Privacy Policy

Last updated: 19 October 2026

This Privacy Policy explains what personal data Dalalmaf collects, why, who we share it with, how long we keep it, and the rights you have. It applies to the website https://dalalmaf.com and everything on it. We wrote it to follow India's Digital Personal Data Protection Act, 2023 and its Rules, and the Information Technology Act, 2000.

1. Who we are

Dalalmaf (https://dalalmaf.com) is the "Data Fiduciary".

Dalalmaf is an online listing platform. Property owners post their properties, and people looking to buy, rent, lease or find PG accommodation contact them directly. We are not a broker or agent.

2. Personal data we collect

When you create an account or sign in

• Your mobile number, which we verify with a one-time code (OTP) sent by SMS.
• Your name.
• A password, if you choose to set one. We store only a secure one-way hash of it, never the password itself.
• Your email address, only if you choose to add one to your profile.
• A profile photo, only if you choose to add one.

When you post a property

• The property's details: type, purpose (sale, rent, lease or PG), price, size, features, description, address and map location.
• Photos and videos you upload.
• Whether buyers may see your phone number. You choose this for each listing, and it's off unless you turn it on.

When you contact an owner

• Your name and mobile number, which we share with that owner when you send an enquiry (see section 4).
• Your message, and the listing it's about.
• A record that you viewed an owner's phone number, where the owner allows it to be shown.

Bankers on Auction Properties

If you register as a banker to post bank-auction properties, we also collect your bank, branch name and address, designation, official bank email address (which we verify with a link), and optionally your employee ID and photo. We use them to confirm that you work for the bank. They aren't shown on the public site, where a listing says only "Verified Banker" and the bank's name.

If you send an enquiry about an auction property, we share your name, mobile number, optional email and message with the banker who posted it.

Collected automatically

• Your IP address and browser type, used for security, fraud prevention and to stop abuse. In our logs we keep a protected (hashed) form of your IP address wherever possible.
• Records of sign-ins, OTP requests and security events.
• Essential cookies, explained in our Cookie Policy (https://dalalmaf.com/legal/cookies).

Kept only on your device

If you choose "Accept all" in the cookie banner, your browser remembers the listings you recently viewed and your recent searches. That information stays on your device and is never sent to us.

We don't collect sensitive information such as financial account numbers, Aadhaar or PAN, and we ask you not to put it in listings or messages.

3. Why we use your data

We use your personal data only for these purposes, based on the consent you give when you register, post a listing or send an enquiry, and for the legitimate uses the law allows (such as security and legal compliance):

• To create and run your account, and to verify your mobile number.
• To publish, review and manage your property listings.
• To put people who are interested in a property in touch with its owner.
• To send you messages about your account and listings: sign-in codes, enquiries, approvals, changes needed and expiry reminders.
• To keep the platform safe: checking listings before they go live, detecting fraud, spam and fake listings, and handling reports.
• To promote listings on Dalalmaf and on Dalalmaf's social media channels, using the photos, videos and listing details that the owner allowed us to use when submitting the listing (see section 5).
• To comply with the law, respond to lawful requests from authorities, and protect our rights and our users.

We only send offers or news by email or WhatsApp if you have opted in, and you can withdraw that permission at any time in Account → Privacy and your data.

4. Sharing your contact details with owners

When you send an enquiry about a listing, you agree that we share your name and mobile number with that listing's owner, so that they can reply to you. We share them only with the owner of the property you enquired about.

An owner's phone number is shown on a listing only if the owner chose to show it. Otherwise, owners reply to enquiries themselves.

If you contact Dalalmaf by phone or WhatsApp about a listing, our staff may pass your name, number and question to the owner, but only after you agree to that.

5. Videos and YouTube

Owners can upload a video of their property. When submitting a listing, the owner confirms that they own the photos and videos or have permission to share them, and allows Dalalmaf to use them, together with the listing's details, to promote the property on Dalalmaf and on Dalalmaf's social media channels, such as YouTube, Instagram, Facebook and Threads.

Dalalmaf uses YouTube API Services. After a listing is approved, we may publish its video on Dalalmaf's own YouTube channel (https://www.youtube.com/@dalal_maf) and play it on the listing page from YouTube. The video's title, description and tags are made only from information the listing already shows publicly: the listing title, property type, purpose, locality, city, price, description and a link to the listing. We never include the owner's name, phone number or exact address.

