Terms of Service & Privacy Policy

1. Identity of the Data Fiduciary & Scope

This document constitutes the unified Terms of Service and Privacy Policy for exTenancy (“we”, “us”, or “our”), accessible via extenancy.com. exTenancy functions as a Data Fiduciary in terms of Section 2(i) of the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023), established in Bangalore (Bengaluru), Karnataka, India.

By accessing our platform, creating an account, or submitting a tenancy review, you (the “Data Principal”) agree to these terms and provide voluntary, informed consent for the processing of your data strictly as described herein.

2. Notice & Itemized Purpose of Data Processing (Sections 5 & 6, DPDP Act)

In accordance with Section 5 of the DPDP Act, 2023, exTenancy gives notice that the collection and processing of personal data is limited strictly to specified, lawful purposes:

• Tenancy Review Data: Information regarding society name, unit identifiers, tenancy period, monthly rent, deposit paid, deposit deduction amount, water availability, owner responsiveness, and comments. Purpose: To publish collective, anonymous rental intelligence for future prospective tenants.
• Mobile Number (Phone): Stored as a cryptographic, salted SHA-256 hash (phone_hash) for identity deduplication, and encrypted using AES-256-GCM (phone_enc). Purpose: To send transactional review status alerts and verify authentic Bengaluru tenancy via one-time passwords (OTP). Plaintext phone numbers are never stored in unencrypted logs or exposed publicly.
• Email Address: Purpose: User account authentication, recovery, and essential transactional notices.
• Stamped Rent Agreement (Verification Document): Purpose: To independently verify bona fide past tenancy and award the “Verified tenant” badge.

3. Digital Rent Agreement Vault & Cryptographic Protection

Stamped rent agreements provided by users are treated as sensitive verification material and protected by rigorous organizational safeguards:

• Private Object Storage: Rent agreements are never placed in public buckets. They reside in a private Supabase Storage vault governed by Row Level Security (RLS) policies.
• Expiring Signed URLs: Authorised human moderators view documents solely via short-lived, pre-signed URLs that automatically expire after 10 minutes.
• Immutable Audit Logging: Every document inspection, approval, or rejection generates an append-only, tamper-evident audit record documenting admin ID, timestamp, and review ID.
• Never Shared with Landlords: Your rent agreement is strictly used for internal verification and is never shared with, sold to, or disclosed to property owners, brokers, or third-party marketers.

4. Data Principal Rights (Sections 11–14, DPDP Act)

Under Chapter III of the DPDP Act, 2023, you hold statutory rights over your personal data:

• Right to Access Information (Section 11): You may request a summary of the personal data currently processed by exTenancy and the identity of any technical data processors.
• Right to Correction & Erasure (Section 12): You may request correction of inaccurate data or deletion of your account and reviews through your account dashboard or by contacting exTenancy support.
• Right of Grievance Redressal (Section 13): You have the right to register grievances or questions regarding your personal data processing through exTenancy support.
• Right to Nominate (Section 14): You have the right to nominate an individual who shall exercise your rights in the event of death or incapacity.

5. Tenant Anonymity & Anti-Retaliation Protection

Bangalore tenants frequently face deposit deductions or disputes with powerful landlords. To prevent retaliation, blacklisting, or harassment:

• All public reviews appear exclusively under randomized or chosen pseudonymous handles (e.g. @u8k2m9x4).
• Reviewers have the option to hide exact move-in and move-out months, displaying only the tenancy year.
• Automated PII guardrails inspect review comments prior to publication and automatically redact phone numbers, bank details, Aadhaar references, and external URLs.

6. User Obligations & Review Integrity

By contributing a review on exTenancy, you warrant that:

• You were a bona fide tenant or leaseholder of the reviewed premises during the stated period.
• Your review represents a truthful, good-faith account of your tenancy and deposit return experience.
• You will not submit forged, fabricated, or third-party rent agreements.
• You will not publish hate speech, profanity, abusive harassment, or private personal data (such as a landlord's personal mobile number or private residence).

7. Withdrawal of Consent & Data Retention

In terms of Section 6(4) of the DPDP Act, you may withdraw your consent for personal data processing at any time through your account settings or by contacting exTenancy support. The withdrawal will not affect the legality of processing carried out prior to withdrawal. Unverified draft reviews and stale temporary uploads are purged periodically in accordance with our automated lifecycle cleanup jobs.