Luxati
Legal

Privacy Policy

Last updated: 20 May 2026

1. Who we are

This Privacy Policy describes how Ibizo Technologies Private Limited (“Luxati”, “we”, “us”) collects, uses, shares and protects your personal data when you use the Luxati Estate app (for buyers), the Luxati Partner app (for brokers and agencies), and the websites at luxati.com (together, the “Platform”).

Luxati is the real-estate division of Ibizo Advisory. Our registered office is in Noida, India. This policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (“DPDPA”).

2. Data we collect

2.1 Information you provide

  • Account details: name, mobile number, email, city, profile photo.
  • Buyer brief data: budget, preferred locality, BHK, move-in timeline, property type, financing preferences.
  • Broker KYC: PAN, RERA registration (where applicable), business address, GSTIN, bank-account details for payouts, identity documents.
  • Listings and inventory: property addresses, photos, pricing, availability, ownership documents you upload.
  • Communications: messages exchanged in-app, call metadata routed through our masked-calling provider (the call audio itself is not recorded by default).

2.2 Information we collect automatically

  • Device & technical data: device model, OS, app version, IP address, language, time-zone, crash logs.
  • Usage data: screens viewed, features used, search queries, properties saved, brokers contacted.
  • Cookies & analytics: we use Google Analytics 4 on luxati.com to understand traffic patterns. You can opt out of GA at any time.

2.3 Information from third parties

We may receive information from your payment instrument provider, our KYC verification partners, RERA portals (to verify broker registrations), and our masked-calling provider.

3. How we use your data

  • To create and operate your buyer or broker account.
  • To match buyer briefs with brokers whose inventory and work area fit.
  • To route masked calls and chats between buyers and brokers.
  • To verify broker identity, RERA status, GST status, and inventory authenticity.
  • To process payouts to brokers and to record closure-fee shares due to Luxati.
  • To send transactional messages (OTPs, lead matches, payout confirmations) and, with your consent, marketing updates.
  • To detect and prevent fraud, spam, and abuse of masked calling.
  • To comply with applicable laws, court orders, and lawful regulatory requests.

4. Legal basis for processing

Under the DPDPA we process your personal data on the basis of your consent (which you may withdraw at any time) and on grounds of legitimate use, including to perform the services you have signed up for, to comply with law, and to respond to medical or safety emergencies.

5. How we share your data

We do not sell your personal data. We share it only with:

  • Brokers (for buyers): when a broker accepts your brief, they see your first name, brief details, and a masked phone number — not your real mobile.
  • Buyers (for brokers): a broker's public profile (name, agency, RERA number, closure history, ratings) is visible to matched buyers.
  • Payment processors: our payment gateway partners (e.g. Razorpay, Cashfree, or equivalent) receive transaction details to settle broker payouts and collect closure-fee shares. Card and UPI data is collected directly by the gateway and is not stored on our servers.
  • Service providers: cloud hosting (AWS / Google Cloud), masked-calling provider, SMS/email delivery, analytics, KYC verification, fraud detection.
  • Regulators and law enforcement: when required by law, court order, or lawful investigation.
  • Corporate transactions: in the event of a merger, acquisition, or sale of assets, with notice to you.

6. Data retention

We keep your account data while your account is active. Buyer brief data is retained for up to 24 months after closure or last activity, to help with after-sale support and tax records. Broker KYC, transaction and closure-fee data is retained for at least 8 years, as required by Indian tax and anti-money-laundering laws. After these periods we delete or anonymise the data, except where longer retention is required by law.

7. Your rights

Subject to the DPDPA, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Erase your data (subject to mandatory retention periods).
  • Withdraw consent for non-mandatory processing.
  • Nominate another person to exercise your rights on your behalf.
  • File a grievance with our Grievance Officer (see section 11).

8. Security

We use industry-standard safeguards including TLS encryption in transit, encryption at rest for sensitive fields, access controls, audit logs, and periodic security reviews. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the Data Protection Board of India in accordance with the DPDPA.

9. Children

The Platform is intended for users aged 18 and above. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the app and on this page. The “Last updated” date at the top reflects the latest revision.

11. Grievance Officer & contact

For privacy questions, data-rights requests, or complaints, contact our Grievance Officer:

  1. Email: contact@luxati.com
  2. Address: Ibizo Technologies Private Limited, Noida, Uttar Pradesh, India

We respond to grievances within 30 days, in line with the DPDPA and the IT Rules.