Privacy policy

We process personal data for specific and lawful purposes, including to:

• verify your mobile number, provide WhatsApp OTP sign-in, maintain your session, and protect your account;
• save and submit your inquiry, match relevant buyer demand, form or manage groups, and show suitable properties, vehicles, or offers;
• coordinate with authorised staff, advisors, dealers, developers, sellers, and other relevant partners when needed to respond to your request;
• deliver transactional updates, callbacks, support responses, and service notices that you request or consent to receive;
• review files, investigate abuse, enforce access controls, prevent fraud, maintain audit trails, and secure our systems;
• answer privacy requests and grievances, meet legal obligations, establish or defend claims, and respond to lawful authority requests; and
• understand and improve platform reliability and buyer journeys using aggregated or de-identified information where practical.

Where applicable, we rely on your consent, actions you ask us to take, and other grounds permitted by Indian law. If required data is not provided, some features, such as OTP sign-in, saved inquiries, group matching, or support follow-up, may not work. GujjuMind does not approve loans or make a buyer's final car or property purchase decision.

GujjuMind uses WhatsApp as its buyer OTP and transactional messaging channel. When this service is enabled and you request a code or agree to WhatsApp updates, we may send Meta the destination mobile number, approved template name and language, message variables such as the one-time code, and a message reference needed for delivery. We receive delivery, read, and failure status events where Meta provides them.

Your OTP normally expires in about five minutes. We do not expose it in the website or API response, and we do not store the readable OTP in our database. Meta and WhatsApp process messaging data under their own terms and the Meta Privacy Policy.

WhatsApp consent for inquiry, offer, callback, and support updates is not consent for unrelated advertising. You may withdraw non-essential messaging consent by contacting us. We may still send a code you actively request or a legally required service notice, where permitted.

We may disclose only the information reasonably needed to:

• authorised GujjuMind staff, administrators, and advisors who operate, secure, support, or review the service;
• dealers, developers, sellers, and relevant partners so they can assess an inquiry, participate in a group-buying process, prepare an offer, or respond to a request at the appropriate stage;
• service providers that host data, store files, deliver messages, monitor security, or provide technical support on our instructions, including Meta for WhatsApp delivery;
• courts, regulators, law-enforcement agencies, or other authorities when disclosure is legally required or reasonably necessary to protect rights and safety; or
• a successor or adviser in a genuine merger, restructuring, financing, or transfer of the business, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data as a standalone product or share it with data brokers. Other buyers should receive group context rather than your direct contact details unless a specific coordinated interaction requires and permits that disclosure.

GujjuMind uses essential cookies and similar session mechanisms to keep buyer and admin sessions signed in, refresh authorised sessions, prevent misuse, and preserve security. Production session cookies are configured with protections such as HTTP-only access, secure transmission, and SameSite controls.

We do not currently use third-party advertising pixels or non-essential behavioural analytics cookies on the public website. If that changes, we will update this policy and introduce any notice or choice required by law before using them.

We keep data only for as long as reasonably needed for the purpose described in this policy, to maintain security and audit history, resolve disputes, enforce agreements, and satisfy legal requirements. Retention therefore depends on the type of record and the status of your relationship with GujjuMind.

• OTP codes normally expire in about five minutes; related challenge and security records may be retained longer to prevent abuse and investigate incidents.
• A refresh session generally lasts for up to 30 days unless you sign out, it is revoked, or a different security configuration applies.
• Inquiry, group, offer, support, consent, audit, and upload records may be retained while the service is active and afterward where needed for support, fraud prevention, disputes, compliance, or legal claims.
• When deletion is required and no lawful or security reason supports continued retention, we will delete or anonymise the relevant data using our operational process.

We use proportionate technical and organisational safeguards, including encrypted network transport in production, protected session cookies, role-based admin and buyer access, one-way hashing for OTP verification records, restricted file access, file type and size validation, audit logging, risk checks, and controlled outbound network access.

No internet service can guarantee absolute security. If we identify a personal-data incident, we will investigate, contain it, preserve appropriate evidence, and provide notices required by applicable law. Please contact us promptly if you believe your account or information has been misused.

Subject to identity verification and applicable law, you may ask us to:

• confirm whether we process your personal data and provide an understandable summary;
• correct inaccurate or incomplete account and inquiry information;
• erase personal data that is no longer required, where no legal, security, fraud-prevention, or dispute-related exception applies;
• withdraw a consent or change a communication preference for future processing;
• explain relevant recipients or categories of recipients with whom your data has been shared;
• register and resolve a privacy grievance; and
• nominate another individual to exercise applicable rights in the event of death or incapacity, where this right applies.

Withdrawal does not invalidate processing already carried out lawfully. It may also prevent us from providing a feature that requires the withdrawn data. If you remain dissatisfied after using our grievance process, you may approach the competent authority where a statutory complaint route is available.

GujjuMind is intended for adults who can make or participate in car and home purchase decisions. It is not directed to anyone under 18, and we do not knowingly seek their personal data. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.

Depending on our infrastructure and service providers, personal data may be processed or stored in India or another country. For example, Meta may process WhatsApp message delivery data on its global systems. Where cross-border processing occurs, we apply appropriate safeguards and follow restrictions notified under applicable Indian law.

We may update this policy when the product, providers, or law changes. The latest version and date will appear on this page. If a change materially affects how we use data already collected, we will provide additional notice or seek consent where required.

Jigar Patel is the designated privacy & grievance contact for Trivik Group and GujjuMind. This contact is authorised to receive and coordinate responses to privacy questions, consent withdrawals, correction or deletion requests, and grievances.

Email info@gujjumind.com with the subject “Privacy request”, or use the contact page and select “Privacy concern” or “Grievance”. Describe the request and the mobile number or email connected to your account. Do not send an OTP, password, bank detail, or identity document by ordinary email or through the basic contact form.

We may request proportionate information to verify your identity before changing, disclosing, or deleting account data. We will acknowledge and handle requests within the period required by applicable law.