1. Statutory Legal Roles: Data Fiduciary vs. Data Processor

1.1. Under the provisions of the Digital Personal Data Protection Act, 2023:

1.2. The Client Developer is the “Data Fiduciary”: The real estate developer, builder, or marketing agency determines the purpose and means of collecting personal data from prospective plot buyers, home buyers, or clients. The Developer is solely responsible for providing statutory notice and securing lawful consent from its buyers before entering any buyer names, contact details, or token records into the Developer Admin Portal.

1.3. JAIVIBE CRM is the “Data Processor”: JAIVIBE CRM processes, hosts, and stores real estate inventory and customer hold data strictly on behalf of, and pursuant to the technical instructions of, the client Developer. JAIVIBE CRM does not own, independently process, or monetize buyer data.

2. Categories of Data Processed

2.1. Administrative & Credentials Data: For authorized Developer personnel and administrative accounts: username, organizational email, cryptographically salted password hashes (bcrypt), assigned tenant IDs, and active session device tokens.

2.2. Real Estate Layout Data: Master plan blueprint images (PNG, JPEG, WebP), polygon vector coordinates, plot numbers, square yardage/dimensions, facing directions, inventory statuses, and optional private internal buyer hold notes entered by Developers.

2.3. Technical, Log & Audit Data: IP addresses, approximate geographical city/region, browser user-agent headers, session timestamps, and immutable activity logs recording inventory modifications.

2.4. General Inquiries: Contact information (name, telephone number, email, and inquiry messages) voluntarily submitted through the public contact form at crm.jaivibe.com/contact.

3. Server-Side Customer Identity Redaction (Privacy by Design)

3.1. Mandatory Technical Redaction: In adherence to statutory data minimization principles, when any Public User or prospective buyer opens an interactive public plot map link (crm.jaivibe.com/developer/project), the server API automatically and irreversibly redacts all customer personally identifiable information (PII) before transmission.

3.2. Stripped Data Fields: Internal buyer names (ownerName), customer contact numbers, hold notes, and transaction notes are stripped on the server side and set to undefined in the JSON payload delivered to client browsers.

3.3. Broadcast Limitations: Public maps deliver exclusively visual geometry, plot numbers, dimensions (sq yds), facings, and availability badges (“Available”, “Reserved”, “Registered”). At no point does JAIVIBE CRM broadcast or make publicly available any homebuyer identity.

4. WhatsApp Inquiry Routing & Peer-to-Peer Communication

4.1. When a prospective buyer clicks the “WhatsApp Inquiry” button on any plot, the browser executes a direct URL redirect to the official WhatsApp mobile application or WhatsApp Web, addressing the Developer's designated telephone number.

4.2. Zero Interception: JAIVIBE CRM does not intercept, read, store, transcribe, or monitor buyer WhatsApp telephone numbers or chat content. All communication occurs strictly peer-to-peer over WhatsApp's end-to-end encrypted messaging infrastructure.

4.3. The Company disclaims all responsibility for any representations, price quotations, or contracts negotiated between a buyer and a developer over WhatsApp.

5. Multi-Tenant Architecture & Cloud Security Safeguards

5.1. Tenant Isolation (Row-Level Security): The Platform enforces strict database Row-Level Security (RLS). Developer sub-admin accounts are restricted to querying and modifying records tied strictly to their unique developerId. Cross-tenant access is strictly blocked at the database query layer.

5.2. Encrypted Storage & Infrastructure: Blueprint layout images are stored in isolated Cloudflare R2 object storage buckets with presigned cryptographic access. Inventory records are hosted on managed MongoDB Atlas database clusters with automated encryption in transit (TLS/HTTPS) and encryption at rest.

5.3. Session Protection: Administrative access tokens are secured inside tamper-proof, HttpOnly, SameSite=Lax browser cookies signed using cryptographic HS256 JWT signatures. Active logins are constrained by concurrent device caps to prevent unauthorized credential sharing.

6. Absolute Prohibition of Data Monetization & Sub-Processor Disclosure

6.1. Zero Data Selling: JAIVIBE CRM does NOT sell, rent, lease, trade, or commercialize developer inventory records, buyer contact lists, or plot sales figures to any third-party real estate broker, advertising network, or data aggregator.

6.2. Authorized Cloud Sub-Processors: The Company utilizes trusted infrastructure sub-processors strictly to host and execute the software service:

• Cloudflare, Inc. (R2 Object Storage): Secure cloud hosting for layout master blueprint files.
• MongoDB, Inc. (MongoDB Atlas): Managed cloud database for plot records and audit logs.
• Vercel, Inc.: Serverless application hosting and Edge middleware execution.

6.3. Statutory Disclosures: Personal or account records will only be disclosed to government bodies or law enforcement authorities upon receipt of a valid, enforceable court order or statutory directive issued under Indian law.

7. Data Retention & Permanent Offboarding Purge

7.1. Active Account Retention: Real estate inventory and project records are retained for the duration of the active subscription agreement.

7.2. Permanent Offboarding Deletion: Upon client offboarding or formal project deletion, the Platform permanently deletes all associated project documents, plot polygon records, developer login accounts, active sessions, and Cloudflare R2 image files.

7.3. Security Logs: High-level system activity audit logs are preserved for security auditing, fraud prevention, and proof of legal compliance.

8. Rights of Data Principals (Under the DPDP Act, 2023)

8.1. In accordance with Sections 11 through 14 of the Digital Personal Data Protection Act, 2023, Data Principals (individuals whose personal data is processed) possess the right to:

• Request a summary of personal data being processed and the processing activities undertaken.
• Request correction, completion, or updating of misleading or inaccurate personal data.
• Request erasure of personal data that is no longer necessary for statutory or agreed purposes.
• Seek grievance redressal regarding the processing of personal data.

8.2. Because the Client Developer acts as the primary Data Fiduciary for homebuyer identities, buyers may submit requests directly to the respective Developer to amend or delete their plot reservation records.

9. Statutory Grievance Redressal & Data Protection Officer

9.1. In compliance with the Digital Personal Data Protection Act, 2023 and Rule 3 of the Information Technology (Intermediary Guidelines) Rules, 2021, the designated officer for privacy inquiries and data grievances is: