Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account information: When you create an account or sign in using OTP, we collect your mobile phone number and, optionally, your email address.
• Contact form: When you submit a contact inquiry, we collect your name, email address, phone number, and message content.
• Floor plan requirements: When you use the plan generator or request an architect plan, we collect details about your plot dimensions, plot facing, number of bedrooms and bathrooms, kitchen preferences, parking requirements, Vastu preferences, and any special requirements you describe.
• Reference images: If you upload reference images or layout sketches as part of an architect plan request, we store those files to fulfil your service request.
• Communication: Any emails or messages you send to our support team.

1.2 Payment Information

All payment transactions are processed securely by Razorpay (India). NakshaAI does not collect, store, or process your credit card, debit card, UPI, or net banking credentials. Razorpay processes your payment and shares only order confirmation and payment status information with us. Please review Razorpay's Privacy Policy for details on how your payment data is handled.

1.3 Automatically Collected Information

• Usage data: Pages visited, features used, clicks, time on page, and session duration.
• Device and browser information: Browser type and version, operating system, screen resolution, and device type (mobile, tablet, desktop).
• IP address: Used for rate-limiting, fraud prevention, and approximate location detection (state/region level only).
• Cookies and session tokens: Authentication session tokens issued by our authentication provider (Supabase). See Section 4 for full cookie details.

1.4 AI-Generated Plans

AI-generated floor plan images created as a result of your requirements are stored on our secure cloud storage (Supabase Storage). You retain the right to download and use these plans subject to our Terms of Service. We may use aggregated, anonymised plan metadata (plot dimensions, facing, bedroom counts) to improve our AI models, but we will never use personally identifiable information in this process.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the NakshaAI platform and services
• Process your payments and manage your orders
• Generate AI floor plan concepts and facilitate architect plan preparation
• Authenticate your identity and manage your account session
• Respond to your support inquiries and contact form submissions
• Send order confirmation and plan delivery notifications
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Comply with legal obligations under Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023
• Analyse aggregate usage patterns to improve our services (using anonymised data only)
• Measure performance and send promotional communications, where you have opted in

We will never sell your personal data to third parties. We will never use your contact details for unsolicited commercial communications unrelated to NakshaAI services.

3. Third-Party Services

NakshaAI integrates with the following third-party services that may process your data as part of delivering our platform:

3.1 Supabase

We use Supabase as our backend-as-a-service provider for database storage, user authentication, and file storage. Your account records, plan data, and uploaded files are stored on Supabase's infrastructure. Supabase is SOC 2 Type II certified. Supabase Privacy Policy.

3.2 Razorpay

Payment processing is handled by Razorpay Software Pvt. Ltd., a PCI-DSS compliant payment gateway regulated by the Reserve Bank of India. NakshaAI receives only payment status (success/failure) and order identifiers — not your card or banking details. Razorpay Privacy Policy.

3.3 Google (Gemini AI)

AI floor plan generation uses Google's Gemini AI API. Your floor plan requirements (plot size, bedroom count, facing, preferences) are transmitted to Google's API to generate plan images. No personally identifiable information such as your name, phone number, or payment details is transmitted to this API. Google Privacy Policy.

3.4 2Factor.in

OTP (one-time password) SMS messages for account authentication are delivered via 2Factor.in, an Indian SMS gateway provider. Your mobile number is shared with 2Factor.in solely for OTP delivery. NakshaAI retains no phone-number data on 2Factor.in's systems beyond the transmission of the OTP.

3.5 Google Analytics and Google Ads (Future)

We intend to implement Google Analytics 4 and Google Ads conversion tracking to understand how users interact with our platform and measure the effectiveness of marketing campaigns. When implemented, this will be disclosed via an updated cookie banner. Data shared with Google Analytics is anonymised and does not include your name, phone number, or payment information.

3.6 Meta (Facebook/Instagram) Pixel (Future)

We intend to implement the Meta Pixel for advertising measurement purposes. When implemented, the pixel will track page visits and conversion events (such as completed purchases) to help us optimise our advertising. Personal data shared will be limited to hashed identifiers as required for Meta's Conversions API. This will be disclosed via an updated cookie banner before implementation.

4. Cookies and Tracking

We use cookies and similar tracking technologies to maintain your session and understand how our platform is used. For full details, please read our Cookie Policy.

Essential Cookies

Supabase sets an authentication session cookie (typically named sb-[project]-auth-token) when you sign in. This cookie is required for your account session to function. Without it, you cannot access your account or purchased plans.

Analytics Cookies (Planned)

When implemented, Google Analytics 4 cookies will collect anonymised usage data. You will be able to opt out via our cookie preference centre before these cookies are set.

5. Data Storage and Security

All data is stored on Supabase infrastructure, which uses encrypted storage and secure transmission (TLS/HTTPS) for all data in transit. Payment processing occurs entirely within Razorpay's PCI-DSS compliant environment.

We implement technical and organisational security measures including: HMAC-based payment verification, rate limiting on all public-facing APIs, input sanitisation, and access controls on stored plan data. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

If you believe your account has been compromised, please contact us immediately at support@nakshaai.com.

6. Data Retention

• Account data: Retained for as long as your account is active. Upon account deletion request, your personal data is deleted within 30 days, subject to legal retention requirements.
• Order and payment records: Retained for 7 years from the date of transaction, as required by Indian financial and tax regulations.
• AI-generated floor plans: Retained in your account indefinitely until you delete them or request account deletion.
• Contact form submissions: Retained for up to 2 years to enable follow-up and service improvement.
• Uploaded reference images: Retained until your order is fulfilled and for 90 days thereafter, then deleted unless you request earlier deletion.

7. Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian law, you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to correction: Request that inaccurate or incomplete personal data be corrected.
• Right to erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to withdraw consent: Where processing is based on your consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to nominate: Under the DPDP Act, nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, please contact us at support@nakshaai.com with the subject line "Data Rights Request". We will respond within 30 days.

8. Children's Privacy

NakshaAI's services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal information, please contact us immediately and we will take steps to delete it.

9. International Users

NakshaAI is operated from India and is primarily designed for users in India. If you access our services from outside India, you acknowledge that your information will be transferred to and processed in India, where data protection laws may differ from those in your jurisdiction. By using our services, you consent to such transfer and processing.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our services after any update constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: