Privacy Policy

1. Information we collect

Registration: business name, address, business type, optional GSTIN, owner name, email and mobile number, selected plan and billing cycle.

Payment: Razorpay order and payment identifiers, amount, status and method type. Payment evidence you upload (a screenshot or PDF), the transaction ID and the UTR number. We do not receive card numbers, UPI PINs or bank credentials.

Accounts: user names, emails, roles, sign-in times, and IP address and browser information for security.

Demo requests: the details you enter in the contact form, and whether you opted in to product updates.

2. Customer business data and employee data

Customers record their own leads, property, deal and employee information in the service. The Customer decides what to record and is responsible for having a lawful basis to do so. We process this data on the Customer's behalf to provide the service.

3. How we use information

To register and verify businesses, process payments, create and secure workspaces, send transactional emails (for example activation, password reset and payment updates), provide support, and prevent misuse. Product update emails are sent only if you opt in.

4. Data separation

Each Customer's business data is stored separately from every other Customer's and cannot be reached from another Customer's workspace. Registration, billing, account and audit information needed to run the service is kept separately again.

5. Administrative access

Our operations staff who handle registrations see registration, payment and account status only; they cannot browse Customer business data such as leads, staff, projects or deals. Payment evidence is visible only to people authorised to review payments, and each viewing is logged.

H&G NextGen administrators can view and export a Customer's workspace data and manage its account (for example suspend or restore access, extend a subscription or change a plan). They do so only to run, support and secure the service, resolve billing or account problems, and meet legal obligations. Every view, download and change is recorded in an audit log that cannot be edited or deleted.

6. Service providers

Razorpay (payments), and our email delivery, photo storage and hosting providers [names and regions to be listed before launch]. They process data only as needed to provide their services to us.

7. Security

Passwords are stored in a form that cannot be turned back into the password, so nobody, including us, can read them. Activation and reset links work once and expire. The keys that open each workspace are stored encrypted. Sensitive actions are recorded in audit logs that the application cannot edit or delete. No system is perfectly secure; we will notify affected Customers of security incidents as required by law.

8. Retention and deletion

Customer workspace data is kept for 30 days after a subscription ends without renewal, then the workspace database is deleted. Renewing within those 30 days restores everything. [Retention periods for registration records, payment evidence and audit logs to be finalised.] Backups are retained for a limited period and then overwritten.

9. Your rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may request access to, correction of, or erasure of your personal data, and withdraw consent for optional processing such as marketing emails. Employees of a Customer should first contact that Customer.

10. Grievance officer

[Name, designation and contact details of the grievance officer to be added.] We will acknowledge and respond to grievances within the time required by law.