Privacy Policy

1. About Dorleto

Data Fiduciary: Dorleto Technologies Pvt. Ltd.

Registered Office: Agra, Uttar Pradesh, India

Website: www.dorleto.com

Privacy and Grievance Contact: support@dorleto.com

Dorleto determines the purposes and means for processing personal data in connection with its Services and therefore acts as the Data Fiduciary for such processing.

2. Who Can Use Dorleto

Dorleto currently provides its Services to:

• Tenants;
• Landlords/property owners; and
• Property agents.

Dorleto's Services are intended for individuals who are 18 years of age or older.

Dorleto does not knowingly permit persons below 18 years of age to use features that require eligibility verification, including property listing or property booking.

Age eligibility may be verified through the applicable verification process, including e-KYC where required.

3. Personal Data We Collect

We collect only the personal data reasonably required for the purposes described in this Privacy Policy.

3.1 Account and Authentication Information

When you create or authenticate an account, we may collect:

• Name;
• Mobile number; and
• Authentication/OTP-related information necessary to verify your account.

WhatsApp is currently used for OTP/authentication communications through our service provider, MSG91.

3.2 Profile Information

Depending on the Services you use, we may collect:

• Name;
• Age;
• Occupation; and
• Email address, where voluntarily provided.

Email is currently optional.

We do not currently collect a profile photograph from users.

3.3 E-KYC Information

Where property listing or property booking requires verification, Dorleto facilitates e-KYC through DigiO.

Dorleto does not directly collect or store the full government identification document or full government ID number through this e-KYC flow.

DigiO performs the applicable verification process and provides Dorleto with:

• A masked identification number/ID; and
• The relevant verification status.

Dorleto uses this information for identity/eligibility verification, fraud prevention, service delivery, record keeping, and other purposes described in this Privacy Policy.

3.4 Location Information

With the applicable device permission, Dorleto may access your device's location while you are using the application.

You may also manually enter a location for property search.

Location information may be used to:

• Show or search for relevant properties;
• Provide location-based functionality;
• Improve the accuracy of property search; and
• Maintain appropriate service and audit records.

Dorleto does not currently conduct background location tracking.

If you withdraw location permission, certain location-dependent features may become unavailable.

3.5 Property Information

When a landlord or agent lists a property, Dorleto may collect information such as:

• Property address/location;
• Property type;
• Rent;
• Security deposit information where applicable;
• Room/property details;
• Amenities;
• Availability;
• Property description;
• Property photos; and
• Other information necessary to create and manage the property listing.

Dorleto does not currently collect property ownership documents through the application.

3.6 Property Photos

Landlords and agents may upload photographs of properties.

Property photographs are stored using Dorleto's AWS infrastructure.

Tenants are not currently required to upload profile photographs, selfies, live-verification photographs, or videos.

3.7 Information Shared During Property Booking

When a tenant chooses to book a property, relevant tenant information may become available to the relevant landlord for the purpose of evaluating and managing the booking.

This may include:

• Name;
• Age;
• Sex/gender;
• Mobile number;
• KYC verification status;
• Masked identification number/ID; and
• Relevant rent-payment screenshot.

The landlord may approve or reject a booking request.

Dorleto does not make automated eligibility or approval decisions on behalf of landlords.

3.8 Rent Payment Information

Dorleto currently facilitates rent payments differently from subscription payments.

For rent:

• The landlord provides their UPI ID through the Dorleto application.
• The landlord can update their UPI ID.
• The tenant may be shown the landlord's UPI ID for making rent payment directly to the landlord.
• Dorleto does not receive the rent amount into its own account through this flow.
• After making payment, the tenant may upload a payment screenshot.
• The payment screenshot is stored on Dorleto's AWS infrastructure.
• The screenshot may be accessed by the relevant landlord and authorized Dorleto administrators for payment verification.
• Payment verification may involve confirmation from the landlord.

Dorleto does not currently require the tenant to separately provide a UTR/transaction reference number.

For subscription payments, Dorleto uses Razorpay. Payment credentials and sensitive payment information are handled through the applicable payment-processing infrastructure rather than being directly collected by Dorleto.

3.9 Agent Information

Agents may provide:

• Name;
• Mobile number;
• Profile information required for the Services;
• Landlord information necessary to list an authorized property;
• Property information; and
• UPI ID for receiving applicable agent commissions.

