Bruj — Privacy Policy

Version 2.2 · Effective 1 November 2026 · Draft for counsel review

This policy explains what personal data Bruj collects, why, how long we keep it, who we share it with, and the rights you have. It is our notice to you under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, and is also written to meet the Information Technology Act, 2000 and its rules.

You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to the Grievance Officer (section 15).

1. Who we are

Bruj is a commercial real estate information platform for occupiers and investors. It is operated by Saraf Holdings Private Limited, a company incorporated in India, with its business address at 17 Dover Road, Ballygunge, Kolkata 700017, West Bengal, India ("we", "us"). For the purposes of the DPDP Act we are the Data Fiduciary for the personal data described here.

Bruj is free. We do not charge users, take fees on transactions, or act as a broker or agent for anyone.

2. The short version

• We collect what you give us to run your account, and a small amount of technical data to keep the service working and secure.
• What you put in your own workspace (My portfolio, rent ledger, requirements, shortlists, notes) is private to your account.
• We do not sell your personal data, show advertising, or use advertising or cross-site tracking cookies.
• We do not publish the names of individuals in the building information we show.
• You can see, correct, download or delete your data, and withdraw consent, at any time.

3. Personal data we collect, and why

For each item we list the data, the purpose, and how long we keep it. We use your data only for the purposes stated next to it.

3.1 Your account

• Data: your full name, e-mail address, phone number, organisation (or "Individual"), the profile label you choose (owner or landlord, lessee, investor, or Channel Partner), a profile photo (optional), a RERA registration number and the State that issued it if you are a Channel Partner and give them, what brings you here if you say, and the markets you are interested in.
• Purpose: to create and secure your account, show you the features for your account type, and contact you about your account. We call or WhatsApp you on your phone number only if you separately agree to be contacted that way (section 4); the people you share a listing with see it and your photo (section 6). Your photo is stored at an address that is not listed anywhere; anyone who has that address can open it.
• Kept: while your account is open.

3.2 Your space requirement (Occupiers)

• Data: the size, location, budget, timing and other needs you enter.
• Purpose: to show you matching spaces and, only if you ask us to, to help you find space.
• Kept: while your account is open, or until you delete the requirement.

3.3 My portfolio

• Data: spaces or assets you record, lease terms (for example rent, CAM charges, security deposit, lock-in, escalation, notice period, seats), your rent ledger (month, amounts, paid or due, paid-on date), and figures we calculate from them, such as cost per seat and lease calendar dates.
• Purpose: to keep your records and reminders for you. These figures are your own entries; we do not verify them, publish them, or use them to build market data.
• Kept: while your account is open, or until you delete the entry.

3.4 Listings you submit

• Data: property details, photographs, documents and contact details you provide through "List your property".
• Purpose: to review your listing and, once approved, show it on Bruj. Your contact details are not published; enquiries are passed to you.
• If you upload a document to list a property, its contents are read by an AI service (Claude, by Anthropic) to fill in your listing. Uploaded files are stored privately and deleted if the listing isn't confirmed.
• Kept: while the listing is live and for 12 months after it is withdrawn, so we can answer questions about it; then deleted.

3.5 Enquiries and requests

• Data: what you enter when you send an enquiry about a space or building, ask for a site visit, or send a loan-against-rent (LRD) or financing enquiry, together with your contact details.
• Purpose: to respond to you and, where the enquiry is about a listing, to pass it to the person who listed it. We will not pass a financing enquiry to any lender or third party without asking you first.
• Kept: 12 months from the enquiry, then deleted automatically.

3.6 Saved work

• Data: saved searches, shortlists, notes, and calculator scenarios you choose to save.
• Purpose: to keep them for you.
• Kept: while your account is open, or until you delete them.

3.7 Private links and presentations

• Data: when someone opens a private link or presentation shared from Bruj, we record that the link was opened, when, and which parts were viewed. We do not require the viewer to sign in, and we do not record the viewer's name unless they give it.
• Purpose: to tell the person who shared the link that it was viewed, and to keep links secure.
• Kept: 12 months, then deleted.

3.8 Feedback and problem reports

• Data: what you write to us, the page you were on, and your account e-mail if you are signed in.
• Purpose: to answer you and fix problems.
• Kept: 24 months, then deleted.

