Our Policies & Terms

1Introduction & Scope

Smattio Technologies Private Limited ("Smattio," "we," "us," or "our") is committed to protecting the privacy, confidentiality, and security of personal information entrusted to us. This Privacy Policy explains transparently how we collect, use, process, disclose, retain, and protect personal data across the Smattio real estate CRM platform, including our website (smattio.com), web application, mobile applications (Android and iOS), customer portals, and associated application programming interfaces (collectively, the "Service").

This policy applies to all visitors to our website, registered customer accounts, tenant administrators, sales managers, field agents, and individuals who communicate with us. It also defines our responsibilities regarding the prospective property buyer data ("Leads") processed through our platform on behalf of our business clients.

Depending on how you interact with Smattio, we operate in two distinct capacities under applicable data protection legislation:

• Smattio as Data Fiduciary (Data Controller): We act as a Data Fiduciary when we decide the purposes and means of processing personal data relating to website visitors, direct prospective clients submitting demo requests, registered account administrators, sales users, and billing contacts.
• Smattio as Data Processor: We act as a Data Processor on behalf of our enterprise clients ("Tenants" — real estate developers, agencies, and brokers) who utilize our CRM. The Tenant acts as the Data Fiduciary (Data Controller) for all prospective buyer leads, contact histories, pipeline stages, and notes stored in their isolated CRM workspace. Smattio processes such data strictly pursuant to the Tenant's configuration, instructions, and our service agreement.

2Information We Collect

We collect information only to the extent necessary to deliver high-performance CRM software, maintain platform security, facilitate customer communication, and meet legal obligations. We categorize collected information as follows:

• Account & Registration Information: Full name, corporate email address, mobile phone number, company or brokerage name, registered business address, designated team size, administrative role, and account credentials. Passwords are cryptographically hashed using industry-standard bcrypt algorithms with unique salts before storage; we never store or have access to plain-text passwords.
• Demo & Contact Requests: Details provided when requesting a product demonstration, consultation, or contacting sales through our website forms, including your full name, work email address, phone number (with optional WhatsApp communication consent), company name, current team size (e.g., 1–5, 6–15, 16–50, or 50+ members), and message contents.
• Billing & Tax Information: Organization name, registered billing address, billing contact email and phone, and Goods and Services Tax Identification Number (GSTIN) for tax invoice generation and statutory input tax credit claims.
• Customer Support & Inquiries: Communications sent to our support team via email, WhatsApp, or in-app support requests, including problem descriptions, diagnostic screenshots, and feedback.

When our Tenants utilize Smattio CRM to operate their real estate sales workflows, they or their authorized sales agents enter, upload, or sync lead data into their dedicated workspace:

• Prospective property buyer details, including full names, contact telephone numbers, email addresses, and location preferences.
• Property acquisition criteria: budget brackets, preferred unit configurations (e.g., 2BHK, 3BHK, commercial, villa), property status, and financing preferences.
• Inbound lead origin tags: leads imported via tenant-connected webhooks from third-party property discovery portals (e.g., 99acres, MagicBricks, Housing.com), social advertising campaigns (Meta Lead Ads / Facebook / Instagram), landing pages, QR codes, or direct offline walk-ins.
• Communication records, follow-up call logs, scheduled site visit dates, sales notes, lead status transitions, and agent performance tracking data.

• Device & Connection Data: Internet Protocol (IP) address, browser family and version, operating system, device manufacturer/model, device language, referring URL, and internet service provider.
• Platform Telemetry & Log Data: Date and time stamps of requests, feature access logs, navigation paths, page load durations, error logs, and system crash diagnostics.
• Security & Session Tokens: Cryptographically generated HTTP-only session tokens (such as smattio-crm-session) and Cross-Site Request Forgery security tokens (XSRF-TOKEN) required to secure user sessions and prevent unauthorized state-changing requests.

