Privacy Policy

Effective Date: 30 May 2026 | Last Updated: 30 May 2026
Also read: Terms of Service

KhojKaro.in (“Platform,” “we,” “us,” “our”) is operated by KhojKaro, Siliguri, West Bengal, India. We provide job placement assistance, rental/PG discovery, business lead generation, and local service matchmaking to individuals (B2C) and businesses (B2B) across North Bengal.

This Privacy Policy is a legally binding document under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (“DPDPA”). By accessing or using our services through any channel (website, WhatsApp, Facebook, Instagram, or any other medium), you unconditionally agree to this Policy. If you do not agree, you must immediately cease using our services.

1. Definitions

• “User” — any individual accessing our Platform or services (job seeker, room seeker, service seeker).
• “Business Client” — any entity (employer, landlord, service provider) using our lead generation or listing services.
• “Lead Data” — personal information of Users shared with Business Clients for the purpose of a specific match.
• “Services” — all services provided by KhojKaro through any channel.
• “Personal Data” — has the meaning assigned under DPDPA 2023.

2. Information We Collect

2.1 From Individual Users (B2C)

Data Type	Examples	Collection Method
Identity Data	Full name, age, gender	WhatsApp messages, forms
Contact Data	Phone/WhatsApp number, email	Direct messaging
Qualification Data	Education, skills, work experience	User-provided via WhatsApp
Location Data	City, area, preferred locality	User-provided
Preference Data	Job type, salary range, room budget, area preference	Conversation
Device/Analytics	IP address, browser, pages visited, referral source	Automatic (cookies, analytics)

2.2 From Businesses (B2B)

Data Type	Examples	Collection Method
Business Identity	Business name, owner name, GSTIN, Udyam registration	Onboarding
Contact Data	Business phone, WhatsApp, email, address	Direct communication
Listing Data	Job descriptions, vacancies, room/PG details, pricing	Business-provided
Transaction Data	Lead purchases, payments, commission records	Platform records
Verification Data	Business documents, premises photos, references	Verification process

2.3 Automatically Collected

• Page views, clicks, session data via first-party analytics (Supabase)
• Search queries that led you to our site
• Device type, OS, browser version
• City-level geolocation (from IP address)

3. Purpose & Legal Basis

Purpose	Legal Basis (DPDPA)
Match Users with jobs/rooms/services	Consent + Legitimate Interest
Share Lead Data with Business Clients	Explicit Consent
Send relevant opportunities via WhatsApp	Consent
Process B2B payments/commissions	Contractual Necessity
Fraud detection and platform safety	Legitimate Interest
Legal compliance (tax, regulatory)	Legal Obligation
Analytics and service improvement	Legitimate Interest (anonymized)
Enforce Terms of Service	Legitimate Interest

4. Data Sharing

We do NOT sell personal data. Sharing occurs only as follows:

Recipient	Data Shared	Purpose	Restriction
Business Clients	User name, phone, qualifications	Job/room match initiated by User	Single-purpose use only
Users	Business name, location, listing details	Display verified opportunities	Public listing data only
Infrastructure	Technical data	Platform operation	Bound by their DPAs
Legal Authorities	As required by law	Court orders, fraud	Valid legal process only

5. Data Retention

Category	Period	Justification
Active User profiles	Until deletion request or 2 years of inactivity	Service delivery
Business Client accounts	Relationship duration + 3 years	Contractual + legal
WhatsApp logs	12 months from last interaction	Dispute resolution
Transaction/payment records	8 years	Income Tax Act compliance
Analytics data	Indefinite (anonymized only)	Market research
Verification documents	Listing duration + 2 years	Fraud prevention

Upon expiry of retention period, data is permanently deleted or irreversibly anonymized within 90 days.

6. Data Security

• HTTPS/TLS encryption on all web traffic (Cloudflare)
• Database access controls with Row Level Security (Supabase)
• No storage of payment card data on our servers
• Access restricted to authorized personnel only
• Periodic security reviews and access audits
• Data minimization — we collect only what is strictly necessary

Breach Notification: In the event of a data breach, we will notify the Data Protection Board of India and affected individuals within 72 hours, as required by DPDPA 2023.

7. Your Rights (DPDPA 2023)

• Right to Access: Obtain confirmation and a copy of your data
• Right to Correction: Rectify inaccurate or incomplete data
• Right to Erasure: Request deletion (subject to legal retention)
• Right to Withdraw Consent: At any time, without affecting prior processing
• Right to Grievance Redressal: Complain to our Grievance Officer or the Data Protection Board
• Right to Nominate: Designate a nominee for rights in case of death/incapacity

How to exercise: WhatsApp +91 8293037387 or email hello@khojkaro.in with subject “Privacy Request.” Response within 72 hours, action within 30 days.

Note: If you request erasure of data already shared with a Business Client, we will instruct them to delete it. We cannot guarantee third-party compliance and shall not be liable for their actions post-transfer.

8. Cookies & Tracking

• Essential: Language preference, session state (cannot be disabled)
• Analytics: First-party only via Supabase (no Google Analytics, no Facebook Pixel)
• Advertising: NONE. We do not use any third-party ad trackers.

9. Communication Consent

By providing your WhatsApp number and initiating conversation, you consent to receive: matching notifications, follow-ups, and platform updates. Opt out by messaging “STOP” — processed within 24 hours.

10. Children’s Privacy

Services are for individuals 18+. We do not knowingly collect data from minors. If discovered, data is deleted within 48 hours.

11. Cross-Border Transfer

Data is primarily processed in India. Infrastructure providers may process data outside India, subject to DPDPA 2023 Section 16 safeguards.

12. B2B Specific Provisions

• Business listing data may be publicly displayed
• Lead Data under strict single-purpose license (see Section 4)
• Business Clients are independent controllers for post-introduction data
• Clients must maintain own DPDPA compliance
• We reserve the right to audit compliance

13. Limitation of Liability

14. Indemnification

You agree to indemnify and hold harmless KhojKaro, its operators, employees, and agents from all claims, damages, losses, and expenses (including legal fees) arising from: your violation of this Policy or Terms, misuse of data received through us, third-party claims from your use, or inaccurate information you provided.

15. Grievance Officer

Pursuant to IT Act 2000 Rule 5(9) and DPDPA 2023:

Name: Sayak Dutta
Email: hello@khojkaro.in
WhatsApp: +91 8293037387
Address: Siliguri, West Bengal 734001, India
Response: 48 hours acknowledgment, 30 days resolution

16. Amendments

We may modify this Policy at any time. Material changes notified 7 days in advance. Continued use constitutes acceptance. If you disagree, stop using our services and request deletion.

17. Severability & Survival

If any provision is invalid, remaining provisions continue. Sections 4, 13, 14, and 15 survive termination.

18. Governing Law & Dispute Resolution

Governed by laws of India. Disputes: mediation first, then exclusive jurisdiction of courts in Siliguri, West Bengal, India.

19. Contact

• WhatsApp: +91 8293037387
• Email: hello@khojkaro.in
• Web: https://khojkaro.in