Privacy Policy

Last updated: April 5, 2026 · Effective from launch date

PGStack is committed to protecting your privacy and complying with India's Digital Personal Data Protection (DPDP) Act, 2023. This policy explains what data we collect, why, and how we protect it.

1. Information We Collect

We collect information you provide directly: • Phone number and OTP for authentication • Name, email address, and profile photo • Property details, photos, and documents (for PG owners) • KYC documents (Aadhaar/PAN) for identity verification • Booking details and communication history • Location data (only when you use Near Me search, with your permission)

2. How We Use Your Information

We use your information to: • Authenticate your identity and maintain your account • Connect seekers with PG owners • Process booking requests and send confirmations • Verify KYC for owners and agents • Send transactional communications (OTP, booking updates) • Improve platform features and detect fraud

3. Data Sharing

We do not sell your personal data. We share data only: • With the other party to a booking (owner sees seeker name/phone, seeker sees owner contact) • With field agents assigned to verify your property (owners only) • With AWS (our infrastructure provider) for storage and processing • With MSG91 for OTP delivery • With payment processors (Razorpay) for transactions • When required by law or valid legal process

4. Data Security

We implement industry-standard security measures: • AES-256-GCM encryption for sensitive data at rest • HTTPS/TLS encryption for all data in transit • HSTS (HTTP Strict Transport Security) enforced • Rate limiting on authentication endpoints • Session version control (logout-all-devices) • All media files stored in private S3 buckets with presigned URLs

5. Your Rights (DPDP Act, 2023)

Under India's Digital Personal Data Protection Act, 2023, you have the right to: • Access the personal data we hold about you • Correct inaccurate personal data • Request deletion of your account and personal data • Withdraw consent for data processing • Nominate a person to exercise rights on your behalf To exercise any right, contact us at privacy@pgstack.co.in

6. Data Retention

We retain your data as long as your account is active. After account deletion: • Profile data is deleted within 30 days • Booking records are retained for 2 years for legal compliance • KYC audit logs are retained as required by applicable law

7. Cookies

We use only essential cookies required for authentication (session tokens). We do not use advertising or tracking cookies. You can clear cookies at any time from your browser settings.

8. Children's Privacy

PGStack is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us their data, contact us at privacy@pgstack.co.in.

9. Changes to This Policy

We may update this policy periodically. We will notify you of material changes via email or in-app notification. Your continued use of PGStack after changes constitutes acceptance of the updated policy.

10. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the details of the Grievance Officer are: Name: Grievance Officer Email: grievance@pgstack.co.in Organisation: PGStack, Hyderabad, Telangana, India Complaints must be acknowledged within 24 hours and resolved within 15 days of receipt.

11. Contact

For privacy-related queries: Email: privacy@pgstack.co.in PGStack, Hyderabad, Telangana, India