3.9 Technical and security data

• Data: sign-in records, the type of device and browser, error reports (the error message, the page, and the browser), and anonymous counts of how people move through sign-up.
• Purpose: to keep Bruj secure and working, prevent misuse, and fix errors.
• Kept: at least one year, as the DPDP Rules require for security logs, and no longer than two years.

What we do not collect. We do not ask for Aadhaar, PAN, bank account or card details, payment information, or your precise location.

4. Your consent

When you create an account we ask for your consent separately for:

1. Running your account (required): processing the data in section 3 for the purposes stated there. Without it we cannot provide an account.
2. Being contacted by phone or WhatsApp (optional): about your requirement, listings or enquiries. You can leave this unticked and still use everything on Bruj.

We keep a record of what you agreed to, which version of this policy it was, and when. You can withdraw consent at any time, as easily as you gave it: switch off phone contact in Settings, or delete your account (Settings, then Delete account), or write to the Grievance Officer. Withdrawing does not affect anything done before you withdrew.

We may also process personal data without consent where the DPDP Act allows it, for example to comply with law or a court order.

5. Information about buildings, and people named in public records

The building information on Bruj comes from public registries and other named sources, and every fact shows its source and status. Some public records name individuals, for example as owners. We do not publish the names of individuals. If you believe Bruj shows personal data about you, write to the Grievance Officer and we will review and, where appropriate, remove or correct it.

6. Who we share personal data with

We share personal data only:

• With people you choose: when you share a link or presentation, send an enquiry, or submit a listing. When you share a listing, the person you share it with sees your name, photo, organisation, profile label and the phone number and e-mail in your profile.
• With service providers who run Bruj for us, under contract and only for that purpose:
• Supabase: database, sign-in and private file storage.
• Netlify: website hosting and delivery.
• Mapbox: map display. When the map loads, your device asks Mapbox for map images, so Mapbox receives your IP address and the map area being viewed.
• Google: web fonts (your browser fetches font files from Google, which receives your IP address) and e-mail delivery from our Google account.
• When the law requires it: to comply with a valid request from an Indian authority or a court.
• If the platform changes hands: personal data may pass to a successor who must honour this policy.

We do not sell personal data and do not share it with advertisers or data brokers.

7. Where your data is processed

Your data is stored with Supabase. Some of our service providers may process data outside India. We transfer personal data outside India only as the DPDP Act permits, and never to a country the Government of India has restricted.

8. How long we keep data

We keep each kind of data for the period stated in section 3, and only as long as needed for its purpose or as the law requires. When you delete your account we erase your personal data within 30 days, except records we must keep by law (for example security logs), which are kept only for the period the law requires.

9. Security

We use encrypted connections, row-level access controls so that each account can reach only its own data, private file storage with short-lived links, and restricted administrative access. No system is perfectly secure. If a personal data breach affects you, we will tell you without delay, and tell the Data Protection Board of India, as the DPDP Rules require.

10. Your rights

Under the DPDP Act you can:

• Access: ask for a summary of the personal data we hold about you, how we use it, and who we have shared it with.
• Correct, complete or update it. Most details can be changed in Settings.
• Erase it: Settings, then Delete account, or write to us.
• Withdraw consent (section 4).
• Nominate another person to exercise your rights if you die or become unable to do so.
• Complain: to our Grievance Officer first (section 15), and if you are not satisfied, to the Data Protection Board of India.

We will reply to requests within the time the DPDP Rules allow, and aim to do so within 15 days. We may need to confirm your identity first.

11. Cookies and browser storage

Bruj uses only the browser storage it needs to work:

• Sign-in: keeps you signed in.
• Preferences: remembers simple choices such as the last tab you used and saved searches.

We do not use advertising cookies, cross-site tracking, or third-party analytics. Clearing your browser storage signs you out and resets these preferences.

12. Age

Bruj is for professionals aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.

13. Not a broker; not advice

Bruj is an information service. We do not broker, arrange or take part in any transaction. Listings are the statements of the people who list them. Nothing on Bruj is legal, financial, tax, valuation or investment advice.

14. Changes to this policy

If we change this policy we will post the new version here with its effective date. If a change affects how we use your personal data, we will tell you by e-mail before it takes effect and, where the law requires, ask for your consent again.

15. Grievance Officer and contact

Dev Saraf, Director, Saraf Holdings Private Limited E-mail: SarafDev@gmail.com Address: 17 Dover Road, Ballygunge, Kolkata 700017, West Bengal, India

We acknowledge grievances within 24 hours and aim to resolve them within 15 days.