Dorleto currently does not collect agent bank-account details, PAN, or GSTIN specifically for commission payments.

An agent may list a landlord's property only after obtaining the landlord's permission/authorization.

The landlord may subsequently view, edit, or delete the relevant property listing.

3.10 Stay Information

For properties occupied by tenants, Dorleto may maintain:

• Move-in date; and
• Move-out date.

These dates may be visible to the relevant landlord and agent for property-management and tenancy-related purposes.

Historical stay information may be retained for legitimate operational, audit, dispute-resolution, and record-keeping purposes.

3.11 Technical and Device Information

When you use the Dorleto application, we may automatically collect certain technical information, including:

• IP address;
• Device type/model;
• Operating system and version;
• Application version; and
• Crash and error logs.

This information is used for security, troubleshooting, service operation, error resolution, and technical maintenance.

Dorleto does not currently use advertising IDs or third-party analytics SDKs.

4. How We Use Personal Data

Dorleto may process personal data for the following purposes:

1. Creating and authenticating user accounts;
2. Maintaining user profiles;
3. Providing property search and listing functionality;
4. Facilitating property bookings;
5. Performing e-KYC and identity/eligibility verification;
6. Showing relevant tenant information to landlords where required for booking/property-management purposes;
7. Facilitating and verifying rent-payment information;
8. Processing agent commissions;
9. Processing Dorleto subscription payments;
10. Providing customer support;
11. Preventing fraud, misuse, unauthorized access, and security incidents;
12. Troubleshooting technical problems and resolving application errors;
13. Complying with applicable legal and regulatory requirements;
14. Maintaining appropriate internal audit and business records; and
15. Providing Dorleto's own service-related communications and, where separately permitted/consented to, promotional communications.

Dorleto does not currently use personal data to create third-party advertising profiles.

5. Consent

Where consent is the applicable legal basis for processing, Dorleto seeks consent through a clear affirmative action.

Depending on the feature, consent may be obtained for:

• Account creation and personal-data processing;
• Profile completion;
• Location access;
• e-KYC;
• Property listing;
• Property booking;
• Processing of rent-payment screenshots; and
• Other specific purposes where consent is required.

Consent requests will be presented separately and in a manner intended to make the relevant purpose understandable.

Consent for one optional purpose will not automatically be treated as consent for unrelated purposes.

6. Withdrawal of Consent

Where processing is based on consent, you may withdraw applicable consent through the available settings or consent-management mechanism.

Dorleto intends to provide a withdrawal process that is reasonably comparable in ease to the process through which consent was provided.

Where withdrawal of a particular consent makes a feature dependent on that consent unavailable, you may no longer be able to use that particular feature unless and until the required consent is provided again.

For example, withdrawal of consent required for a property-listing function may prevent you from adding or managing a property through that function.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal and does not prevent Dorleto from retaining or processing information where retention or processing is otherwise required or permitted by applicable law.

The DPDP Act provides Data Principals with a right to withdraw consent and requires the ease of withdrawal to be comparable to the ease of giving consent. (MeitY)

7. Sharing of Personal Data

Dorleto may share personal data where necessary to provide the Services, perform a requested transaction, operate the platform, maintain security, or comply with law.

7.1 Sharing Between Users

Certain information is shared with other users only where required for the relevant Dorleto service.

Landlord may receive relevant tenant information associated with a booking/property-management relationship, including:

• Tenant name;
• Age;
• Sex/gender;
• Mobile number;
• KYC verification status;
• Masked ID; and
• Relevant rent-payment screenshot.

Tenant generally sees:

• Relevant property listing information; and
• The landlord's UPI ID when required to make direct rent payment.

The tenant does not ordinarily receive the landlord's personal profile or KYC information through the property listing.

Agent may receive:

• Relevant property information for properties associated with the agent; and
• Relevant tenant stay information, including applicable move-in and move-out dates.

Landlord may see the name of the agent who has listed the landlord's property.

Dorleto aims to limit user-to-user disclosure to information reasonably necessary for the relevant service.

8. Third-Party Service Providers

Dorleto uses selected third-party service providers to operate its Services.

These currently include:

• DigiO – e-KYC/identity verification and provision of masked ID and verification status.
• AWS – Cloud infrastructure, storage, application/data hosting and related technical services.
• Razorpay – Processing Dorleto subscription payments.
• MSG91 – WhatsApp OTP/authentication services.
• Google Maps / Google location services – Location and property-search functionality.

