Privacy & Data Protection Policy

1. Overview & Commitment

Arutis Technologies Private Limited ("Arutis", "we", "us", or "our"), having its operating headquarters at Bandra Kurla Complex (BKC), Mumbai, Maharashtra 400051, India, operates ArutisCRM (https://crm.arutistechnologies.com).

We provide cloud-based, multi-tenant real estate customer relationship management and inventory software to Indian real estate developers, builders, channel partners, and brokers. We are committed to protecting the privacy of our subscribers, their authorized users, and their prospective property buyers and sellers in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 (and rules thereunder).

---

2. Multi-Tenant Data Isolation & Encryption

A foundational pillar of ArutisCRM is our strict Multi-Tenant Data Boundary Protection:

• Cryptographic Tenant Scoping: Every real estate company operates in a dedicated, isolated database scope governed by a unique tenant_id. Under no circumstances can any user or employee of one real estate company view, query, or export data belonging to another company.
• Encryption at Rest & in Transit: Sensitive customer records, phone numbers, Aadhaar/PAN references, and confidential price quotes are encrypted using industry-standard AES-256 encryption. All web and API traffic is strictly encrypted using TLS 1.3 / HTTPS.
• Zero Cross-Contamination: Lead records captured via 99acres, MagicBricks, Housing.com, Meta Ads, or direct WhatsApp forms are locked exclusively to the subscribing licensee's tenant workspace.

---

3. Information We Collect

We collect and process the following categories of information:

1. Account & Billing Information: Name, work email address, company business name, RERA registration number, GSTIN, billing address, and transaction identifiers provided when registering an ArutisCRM account or subscribing to a billing tier via Razorpay.
2. Client / Lead Data Entered by Subscribers: Buyer and seller contact names, phone numbers, property inquiries, visit logs, and booking cost sheets that subscribers upload or capture through their business operations.
3. Technical & Usage Diagnostics: IP address, browser user-agent, operating system, and system access audit logs to detect security threats and provide customer support.

---

4. Purpose of Data Processing

We process data solely for the following legitimate business purposes:

• Delivering the core functionalities of ArutisCRM (lead tracking, WhatsApp site visit notifications, property expo management, tower inventory, and billing).
• Facilitating subscriber-approved integrations with SMS gateways, WhatsApp Cloud API, and Indian real estate portals.
• Complying with statutory reporting requirements under applicable Indian laws, RERA rules, and tax mandates.
• Maintaining system security, uptime, and automated backup operations within certified data centers.

---

5. Data Retention & Deletion

Subscribers retain full ownership of their operational CRM records. You may request data exports in Excel/CSV format at any time from your tenant settings. Upon termination of an ArutisCRM subscription, subscriber data is retained for a grace period of 30 days to facilitate renewal, after which it is securely purged from production clusters.

---

6. Grievance Officer & Contact

In accordance with the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023, you may address any privacy concerns or exercise your data rights by contacting our designated Data Protection & Grievance Officer: