Privacy Policy

DeploySpace operates a managed marketplace for commercial real estate in Bangalore, India. We connect verified commercial property owners with serious brands and channel partners, and we serve as the single coordinated point of contact across every conversation on the platform.

Privacy is fundamental to that role. This policy explains what information we collect, why we collect it, how we use it, who we share it with, and the rights you have over your data. It applies across our website, dashboards, listings, brief submissions, and any other services we operate under the DeploySpace brand.

By using DeploySpace, you consent to the practices described here. If you do not agree, please do not use our services.

a. Information you provide directly

• Account information: name, email address, phone number, password (stored hashed; never in plain text), and the role you select (property owner, brand, or channel partner).
• Profile information based on role:
  • Property owners — property address, ownership status, authorisation to lease, KYC details where applicable.
  • Brands — company name, industry, team size, expansion plans, target micro-markets, area, and budget ranges.
  • Channel partners — company name, RERA registration number, GST number, years of experience, inventory size, and specialisation.
• Property listings: descriptions, specifications (area, frontage, floor, power load, parking, etc.), photographs, location data, lease terms, and supporting documents you upload for verification.
• Communications and inquiries: messages, briefs, site-visit requests, and any correspondence with our team or other users routed through the platform.
• Payment information: we do not currently process payments. If we introduce paid services in the future, payment data will be processed by PCI-compliant third-party providers and governed by their own privacy practices.

b. Information collected automatically

• Device and connection: IP address, browser type and version, operating system, device type, and screen resolution.
• Usage data: pages visited, time spent, search queries, filters applied, listings viewed, click and scroll interactions.
• Cookies and similar technologies: see our Cookie Policy for the full breakdown.
• Approximate location: derived from your IP address (city/region level only). We do not collect precise GPS location from your device.

c. Information from third parties

• Google account information: when you choose "Continue with Google", we receive your basic profile information (name, profile picture) and email address. We only request the minimum scopes needed to authenticate you. We do not access your Google contacts, Drive, Calendar, Gmail, or any other Google service.

We use your information to:

• Provide, maintain, and improve our services — including running the marketplace, displaying listings, processing inquiries, and coordinating site visits.
• Independently verify property listings and channel partner credentials before they go live.
• Connect property owners with qualified, pre-screened brands and partners.
• Send service-related notifications (verification status, inquiries, account alerts, security notices).
• Send marketing communications about new features, properties, or opportunities — only when you have opted in. You can withdraw consent at any time.
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service.
• Comply with applicable laws, regulations, court orders, and lawful requests from public authorities.
• Conduct analytics and aggregated research to improve the product.

This section describes how DeploySpace handles user data obtained through Google's OAuth APIs. It is intended to satisfy Google's requirements for OAuth verification and is binding on us.

• We use Google Sign-In to let you authenticate to DeploySpace using your existing Google account.
• Google data we access: your basic profile (name, profile picture) and email address — and nothing else.
• Google data we do NOT access: your Google Contacts, Drive, Calendar, Gmail, Photos, Search history, or any other Google product or scope. We do not request — and Google does not grant us — access to any of these.
• How we use Google user data: solely to create and authenticate your DeploySpace account, and to display your name and profile picture inside DeploySpace where account attribution is useful (for example, your nav-bar avatar).
• We do not sell, rent, or transfer Google user data to third parties for advertising, marketing, profiling, or any other commercial purpose.
• We do not use Google user data for advertising or for any purpose other than account authentication and the basic display described above.
• Sharing with service providers: Google user data may be stored by our infrastructure providers (Supabase for authentication, Vercel for hosting) strictly in support of running DeploySpace. These providers act as data processors and are contractually bound to protect the data.
• You can revoke our access to your Google account at any time via Google Account Permissions. Doing so will not delete your DeploySpace account; you can continue signing in with email and password.

We are a managed marketplace, not a classifieds site. Our default posture is to share as little as necessary, only with people who need it, only when you've taken an action that warrants it.

With other users (limited)

When property owners list a property, basic listing information (description, specifications, photographs, locality) becomes visible to authenticated brands and channel partners on the marketplace. Owner contact details, exact address, and personal information are never shared without DeploySpace's facilitation, and only after a brand has been qualified by our team.

Inquiries from brands are routed through DeploySpace and presented to owners with brand identity anonymised at first ("a leading retail brand expressed interest"). Identity is shared once both sides have confirmed mutual interest.