The Smattio mobile application includes an optional field attendance and site visit verification feature for real estate sales agents. GPS location data is collected strictly subject to the following safeguards:

• Location coordinates are captured only at the precise moment when a field sales agent explicitly clicks the "Check-In", "Check-Out", or "Log Site Visit" button within the mobile app.
• Smattio does not engage in continuous, background, or passive real-time tracking of any employee or user.
• Location coordinates are accessible solely to the authorized administrators of that specific Tenant's account for payroll and field visit validation purposes.
• Users retain the right to enable or disable device location services at any time through their iOS or Android operating system permissions. Disabling location services simply restricts the mobile check-in verification feature.

All online subscription payments on Smattio are processed directly through certified, PCI-DSS Level 1 compliant payment gateways (Razorpay Software Private Limited). Smattio does not collect, process, store, or transmit raw credit card numbers, debit card numbers, CVV security codes, or net banking authentication credentials on its servers. We receive and retain only non-sensitive transaction tokens, payment status, payment method category (e.g., UPI, NetBanking, Credit Card), the issuing bank/brand, and the last 4 digits of payment cards for accounting, reconciliation, and GST-compliant invoicing.

Smattio does not request, solicit, or knowingly store sensitive personal data, such as biometric records, genetic data, health or medical information, religious beliefs, political opinions, caste details, or national identity card numbers (such as Aadhaar or PAN) of prospective real estate buyers. Tenants are strictly prohibited under our Terms of Service from entering or uploading such sensitive categories into the Platform.

3How We Use Your Data

We process personal data only when an applicable legal ground under the DPDP Act 2023 or international data protection law permits us to do so. The table below outlines our primary processing purposes and their corresponding legal grounds:

Processing Purpose	Legal Ground	Data Categories Processed
Providing, maintaining & operating the CRM Service	Contractual necessity	Account credentials, tenant workspace data, lead data, contact details
User authentication, session security & multi-tenant data isolation	Contractual necessity & Legitimate interests	Hashed credentials, session tokens, IP addresses, audit logs
Billing, subscription management, GST invoicing & accounting	Contractual necessity & Legal obligation	Billing contact name, business address, GSTIN, payment tokens, invoice records
Customer support, onboarding assistance & incident resolution	Contractual necessity	Contact data, error reports, correspondence history, user role
Transactional notifications, system alerts & security advisories	Contractual necessity & Legal obligation	Email address, mobile number (SMS / WhatsApp), in-app notifications
WhatsApp messaging integration (Meta Cloud API)	Consent & Contractual necessity	Mobile phone numbers, message content configured by Tenant
Field attendance & site visit check-in verification	Contractual necessity & Consent (via device permissions)	Agent identifier, timestamp, point-in-time GPS coordinates
Platform performance monitoring, bug diagnosis & optimization	Legitimate interests	Aggregated telemetry, API response times, browser types, error stack traces
Fraud prevention, anti-abuse safeguards & rate limiting	Legitimate interests & Legal obligation	IP addresses, device metadata, login attempt logs, security logs
Statutory, taxation & regulatory compliance	Legal obligation	Billing history, GST records, official correspondence as required by Indian law
Direct marketing & product announcements (opt-in only)	Explicit consent	Full name, business email address (with immediate unsubscribe options)

4Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We disclose personal data only on a strictly need-to-know basis under binding confidentiality and data protection terms in the following specific circumstances:

We engage reputable third-party infrastructure and software service providers ("Sub-processors") to support platform operations. All sub-processors are bound by stringent data processing agreements that restrict processing solely to authorized instructions and mandate equivalent security standards:

• Cloud Infrastructure & Hosting: Enterprise cloud server and database providers (including Amazon Web Services and DigitalOcean) with primary data centers located in India (Mumbai Region) for secure computing, isolated storage, and automated database backups.
• Payment Gateway Partners: Razorpay Software Private Limited for secure online payment processing, subscription management, and statutory GST credit note and invoice issuance.
• Communication Gateways: Meta Platforms, Inc. / Meta Platforms Ireland Ltd. for WhatsApp Business Cloud API integration, enabling tenant-authorized automated messaging, follow-ups, and notifications.
• System Fonts & Assets: Google Fonts CDN (fonts.googleapis.com / fonts.gstatic.com) used strictly to deliver lightweight web typography to user browsers without tracking or cookie assignment.

Smattio CRM provides pre-built webhook connectors and integration pipelines for external real estate portals and advertising platforms, including 99acres, MagicBricks, Housing.com, and Meta Lead Ads (Facebook & Instagram). When a Tenant configures and activates these integrations, lead data collected on those third-party services is transmitted directly into the Tenant's CRM database. Smattio acts strictly as a technical intermediary and data processor; each external portal is governed independently by its own terms and privacy policy.

We may disclose personal data to law enforcement bodies, courts, or governmental authorities if we reasonably believe such disclosure is necessary to: (a) comply with a valid subpoena, warrant, judicial summons, or applicable statutory obligation under Indian law; (b) enforce our Terms of Service; (c) detect, investigate, and prevent fraudulent, criminal, or abusive behavior; or (d) protect the life, safety, or legal rights of Smattio, our users, or the general public.

In the event that Smattio Technologies Private Limited participates in a merger, corporate acquisition, financing due diligence, reorganization, bankruptcy, or sale of substantial business assets, customer and user information may be transferred as a business asset. In such circumstances, the acquiring entity will remain bound by the commitments articulated in this Privacy Policy, and affected users will receive prior written notice.

Smattio's primary server infrastructure and operational databases are stationed within the Republic of India. When technical service delivery necessitates the transmission of personal data across national borders (for instance, when utilizing global communication routing through Meta's WhatsApp Cloud API infrastructure or content delivery edge networks), we ensure that such transfers comply with Chapter III of the Digital Personal Data Protection Act, 2023, and that appropriate legal mechanisms, including Standard Contractual Clauses (SCCs) and end-to-end transport encryption, are enforced.

Our website and blog articles may contain hyperlinks to third-party web properties, industry references, or partner portals. Smattio exercises no control over, and accepts no responsibility for, the privacy practices, content, or cookie deployments of external websites. We strongly encourage users to review the privacy notices of any third-party websites they navigate to.

5Data Storage & Retention

All primary CRM databases, customer accounts, and file attachments are stored securely on hardened cloud infrastructure located in India (Mumbai Region). We adhere to the principle of data minimization and do not retain personal information longer than required for the purposes for which it was gathered.

Data Category	Retention Duration	Disposition Method
Active Subscription Workspace Data (Leads, Notes, Users)	Duration of active, paid subscription	Maintained securely in isolated tenant partition
Post-Cancellation / Terminated Account Data	30 calendar days following account termination	Permanent, irreversible cryptographic database deletion
Billing Records, Tax Invoices & Payment Tokens	7 years from date of transaction	Statutory archiving per Indian GST Act & Companies Act, 2013
System Security, Authentication & Audit Logs	12 months from generation	Automated rolling log purging
Disaster Recovery System Backups	30-day rolling retention cycle	Automated backup rotation and overwrite
Marketing Inquiries & Website Demo Form Submissions	24 months, or until consent is revoked / unsubscribed	Secure deletion from customer relationship queues

Tenants can request full account deletion at any time by having an authorized administrator email info@smattio.com. Upon cancellation, your data enters a 30-day grace period during which you may request a complete export of your lead records in CSV or JSON format. After 30 days, all CRM workspace databases, uploaded property files, and user credentials are permanently and irreversibly purged from our active systems, and will cycle out of encrypted backups within the standard 30-day backup rotation.

6Security Measures

Smattio maintains a comprehensive information security program utilizing administrative, technical, and physical controls designed to safeguard personal data against unauthorized access, destruction, loss, alteration, or disclosure:

• Encryption in Transit: All HTTP traffic across our website, web application, APIs, and mobile applications is enforced using modern Transport Layer Security (TLS 1.3 / TLS 1.2) with strict HSTS policies.
• Encryption at Rest: Sensitive data columns, storage volumes, and database snapshots are encrypted at rest using AES-256 standards.
• Cryptographic Password Hashing: All account passwords are protected using salted bcrypt hashes. Clear-text passwords are never logged, stored, or visible to Smattio personnel.
• Multi-Tenant Logical Isolation: Data isolation is enforced programmatically at the application and query layers. Database queries are strictly tenant-scoped, ensuring that no tenant can view, query, or modify another organization's records.
• Access Controls & Least Privilege: Access to production servers and infrastructure is strictly confined to authorized engineering personnel through multi-factor authentication (MFA), role-based access controls (RBAC), and key-based SSH authentication.
• Network Defense: Web Application Firewalls (WAF), rate-limiting mechanisms, automated intrusion detection, and continuous monitoring protect against DDoS attacks and brute-force attempts.
• Automated Disaster Recovery Backups: Daily automated backups are encrypted and replicated across georedundant secure facilities within India.

7GPS & Location Data

The Smattio mobile application includes an optional check-in and attendance module tailored for real estate field sales representatives. Our handling of location data follows strict boundaries:

• Explicit Trigger Only: GPS coordinates are captured solely at the exact instant when an agent actively triggers a designated in-app button (e.g., "Punch In," "Punch Out," or "Verify Site Visit").
• No Continuous Background Tracking: Smattio does not track, monitor, or poll your geographic coordinates continuously, passively, or in the background when the application is idle or closed.
• Restricted Visibility: Field location coordinates are accessible exclusively to designated administrative managers within your specific employer's organization for attendance confirmation and travel reimbursement auditing. Location records are never shared with external advertisers or third parties.
• Device Level Control: Field agents maintain full authority to grant, deny, or revoke location permissions at any time through their smartphone's system settings (iOS / Android). Revoking permission will disable check-in verification but will not impede other CRM functionality.

8Your Privacy Rights

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable global data protection regulations (such as GDPR for international users), individuals hold enforceable rights regarding their personal data:

• Right to Access & Summary: You have the right to request a clear summary of your personal data processed by Smattio, the processing activities undertaken, and the identities of any data fiduciaries or processors with whom your data has been shared.
• Right to Correction & Rectification: You may request the correction of inaccurate personal data, the completion of incomplete information, and the updating of out-of-date records.
• Right to Erasure ('Right to be Forgotten'): You may request the deletion of your personal data where retention is no longer necessary for the original processing purpose or for legal compliance.
• Right to Data Portability: You are entitled to receive your personal data in a structured, commonly used, machine-readable format (CSV or JSON) to transfer it to another service provider.
• Right to Withdraw Consent: Where processing is predicated upon your consent (such as promotional emails, optional marketing cookies, or WhatsApp updates), you have the right to withdraw that consent at any time without adverse penalty.
• Right to Nominate: Under Section 14 of the DPDP Act 2023, you have the right to nominate another individual who shall, in the event of your death or incapacity, exercise your data privacy rights on your behalf.
• Right of Grievance Redressal: You have the right to readily available means of grievance redressal provided by Smattio regarding any act or omission regarding personal data obligations.

If you are an end-customer prospective buyer whose contact details were submitted to or captured by a real estate builder or broker using Smattio, that builder or broker acts as your Data Fiduciary (Data Controller). We recommend directing your access, correction, or deletion requests directly to that specific real estate agency. If you contact Smattio directly, we will promptly notify the relevant Tenant administrator and assist them in fulfilling your statutory request.

To exercise any statutory privacy rights, please submit a written request to our Data Protection Officer at info@smattio.com with the subject line "Data Subject Rights Request". To protect account confidentiality, we will verify your identity before processing the request. We will acknowledge receipt within 48 hours and fulfill your request without charge within 30 days of receipt, unless requests are manifestly unfounded, repetitive, or excessive.

9Cookies & Tracking

Smattio uses cookies, local browser storage, and related web technologies on our website and web application to ensure platform stability, remember user preferences, and analyze aggregate traffic trends. We provide transparent information about our cookies and granular controls for our users.

Cookie / Key Name	Category	Purpose & Description	Duration	Opt-Out
smattio-crm-session	Strictly Necessary	Maintains authenticated user session identity and state across page navigations.	Session (expires on browser close)	No — Mandatory
XSRF-TOKEN	Strictly Necessary	Protects application users against Cross-Site Request Forgery (CSRF) security exploits.	Session (expires on browser close)	No — Mandatory
remember_web_*	Strictly Necessary	Maintains persistent login when the user explicitly opts into "Remember Me" on sign-in.	5 years (or until logout)	User-Initiated
smattio_cookie_consent	Functional / Preferences	Stored in both cookie and localStorage to record your cookie banner selections.	1 year	Configurable
smattio-theme	Functional / Preferences	Stored in browser localStorage to persist your dark/light interface mode selection.	Persistent until cleared	Configurable
Analytics Cookies	Performance / Analytics	Measures aggregate traffic, page timings, and navigation paths to optimize page speed.	Up to 12 months	Yes — Opt-in
Marketing Cookies	Marketing / Advertising	Measures conversion efficacy of digital marketing campaigns for prospective customers.	Up to 12 months	Yes — Opt-in

You have multiple options to govern cookies and local storage:

• In-Platform Consent Controls: You can adjust or withdraw your cookie consent at any time by clicking the "Cookie Preferences" link located in our website footer or through our on-site cookie banner modal.
• Browser Configuration: Most web browsers permit you to inspect, restrict, block, or delete cookies via browser privacy settings. Note that disabling Strictly Necessary cookies will prevent you from logging into your Smattio CRM account.
• Do Not Track & Global Privacy Signals: We honor Do Not Track (DNT) and Global Privacy Control (GPC) signals transmitted by your browser by automatically disabling optional analytics and marketing scripts.

10Children's Privacy

Smattio is an enterprise B2B real estate software platform created exclusively for commercial organizations, property builders, real estate brokers, and adult sales professionals. The Service is not directed toward, marketed to, or intended for individuals under the age of 18 (or the applicable age of legal majority in your territory).

We do not knowingly solicit, collect, or retain personal data from children under 18 years of age (or under 13/16 under COPPA and the GDPR). If you are a parent, legal guardian, or company administrator and become aware that a child has improperly provided us with personal data, please inform us immediately at info@smattio.com. Upon verification, we will promptly delete all such information from our databases and backups.

11Changes to This Policy

We may revise and update this Privacy Policy from time to time to accommodate changes in our platform architecture, integration capabilities, business operations, or evolving legal and regulatory requirements. When revisions occur, we will update the "Last Updated" and "Effective" date displayed at the top of this legal documentation.

For any material revisions that substantially impact how we collect, use, or share personal data, we will provide registered account administrators with at least 14 days advance notice prior to the effective date via direct email notification and an administrative dashboard notification banner. Continued access to or utilization of the Service following the effective date constitutes your acknowledgment of the updated terms. Previous versions of this policy are archived and available upon written request to our compliance team.

12Grievance Officer

In strict compliance with Section 5(9) of the Digital Personal Data Protection Act, 2023, Section 43A of the Information Technology Act, 2000, and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Smattio has designated a Grievance Officer to handle privacy disputes, data grievances, and statutory inquiries:

13Data Protection Officer

For questions regarding our privacy architecture, data processing agreements (DPAs), cross-border data inquiries, or to submit formal data subject access or deletion requests, you may contact our dedicated Data Protection Officer directly:

1Refund Policy Overview

At Smattio, we are committed to customer satisfaction. This Refund Policy outlines the circumstances under which refunds are granted for subscription payments made to Smattio Technologies Private Limited.

2Free Trial Period

Smattio offers a 14-day free trial on the Business plan with no credit card required. The trial period is designed for you to fully evaluate the Service before committing to a paid subscription.

• Full access to all Business plan features during the trial.
• No payment required to start the trial.
• Trial data is retained and transferred to your paid account upon subscription.
• No automatic charges at the end of the trial — you must actively choose to subscribe.

We strongly recommend utilising the free trial to ensure the Platform meets your requirements before purchasing a paid subscription.

3Refund Eligibility

Refunds are evaluated on a case-by-case basis. The following situations may qualify for a full or partial refund:

• Technical failure by Smattio: If we are unable to provide the Service as described due to our own technical issues lasting more than 72 consecutive hours.
• Double billing: If your payment method was charged more than once for the same subscription period due to a billing error on our part.
• Incorrect plan charged: If you were charged for a plan different from what you selected.
• Service not delivered: If your account was not activated within 5 business days of payment despite a confirmed payment receipt.
• Early cancellation within 7 days (new subscribers only): First-time subscribers who cancel within 7 days of their first paid subscription may request a prorated refund for the unused portion.

• Cancellation after 7 days of the subscription period (for renewals).
• Partial month usage — we do not issue prorated refunds for early cancellations after the 7-day window.
• Accounts suspended for violation of our Terms of Service or Acceptable Use Policy.
• Dissatisfaction with features that were accurately described in our plan documentation before purchase.
• Third-party integration costs (Twilio, Facebook API charges, etc.).
• Custom development or one-time setup fees, unless the project was not delivered.
• Renewal charges after a cancellation reminder was sent and ignored.

4Annual Subscription Refunds

Annual subscriptions receive a discounted rate in exchange for a longer commitment. The following refund terms apply to annual plans specifically:

Time Since Annual Payment	Refund Amount
Within 7 days (new subscriber)	Full refund
8–30 days	Prorated for unused full months (at monthly rate)
31–90 days	50% of remaining unused months (at monthly rate)
Beyond 90 days	No refund (service credit may be offered)

5How to Request a Refund

To request a refund, follow these steps:

• Email us at info@smattio.com with the subject line: Refund Request — [Your Company Name]
• Include your registered email address, Tenant ID or company name, and the reason for the refund request.
• Attach any relevant supporting documentation (e.g., duplicate payment screenshot, error screenshot).
• Our billing team will acknowledge your request within 2 business days.
• We will review and make a decision within 7 business days of receiving all required information.
• If approved, the refund will be processed to your original payment method within 10–15 business days.

6Service Credits as Alternative

In some cases where a cash refund is not applicable, Smattio may offer service credits as an alternative remedy. Service credits can be applied toward:

• Future subscription renewals
• Plan upgrades
• Add-on features or additional user seats
• Custom development work

Service credits do not expire and can be used at any time during the life of your account. Credits are non-transferable and have no cash value.

7Chargebacks & Disputes

We strongly encourage you to contact us directly before initiating a chargeback with your bank or payment provider. Unwarranted chargebacks may result in:

• Immediate suspension of your account pending investigation.
• Permanent account termination if the chargeback is found to be fraudulent or in bad faith.
• Recovery of all outstanding amounts plus dispute resolution fees.

If you have a legitimate billing dispute, our team will work with you to resolve it quickly and fairly. Most billing issues are resolved within 5 business days of first contact.

8GST & Tax on Refunds

All Smattio subscription prices are exclusive of GST (currently 18%). GST is charged separately on all invoices as required by Indian tax law.

When a refund is approved, the refund amount will include GST paid on the refunded portion. A revised GST invoice (credit note) will be issued for your records within 7 business days of the refund being processed.

9Contact Our Billing Team

For all billing and refund-related enquiries, our dedicated billing team is available Monday–Saturday, 10 AM – 7 PM IST.