Privacy Policy

Who we are

Zoreja is a sole proprietorship: Amarshan Singh Khanna, trading as Zoreja. This policy explains what personal data we process on zoreja.com and its tools, and the rights you have over it. Contact: zoreja.connect@gmail.com.

Data we collect

• Account data: the email address you sign in with, and the name, role, language and home-search preferences you choose to give us.
• Details you submit with a request: your name, phone number, email and the request itself — for example a home-loan request (amount, preferred bank, and the district and locality of the property in Maharashtra) or a Vastu consultation request (the state or union territory, and the district and locality if you give them) — together with a record of the consents you gave.
• Files you upload: documents you add to your Docs Vault, and floor plans you upload for a Vastu analysis. A copy of each floor plan is also saved in your Docs Vault (folder "Vastu-Plans").
• What you check: the RERA numbers and project names you search for. When MahaRERA confirms a RERA Check, we save the result — the registration numbers, project and promoter names MahaRERA listed, and the date — to your My Reports; for 30 days it lets your one-pagers say that number is registered on MahaRERA.
• If you are a lead in a Channel Partner's My Leads (beta): your name, mobile number, the property you were interested in, the Channel Partner's notes and follow-up reminders, and a record of your permission — the sentence you agreed to on their Presentation QR page and when, or the Channel Partner's confirmation that you gave them permission and when. The Channel Partner collects these details, either because you left them on their QR page or because they added you after confirming they have your permission; Zoreja stores them for that Channel Partner.
• Usage events: which tools you open and use, recorded by Zoreja itself, including for visitors who are not signed in.
• Technical data: your IP address, used for security and rate-limiting. Our rate limits store a scrambled (hashed) form of it, not the address itself; our hosting provider's logs record it.

We do not use third-party advertising or analytics trackers, and we do not sell your personal data.

Why we use it

• To run the tool or service you asked for.
• To pass a request you have agreed to share to a partner approved by the Zoreja team (see below).
• To keep your files in your Docs Vault.
• To secure the platform and prevent abuse.
• To send occasional market updates, only if you opt in.

Each purpose you are asked to agree to is a separate, unticked box. We never bundle consents.

Who receives your data

• Partners approved by the Zoreja team. When you agree to share a request, our team reviews it and passes your name, phone number and request details (including the place you gave) to a partner who handles that kind of request — a Channel Partner for a home loan, or a Vastu consultant for a consultation. That partner can see those details and contacts you. The Zoreja team reviews and approves every partner, but does not independently verify their licences. To withdraw your consent for a request that has not been passed on yet, email zoreja.connect@gmail.com.
• Service providers who process data for us: Vercel hosts the app (the servers that run it are in Mumbai, India); Supabase runs our database, sign-in and file storage (its servers are in Tokyo, Japan); Google's Gemini AI service reads the floor plans you upload for a Vastu analysis, the documents you ask us to analyse and the project names in RERA name searches, and answers your Zora chats. This means your data is processed outside India.
• MahaRERA: the RERA number or project name you check is sent to MahaRERA's public project search.
• The Channel Partner whose list you are in. If you leave your details on a Channel Partner's Presentation QR page, or a Channel Partner adds you with your permission, that Channel Partner sees your name, number and the details above in their My Leads (beta), can download them in a spreadsheet, and contacts you. Only that one Channel Partner — a number can be in only one Channel Partner's list at a time. Zoreja itself does not message you.
• Anyone you give a share link to: one-pagers, loan sheets and RERA listing proofs you create have a share link, and anyone with that link can open the file or page.

Zoreja does not message you on WhatsApp.

How we protect your data

• Your files (Docs Vault documents, including Vastu floor plans, one-pagers and loan sheets) are encrypted by our server with AES-256-GCM before they are stored, in a private Supabase storage bucket in Tokyo, Japan. In Zoreja they open only for your signed-in account, or through a share link you create; there is no screen that lets Zoreja staff open them. Zoreja's server holds the encryption key, so this protects stored files but is not end-to-end encryption.
• Other data is not encrypted by us. Your profile, the requests you submit, your searches and the figures you enter in our tools are stored in readable form in our database, protected by access controls.
• All traffic uses HTTPS.
• Every request is checked against the signed-in account in our application, so one account cannot read another's data. This is enforced by the application, not additionally by database rules. Administrative actions are written to an internal audit log.

How long we keep it

• Buyer enquiries that are not linked to an account are deleted automatically after 30 days by a daily job.
• Leads in a Channel Partner's My Leads (beta): when the Channel Partner deletes a lead it is hidden at once and can be restored for 15 days; after that it is deleted for good. A lead with no activity from the Channel Partner or from you for 90 days is deleted for good, with no undo. Messages in a lead's log, including drafted messages, are deleted 90 days after they were written. When a lead is deleted for good, Zoreja keeps only a record that it existed: its ID, the Channel Partner's account ID, the date, and a scrambled form of the mobile number made with a secret key kept outside the database, which cannot be turned back into the number. This record stops the same lead being deleted and added again to get around the Channel Partner's limits.
• Backups: deleted data can remain in our database provider's backups until the provider's backup period ends and those backups are replaced.
• Everything else has no automatic deletion today: your account, requests, files, searches, usage events and the records of what you used are kept until you delete them (you can delete files in your Docs Vault at any time) or ask us to erase them.

Your rights (DPDP Act, 2023)

You can ask to access, correct or erase your personal data, withdraw a consent, and nominate someone to act for you. To use any of these rights, email the Grievance Officer below from the address you sign in with.

If you are in a Channel Partner's My Leads (beta) you can withdraw your permission at any time, without an account: email zoreja.connect@gmail.com with your mobile number (and the Channel Partner's name, if you know it). We delete your details from that Channel Partner's list, leaving only the deletion record described above.

Erasure is carried out by our team on request — there is no delete-account button yet. It removes: the files in your Docs Vault and Legal Vault (and the stored copies), your saved items, your Zora usage entries, enquiries linked to your account or to your sign-in email, and the name and WhatsApp numbers on your profile. Loan requests are anonymised — your name, phone number and email are removed — rather than deleted, so an anonymous record that the request existed remains.

What that erasure does not remove today:

• your sign-in account and its email address, which also stays on your profile;
• Vastu consultation requests — the name, phone number and email you gave stay on the request, and the consultant it was passed to can still see them;
• the other details on your profile (role, language and any home-search preferences);
• the records of what you used — credit use, RERA checks, Vastu results and other tool results — and usage events;
• anything a partner has saved about you in their own records.

Ask the Grievance Officer and we will remove these by hand where we can — including your Vastu booking details — and tell you what we have to keep.

Grievance Officer / Data Protection contact

• Grievance Officer: Amarshan Singh Khanna
• Email: zoreja.connect@gmail.com
• We acknowledge your request and respond within 90 days.
• If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India.

Cookies

We use only strictly necessary cookies: your sign-in session cookie, and an admin session cookie for our own team. Small preferences, such as your language, are kept in your browser's local storage. No advertising or cross-site tracking cookies.

Children

Zoreja is not directed at anyone under 18 and we do not knowingly process children's data.