These providers may process information necessary to provide their services to Dorleto, subject to their applicable terms, privacy practices, contractual arrangements, and applicable law.

Dorleto does not sell personal data to these providers.

9. Government and Legal Disclosures

Dorleto may disclose personal data where reasonably necessary to:

• Comply with applicable law;
• Respond to a lawful order, direction, notice, summons, or request from a competent authority;
• Prevent, detect, investigate, or address fraud, cyber incidents, unlawful activity, or security threats;
• Protect the rights, safety, property, or security of Dorleto, its users, or other persons; or
• Meet other legally applicable obligations.

Dorleto does not provide personal data to government authorities merely for general purposes; disclosures are intended to be made where legally required or otherwise permitted by applicable law.

10. Data Security

Dorleto implements technical and organisational safeguards intended to protect personal data against unauthorized access, alteration, disclosure, loss, misuse, or destruction.

Current security measures include, as applicable:

• Encryption of stored data;
• HTTPS/SSL for data transmission;
• Restricted access to sensitive information;
• AWS access controls and IAM;
• Restricted production database access;
• No direct production database access for developers;
• Regular backups;
• Security monitoring and checks; and
• Access controls designed to prevent unauthorized personnel, including administrators without appropriate authorization, from viewing sensitive information.

No method of transmission, storage, or electronic security can be guaranteed to be completely secure. Dorleto therefore cannot guarantee that unauthorized access, cyber incidents, or security breaches will never occur.

11. Data Retention

Dorleto retains personal data only for as long as reasonably necessary for the purposes for which it was collected, legitimate operational purposes, security, audit, dispute resolution, or compliance with applicable law.

Current retention practices include:

• Account Information: Following an account deletion request, the applicable account/data deletion process provides a three-month period during which the user may log in and continue/reactivate the account. After the applicable three-month period, account deletion becomes final, subject to information that Dorleto is required or otherwise permitted to retain.
• Property Listings and Property Photos: Property listing information and associated property photographs may be retained for up to three months after deletion of the relevant listing, subject to applicable legal, audit, security, or dispute-related requirements.
• Rent-Payment Screenshots: Rent-payment screenshots are intended to be retained until the next applicable rent-payment date, subject to legitimate operational, dispute, audit, security, or legal requirements.
• KYC Information: Masked ID and KYC verification status may remain in Dorleto's internal systems after the user's active property relationship ends for legitimate audit, security, fraud-prevention, dispute-resolution, or legal purposes. Such retained KYC records are subject to restricted access and are not ordinarily displayed to landlords after the relevant user relationship has ended.
• Location Information: Location-related information may be retained where reasonably necessary for service operation, auditing, security, dispute resolution, or other legitimate purposes.
• Payment and Subscription Records:Subscription/payment records may be retained for accounting, transaction verification, audit, dispute resolution, fraud prevention, and legal or regulatory requirements.
• Technical Logs: IP addresses, device information, application information, crash logs, and error logs may be retained for as long as reasonably necessary for security, troubleshooting, technical operations, fraud prevention, auditing, or other legitimate purposes.
• Backups: Where account/data deletion is applicable, deleted user data is intended to be removed from relevant backups within the applicable three-month deletion period, subject to technical and legal requirements.

Where applicable law requires a particular record to be retained for a longer period, that information may be retained for the legally required period and appropriately restricted.

12. Account Deletion

Users may initiate account deletion through the Delete Account functionality available within the Dorleto application.

After a deletion request:

• The applicable three-month deletion period begins;
• A user may log in during this period, in which case the account may continue/reactivate;
• After the applicable three-month period, deletion becomes final, subject to information that Dorleto is required or permitted to retain under applicable law or for legitimate purposes such as audit, security, fraud prevention, dispute resolution, or payment/accounting requirements.

Deletion of an account does not necessarily require immediate deletion of every record where continued retention is necessary for a specified lawful purpose or legal obligation.