• YouTube is a service of Google. When a video is on YouTube, Google handles it under the Google Privacy Policy: https://www.google.com/policies/privacy
• YouTube's Terms of Service apply to videos on YouTube: https://www.youtube.com/t/terms
• Dalalmaf doesn't ask you to sign in with Google or YouTube, and doesn't access your YouTube account or any YouTube data about you.
• On a listing page, YouTube's player loads only when you press play, and it uses YouTube's privacy-enhanced mode.
• A published video stays on Dalalmaf's channel after the listing is sold or removed. If you want your video taken down, write to our Grievance Officer (section 11) and we will remove it within 30 days.

6. Service providers we use

We share data only with service providers who process it for us to run Dalalmaf, under contracts or terms that require them to protect it:

• Hostinger — hosts the website and our database on a server in Mumbai, India.
• MsgClub — sends SMS messages, including sign-in codes (India).
• Cloudinary — stores and delivers listing photos and videos.
• Google — Google Maps for addresses and map locations on listings, and YouTube for listing videos (section 5).
• Cloudflare Turnstile — checks that forms are being filled in by a person and not an automated program.
• Resend — sends emails, such as bank email verification links and notifications to our team.

Some of these providers may process data outside India. Where they do, it's only as the law allows.

We don't sell your personal data, and we don't share it with advertisers.

We may also disclose personal data when required by law, a court order or a lawful request from a government agency, or to protect the safety of users or the public.

7. How long we keep your data

We keep personal data only as long as we need it for the purposes above or as the law requires:

• Your account: while it's open. If you delete it, see section 8.
• Listings: while live, and afterwards in your account so you can see and renew them.
• Enquiries: the sender's contact details are removed 3 years after the enquiry. The listing, date and status are kept for the owner's records.
• Records of phone numbers being viewed: 1 year.
• Sign-in code records and security logs: 1 year, as required by law. One-time codes themselves expire within minutes and are deleted after 30 days.
• Ended sign-in sessions: 30 days.
• Email addresses and phone numbers that a message was sent to: 90 days. The record of the message itself: 1 year.
• Records of your consent: kept as proof of what you agreed to and when, even after your account is closed.

8. Your rights

You have the right to:

• Access your data. Download a copy any time from Account → Privacy and your data.
• Correct it. Edit your profile and listings yourself, or ask us to correct anything else.
• Erase it. Delete your account from Account → Privacy and your data. Your live listings are paused straight away. You have 30 days to change your mind by signing in again. After that, we remove or anonymise everything that identifies you. We keep only what the law requires (such as security logs) and the records of your consent.
• Withdraw consent for optional messages (email offers, WhatsApp updates) at any time, in Account → Privacy and your data. Withdrawing consent doesn't affect anything we did before.
• Nominate someone to exercise your rights if you die or become unable to do so.
• Complain to our Grievance Officer (section 11). If you aren't satisfied with our answer, you may complain to the Data Protection Board of India.

We respond to requests within 30 days. You can make a request from Account → Privacy and your data, or by writing to our Grievance Officer.

9. Security

We protect your data with industry-standard measures:

• encrypted connections (HTTPS) on every page;
• passwords stored as one-way hashes;
• limits on sign-in attempts and code requests;
• a separate, two-factor sign-in for our staff;
• staff access limited to what each role needs, with a record of every staff action;
• regular backups.

No system is completely secure. If a personal data breach affects you, we will tell you and the Data Protection Board as the law requires.

10. Children

Dalalmaf is for adults. You must be 18 or older to create an account. We don't knowingly collect personal data from children. If you believe a child has given us personal data, contact our Grievance Officer and we will delete it.

11. Contact and Grievance Officer

For any question, request or complaint about your personal data, contact our Grievance Officer:

• Name: Roshni Patel
• Designation: Grievance Officer
• Email: info@dalalmaf.com
• Phone: +91 99251 33440

See also our Grievance Redressal page: https://dalalmaf.com/grievance

12. Changes to this policy

We may update this policy when our services or the law change. We will show the new date at the top of this page. If the change is significant, we will tell you on the website or by message before it takes effect, and ask for your consent again where the law requires.