1. Who We Are
This Privacy Policy explains how Wingies, operated by Pranayan Metiya (an individual, operating as "Wingies", "we", "us"), collects and processes personal data when you use wingies.app (the "Platform"). For purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Wingies is the Data Fiduciary; you are the Data Principal.
2. Data We Collect
| Category | Examples | Source |
|---|---|---|
| Identity | Email address, name | You (signup, onboarding) |
| Contact | WhatsApp number | You (onboarding) |
| Listing content | Title, description, area, lat/lng, costs, photos, move-in dates, flatmate preferences | You (listing post) |
| Activity | Contact requests, approvals, credit ledger entries | Generated by your use |
| Technical | IP address, browser, device, session cookies | Automatic, on each visit |
| Anonymous analytics | Page views, referrer, device type, country (no IP retained, no cookies, no PII) | Vercel Web Analytics |
We do not collect: government IDs, financial account details, biometric data, precise device location, social-graph data, or children's data.
3. How We Use Your Data
We process your data only for these purposes:
- authenticate you and operate your account;
- display your listing to other Users;
- reveal your contact details (WhatsApp, email, name, exact location) to a Seeker only after you, the Lister, explicitly approve their contact request;
- send you transactional emails relating to your account, listings, and contact requests;
- detect and prevent fraud, abuse, and violation of our Terms;
- comply with legal obligations.
We do not sell your data, share it for third-party advertising, or use it to train AI/ML models.
4. Legal Basis (DPDP Act)
We process your data on the basis of your consent, given when you accept these terms at signup. Where processing is necessary for performance of our service or compliance with law (e.g. retaining transaction records for tax purposes), the corresponding statutory basis applies.
5. Who We Share Data With
- Other Users: a Lister's name, WhatsApp number, email, and exact location are shared with a Seeker only after the Lister approves that specific Seeker's contact request. No data is shared with unauthorised third parties.
- Service Providers (Data Processors): we use a small number of vetted third parties to operate the Platform:
- Supabase (database, authentication, file storage) — primary region: Mumbai, India (ap-south-1).
- Vercel (web hosting) — global edge network, headquartered in the United States.
- Resend (transactional email delivery) — headquartered in the United States.
- Cloudflare (DNS, email forwarding) — headquartered in the United States.
- Vercel Web Analytics (anonymous, aggregated page-view metrics) — see Vercel Analytics Privacy. No cookies, no IP retention, no PII.
- Government and law-enforcement agencies: where required by valid legal process under Indian law.
6. Cross-border Transfers
Some of our service providers process data outside India (United States). India does not currently restrict transfers to these jurisdictions under §16 of the DPDP Act, and we apply contractual safeguards with each processor. We will update this policy if the Government notifies any restriction.
7. Retention
- Account data: retained while your account is active and for 6 months after deletion, for fraud prevention and legal compliance.
- Listing data: retained while live and for 12 months after expiry / removal.
- Contact-request records: retained for 24 months for dispute resolution.
- Transactional email logs: retained for 12 months.
Backups containing residual personal data may persist for up to 30 days beyond these periods before being overwritten.
8. Your Rights (DPDP Act §11–§14)
You have the right to:
- access a summary of your personal data we hold and the processing activities;
- request correction or update of inaccurate data;
- request erasure of your data, subject to legal-retention requirements;
- nominate a person to exercise your rights in the event of your incapacity or death;
- withdraw consent at any time, with future effect;
- file a grievance with us (see §11 below) and, if unresolved, with the Data Protection Board of India.
To exercise these rights, email privacy@wingies.app from the email address registered on your account. We will respond within 30 days.
9. Cookies & Similar Technologies
We use first-party session cookies provided by Supabase Auth to keep you signed in. We do not use third-party tracking cookies, advertising cookies, or web beacons.
10. Children
The Platform is intended only for users aged 18 and above. We do not knowingly collect data from anyone under 18. If we learn we have collected such data, we will delete it promptly.
11. Grievance Officer & Data Protection Contact
As required by Rule 3(2)(a) of the IT (Intermediary Guidelines) Rules, 2021 and §10(1) of the DPDP Act:
Grievance Officer / Data Protection Contact
Name: Pranayan Metiya
Email: grievance@wingies.app
Physical address: available on written request via the email above.
We will acknowledge any grievance within 24 hours and resolve it within 15 days.
12. Data Breach
In the event of a personal-data breach, we will notify the Data Protection Board of India and affected Users without undue delay, as required under §8(6) of the DPDP Act.
13. Security
We use standard security practices including encryption in transit (HTTPS), authenticated email links (no passwords stored), database row-level security, and access controls. No system is perfectly secure; you are responsible for safeguarding your own email account.
14. Changes to This Policy
We may update this policy from time to time. Material changes will be notified via email or a prominent notice on the Platform. Continued use after the effective date constitutes acceptance of the revised policy.
15. Contact
Privacy queries: privacy@wingies.app
Grievances: grievance@wingies.app
General support: support@wingies.app