacy Policy.
- Cloudflare, Inc. — hosts the website, serves content, and protects against attacks. See Cloudflare's Privacy Policy.
- AI analysis providers (OpenAI, Anthropic, or equivalents) — for report generation, as described in Section 4.
- Google — if we enable Google Analytics (currently we do not; we will update this policy and notify you if that changes).
- Law enforcement or regulators — only if legally compelled by a valid order from an Indian court, the Data Protection Board of India, or an equivalent authority.
We do not sell your personal data. We do not share your report, photos, or contact details with your landlord, broker, or any third party without your explicit written request.
6. Your rights under DPDPA
As a Data Principal under India's DPDPA, 2023, you have the following rights:
- Right to access (Section 11) — you can request a summary of the personal data we hold about you and the purposes for which it's being processed.
- Right to correction and erasure (Section 12) — you can ask us to correct inaccurate data or erase data we no longer need.
- Right to withdraw consent (Section 6) — where we rely on consent, you can withdraw it at any time. Withdrawal doesn't affect processing done before the withdrawal.
- Right to grievance redressal (Section 13) — see our Grievance Officer details in Section 11 below.
- Right to nominate (Section 14) — you can nominate another person to exercise these rights on your behalf in case of your death or incapacity.
To exercise any of these rights, email pratiklimbachiya4@gmail.com with the subject line "DPDPA Request". We will respond within 30 days.
7. How long we keep your data
| Data type | Retention period |
|---|---|
| Waitlist email (no purchase) | Until you unsubscribe, or 24 months of inactivity |
| Report photos and AI outputs | 90 days after report delivery, then permanently deleted |
| Final PDF report | 12 months, so you can re-download |
| Payment records and invoices | 8 years (required under Income Tax Act, 1961 and GST law) |
| Server / access logs | 90 days |
You can request earlier deletion of report photos and AI outputs at any time via email.
8. How we protect your data
We use reasonable security practices in line with Rule 8 of the Information Technology (Reasonable Security Practices) Rules, 2011 and DPDPA Section 8(4):
- HTTPS / TLS encryption on every page
- Payment data handled entirely within Razorpay — PCI-DSS Level 1 certified
- Access to report data is restricted to the proprietor and authorised contractors bound by confidentiality
- Report files stored with industry-standard encryption at rest
No system is 100% secure. If we become aware of a breach that affects your personal data, we will notify you and the Data Protection Board of India within 72 hours, as required under DPDPA Section 8(6).
9. Cross-border data transfers
Some data (primarily the property photos you upload) is processed on servers outside India by our AI providers, typically in the United States. Under DPDPA Section 16 and Rule 15, cross-border transfers are permitted to all countries by default, except those the Central Government has placed on a negative list. We will stop transferring to any country that appears on such a list.
10. Children's data
SafeLease is intended only for users aged 18 and above. We do not knowingly collect personal data from children under 18. If we learn that a child has given us data, we will delete it. Under DPDPA Section 9, we do not target children for advertising or conduct behavioural tracking of minors.
11. Grievance Officer (required under IT Rules 2011 and DPDPA)
Contact for data-related questions, complaints, or requests
Name: Pratik Limbachiya
Designation: Proprietor & Grievance Officer
Email: pratiklimbachiya4@gmail.com
Response time: within 30 days, as required under Rule 5(9) of the IT Rules, 2011
Jurisdiction: Surat, Gujarat, India
If you are not satisfied with our response, you may also file a complaint with the Data Protection Board of India once it's operational, or with the relevant authority under the Consumer Protection Act, 2019.
12. Changes to this policy
We may update this policy when laws change or our practices evolve. The "Last updated" date at the top will reflect any revision. For material changes — for example, adding new categories of recipients or new purposes — we will notify you by email if we have it, at least 15 days before the change takes effect.
13. Governing law
This Privacy Policy is governed by the laws of India. Any disputes arising from it are subject to the exclusive jurisdiction of the courts of Surat, Gujarat.