With service providers (data processors)

We rely on the following providers, each contractually bound to use your data only as we instruct:

• Vercel — application hosting and delivery.
• Supabase — database, authentication, storage.
• Resend (or similar) — transactional email (verification links, password resets, inquiry notifications).
• Google Analytics — aggregated usage analytics (only when you consent to non-essential cookies).

For legal and safety reasons

We may disclose information when we believe it is reasonably necessary to comply with a law, regulation, court order, or enforceable government request; to enforce our Terms of Service; to investigate fraud or abuse; or to protect the safety and rights of DeploySpace, our users, or the public.

Business transfers

If DeploySpace is involved in a merger, acquisition, financing due diligence, or sale of assets, your information may be transferred as part of that transaction. We will notify you of such a transfer.

With your consent

Any sharing not described above will only occur with your explicit consent.

• Encryption in transit: all traffic to and from DeploySpace uses HTTPS / TLS.
• Encryption at rest: databases and uploaded documents are encrypted at rest by our infrastructure providers.
• Secure authentication: passwords are hashed using industry-standard algorithms; OAuth tokens are stored securely.
• Row-level access controls: our database enforces role-based access at the row level, so users can only see data they are entitled to see.
• Principle of least privilege: only the minimum number of DeploySpace personnel can access user data, and only for specific operational reasons.
• Logging and monitoring: we log access to sensitive systems and review logs regularly.
• Incident response: in the unlikely event of a data breach, we will notify affected users and the appropriate authorities as required by law.

No system is one hundred percent secure. While we apply industry best practices, we cannot guarantee absolute security. You are responsible for keeping your password and account credentials safe.

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), you have the following rights with respect to your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to correction: ask us to correct inaccurate, incomplete, or outdated information.
• Right to erasure: request deletion of your account and associated personal data, subject to retention obligations described below.
• Right to data portability: receive a copy of certain data in a structured, machine-readable format.
• Right to withdraw consent: withdraw any consent you previously gave, including for marketing or non-essential cookies, at any time.
• Right to nominate: nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to grievance redressal: raise a grievance and have it resolved within the time frame prescribed by law.

To exercise any of these rights, email contact@deployspace.in. We will respond within 30 days.

DeploySpace uses cookies and similar technologies to keep you signed in, remember preferences, and (with your consent) understand how the product is used so we can improve it.

• Essential cookies: authentication, session, security. Cannot be disabled if you wish to use the service.
• Functional cookies: remember interface preferences. Improve user experience.
• Analytics cookies: set only with your consent.
• Marketing cookies: set only with your consent.

See our Cookie Policy for the full list and for instructions on managing cookie preferences.

DeploySpace is intended for users who are eighteen (18) years of age or older and who have legal capacity to enter into contracts. We do not knowingly collect personal data from anyone under 18.

If you believe a minor has registered for DeploySpace or shared personal information with us, please email contact@deployspace.in and we will delete the data and the associated account.

DeploySpace primarily stores and processes data in India (Mumbai region) using infrastructure providers operating Indian data centres where supported. Some service providers may store certain data internationally (for example, Google OAuth logs or Vercel edge caches in other regions).

When data is transferred outside India, we rely on contractual safeguards required by the DPDP Act and the receiving jurisdiction's legal protections. We will only transfer data to countries the Government of India has not restricted under the DPDP Act.

We keep personal information only for as long as we need it for the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Account data: retained while your account is active and for one (1) year after deletion, after which it is anonymised or destroyed.
• Property listings: retained while listed and for two (2) years after delisting, for legal and audit compliance.
• Inquiry and brief data: retained for three (3) years for business and dispute-resolution records.
• Marketing data: retained until you withdraw consent.
• Backups: data may persist in encrypted backups for up to ninety (90) days after deletion before being purged.

We may update this Privacy Policy as our services, partners, and legal obligations evolve. The "Last updated" date at the top of this page reflects the most recent material change.

For material changes, we will notify registered users by email and via an in-product notice at least seven (7) days before the change takes effect. Continued use of DeploySpace after a change indicates your acceptance of the updated policy.

For any privacy-related queries, requests, or feedback, email contact@deployspace.in. We will acknowledge your message within seven (7) working days and provide a substantive response within thirty (30) days.

In line with the Digital Personal Data Protection Act, 2023, you have the right to raise grievances regarding the processing of your personal data.

• Grievance officer: details will be updated shortly. In the interim, please direct grievances to the address below.
• Email: contact@deployspace.in
• Response time: we acknowledge grievances within seven (7) working days and aim to resolve them within thirty (30) days.
• Escalation: if you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India in accordance with the DPDP Act.