Privacy Policy

1Information we collect

Account and sign-in. When you sign in with Google, we receive your name, email address and profile picture. We never see your Google password.

KYC documents. Identity documents you upload to register for bidding — for example PAN and a government photo ID — so a bank can verify your eligibility to bid before accepting an earnest money deposit.

Photos. Lot photographs are published by the listing bank, not by you. If a KYC document requires a photograph of yourself, that image is stored as part of your KYC record.

Bids and auction activity. The auctions you view, the lots you watch, and every bid you place — amount, time, and which auction it was against.

Location — district only.We ask for your approximate location so nearby auctions can be shown first. What we store is your district, not a precise coordinate. Declining this only removes the "near you" sort.

Device identifiers. A push notification (FCM) token, so we can alert you when bidding opens on a lot you are watching, or when you are outbid.

Analytics. Basic usage events — which screens are opened and how often — so we can tell which parts of the app are actually used. Analytics events are not linked to your bids for any purpose other than product improvement.

2How we use it

• Creating and securing your account.
• Verifying your eligibility to bid, on behalf of the bank running an auction you register for.
• Showing you relevant, nearby auctions.
• Running the bidding itself and recording its outcome.
• Sending alerts about auctions you are watching or bidding in.
• Improving the app based on how it is actually used.

3Who we share it with

The bank running an auction you register for or bid in, so it can verify your eligibility, accept your earnest money deposit, and run the auction. We share only what that bank needs for its own auction, not your full account.

We also use the following processors, who act on our instructions:

• Google Sign-In. Authenticates you and tells us your name, email address and profile picture. We never see your Google password. Privacy policy.
• Firebase Cloud Messaging (Google LLC). Delivers push notifications to your device. It receives the notification text and your device's push token. It is not used to sign you in and holds none of your app data. Privacy policy.
• Supabase Inc.. Hosts the database and the sign-in service. Your study record is stored there so a new phone can pick up where the old one left off. Supabase stores it on our behalf and does not use it for its own purposes. Privacy policy.
• Supabase Inc. (Storage). Stores files you upload — lot photographs and KYC documents — in access-controlled storage. Supabase stores them on our behalf and does not use them for its own purposes. Privacy policy.
• Vercel Inc. and Neon Inc.. Host the application and its database. They store data on our behalf and do not use it for their own purposes. Privacy policy.

Your card, UPI or netbanking details for an earnest money deposit are entered on our payment provider's own screen and never reach GoldLelam's servers.

4Retention

Account data is kept while your account exists. KYC documents and bid records are kept for as long as the bank you dealt with, or Indian financial and tax law, requires — which is longer than the account itself, and is why deleting your account does not delete an auction's bid or deposit records. See the account deletion page for the full list of what is and isn't removed.

5Your rights under the DPDP Act, 2023

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you.
• Ask us to correct or complete inaccurate or incomplete personal data.
• Ask us to erase personal data that is no longer needed for the purpose it was collected — see the account deletion page.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Withdraw consent at any time, as easily as you gave it — where we rely on consent as the lawful basis.
• Register a grievance with our Grievance Officer (below), and, if unresolved, with the Data Protection Board of India.

We process your data to provide the service you asked for — browsing, registering, and bidding in an auction — and, for KYC and deposit records, to meet obligations under Indian financial and tax law. Consent is given when you create an account and may be withdrawn by deleting it, subject to records we are required to keep regardless.

6Security

A bidder can only reach records belonging to them. Sign-in tokens are held in the device keystore or keychain, never in ordinary app storage.

7Grievance Officer

Under the DPDP Act, 2023, our Grievance Officer for GoldLelam is:

<<<GRIEVANCE OFFICER NAME>>> · <<<GRIEVANCE OFFICER EMAIL>>> · <<<GRIEVANCE OFFICER PHONE>>>

Full details, including response timelines, are on the grievance page.

8Changes to this policy

We'll update the date at the top of this page when this policy changes, and post the update here before it takes effect.

9Contact

Questions about this policy: info@calecutech.com.