The DPDP Act provides a right to erasure, subject to situations where retention is necessary for a specified purpose or compliance with law. (MeitY)

13. Your Rights

Subject to applicable law and its conditions, you may have rights relating to your personal data, including:

• Requesting information about the processing of your personal data;
• Requesting access to your personal data;
• Requesting correction, completion, or updating of inaccurate or incomplete personal data;
• Requesting erasure of personal data where applicable;
• Withdrawing consent where processing is based on consent;
• Raising a grievance concerning Dorleto's processing of your personal data; and
• Exercising other rights available under applicable data-protection law.

The DPDP Act expressly provides rights relating to access/information, correction and erasure, and grievance redressal. (MeitY)

14. How to Exercise Your Rights

For privacy-related requests, including:

• Access to personal data;
• Correction or updating;
• Data-copy requests;
• Erasure requests;
• Consent withdrawal;
• Questions regarding processing or sharing; and
• Privacy complaints,

you may contact: support@dorleto.com

Dorleto may take reasonable steps to verify your identity before processing a request involving your personal data, particularly where disclosure or modification could affect another person's privacy or account security.

Dorleto will process applicable requests in accordance with the requirements and timelines prescribed by applicable law.

15. Grievance Redressal

You may raise a privacy or personal-data grievance by contacting:

Privacy & Grievance Contact

Dorleto Technologies Pvt. Ltd.

Agra, Uttar Pradesh, India

Email: support@dorleto.com

You may also use the available in-app support functionality.

Dorleto will review and respond to grievances in accordance with applicable legal requirements.

The DPDP Act provides Data Principals with a right to readily available grievance-redressal mechanisms. (MeitY)

16. Data Accuracy

You are responsible for providing information that is accurate, complete, and authentic.

You should update your information when it changes and should not provide false, misleading, fraudulent, or impersonated information.

Dorleto may take reasonable measures to verify information where necessary for account security, KYC, property booking, property listing, payment verification, fraud prevention, or compliance purposes.

17. No Sale of Personal Data

Dorleto does not sell personal data.

Dorleto does not currently:

• Sell personal data to advertisers;
• Rent personal data to third parties;
• Create third-party advertising profiles using user data; or
• Permit third parties to use Dorleto user data for their independent marketing purposes.

18. Marketing Communications

Dorleto currently does not send promotional or marketing communications through WhatsApp.

If Dorleto introduces promotional communications in the future, applicable consent, notification, opt-out, and other legal requirements will be addressed before such communications are introduced where required by law.

Service-related communications, authentication messages, security notifications, and other communications necessary to provide the Services may continue where permitted by applicable law.

19. Cookies and Analytics

The Dorleto website currently does not use cookies for analytics or advertising purposes.

The website currently does not provide public account registration/login functionality.

Dorleto also does not currently use third-party analytics SDKs or advertising IDs in the application.

This section may be updated if Dorleto introduces analytics, cookies, advertising technologies, or similar tracking technologies.

20. Children's Privacy

Dorleto's Services are intended for users aged 18 years and above.

Dorleto does not knowingly provide property listing or property-booking functionality to individuals below 18 years of age.

If Dorleto becomes aware that personal data of a person below the permitted age has been collected or processed contrary to applicable law, Dorleto may take appropriate steps, including restricting access and deleting the relevant information where legally required.

21. Automated Decision-Making

Dorleto does not currently use automated decision-making or automated profiling to independently approve or reject users for property bookings or property listings.

Property booking decisions are made through the applicable landlord/user workflow rather than solely through an automated algorithm.

22. Changes to This Privacy Policy

Dorleto may update this Privacy Policy from time to time to reflect:

• Changes to the Services;
• Changes to our data-processing practices;
• New features or technologies;
• Changes in applicable laws or regulations; or
• Changes in our security or operational practices.

When we make material changes, we may provide an appropriate notice through the application, website, email, or other reasonable means, where required.

The updated Privacy Policy will display a revised "Last Updated" date.

23. Future Features

Dorleto may introduce additional services or features in the future, including features involving agreements, electronic signatures, electronic stamping, additional verification, payments, or other property-management services.

If a future feature involves new categories of personal data or materially different processing, Dorleto will update its privacy notices and consent mechanisms as required before or when the relevant processing begins.

25. Acknowledgement

By using Dorleto, you acknowledge that you have had an opportunity to read and understand this Privacy Policy.

Where consent is required for a particular processing activity, Dorleto will obtain the applicable consent through an appropriate consent mechanism.

This Privacy Policy should be read together with Dorleto's Terms of Use and any feature-specific notices or consent requests presented within the application.