Policy
Privacy Policy
Last updated · Quiro Tech Solutions, Chennai
What is live today. You can use the website or mobile app to search for a record, verify your mobile number with a one-time code, and buy and download a record. When you search, the location and record identifiers needed to find the document are sent to the record service; analytics and error-monitoring vendors receive only the minimised data described below. A record is fetched and shown to you before any charge, and the server decides price, entitlement and what you may do next.
This policy explains what we collect, why, how long we keep it, and who else sees it. It is written to be checkable against what the service actually does.
1 Which law governs this
India's Digital Personal Data Protection Act 2023 entered phased commencement on 13 November 2025. Its definitions, Data Protection Board and certain institutional provisions are in force; the principal processing, notice, consent and data-principal-rights provisions are scheduled for 13 May 2027.
Until that later phase commences, section 43A of the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 continue to govern the processing described here. We will update this policy when the next phase takes effect.
2 What we collect
| What | Why | Where it goes |
|---|---|---|
| Your mobile number | To hold your place on the waitlist and, later, to verify a purchase | Cloudflare D1, normalised to +91XXXXXXXXXX |
| Your IP address | Rate limiting only, so one source cannot flood the form | Cloudflare D1, in a separate table, never stored alongside your number |
| How you arrived | utm tags in the link, the page you landed on, the referring site | Cloudflare D1, alongside your waitlist entry |
| Your mobile number, when you buy | To verify it is you, to show you your records, and to issue the invoice | The record service. It keeps an HMAC for lookup, a masked display value and the encrypted full mobile number while your account is active. If you erase the account, the active-account copy is removed; the encrypted number remains only on the statutory tax invoice for the period the law requires |
| What you searched for | The district, taluk, village and survey number, so the record can be fetched | The record service, and the government portal it is fetched from |
| The record you bought, and the government data behind it | It is the thing you paid for, and the evidence of what the register said | Cloudflare R2, referenced by the record service |
| Your sign-in session | To keep you signed in without asking for a code every time | The record service keeps a hashed token, a hashed IP, a shortened browser or app description and your masked number. The mobile app keeps its sign-in credentials in secure device storage; they contain no phone or parcel value |
| How you use View Patta | To understand page visits and whether the record-search and purchase flow works | Production analytics only, using the limited website and mobile events described below |
| Your notification token | To tell your phone when a record is ready so you do not have to keep the app open | The record service and notification providers, only after Android notification permission is granted and you are signed in |
We do not ask for your name, your email address, your address, or a password. Signing in is a one-time code to your mobile number — there is no password to choose or lose. The waitlist form has exactly one field you can see.
A record you buy is a copy of a public government register, so it contains the details the register holds about that parcel and its owners. Those may be someone other than you. We do not add to it, and we do not use it for anything but delivering your copy.
The form also carries a hidden field that real people never fill in. If it arrives filled, the submission is rejected as automated. Its contents are never stored — it exists only to say no.
3 What we do not do
- Limited analytics. Production website pages use Google Analytics and PostHog, and the production mobile app uses PostHog. We send limited events to understand visits and whether the record-search and purchase flow works; events do not include phone numbers, record identifiers, owner names or free text.
- Page counting by our host. Cloudflare Web Analytics is added by our host rather than shipped in our code, so it is not covered by the line above. It counts page views and how quickly pages load. It sets no cookie on this site and cannot follow you to other sites.
- Error monitoring. Staging and production use Sentry for sanitised technical diagnostics from the website and mobile app. Reports do not include phone numbers, record identifiers, owner names or free text. Reports from our server carry your approximate location — country, state and city, as Cloudflare resolves it — but never your IP address.
- No third-party fonts. Typefaces are served from our own domain, so no font request leaks your IP to another company.
- No tracking cookies. See the cookies section below for what does and does not get set.
- No selling or sharing for marketing. We do not sell personal information, and we do not pass it to anyone for their own marketing.
5 How long we keep it
| What | How long | How that happens |
|---|---|---|
| IP rate-limit records | At most 7 days | Deleted automatically by the same endpoint that writes them |
| Your waitlist entry | Until you ask us to remove it | Removed by hand when you write to us — there is no automatic deletion |
| A record you bought | 180 days from purchase | Your access closes and the document is deleted by a nightly job |
| The government data your record was built from | 180 days from purchase | Deleted by the same nightly job |
| Your order and its invoice | For the statutory GST retention period | The order, payment evidence and statutory tax invoice are retained. The invoice keeps the encrypted full mobile number used for the purchase even if you later delete your account |
| Your sign-in session | 30 days after you last use it, and at most 180 days from signing in | Using the site pushes the first window out again; the second is fixed at sign-in and nothing extends it. Expires on its own; signing out ends it immediately |
If a payment dispute is raised on an order, the record and the data behind it are both kept until the dispute closes, however old they are — they are the evidence of what the register said when you bought it.
Waitlist entries are not deleted automatically — being offered a place does not remove yours, and nothing in our system deletes them on a schedule. If you want yours gone, write to privacy@viewpatta.com and a person will remove it.
6 Who else sees it
| Who | What they see | Status |
|---|---|---|
| Cloudflare | Hosts the site and the database, so it necessarily handles every request, including IP addresses | In use today |
| Cloudflare Turnstile | Signals from your browser at sign-in, to tell a person from a bot. Never your phone number, and never what you searched for | At sign-in only |
| Cloudflare Web Analytics | Page views and how quickly pages load, added by our host rather than by our code. No cookie, and nothing that identifies you | In use today |
| Google Analytics / Tag Manager | Production page and funnel events without property identifiers or free text | Production only |
| PostHog | Limited production website and mobile product events without phone, record or owner details | Production only |
| Sentry | Sanitised website and mobile app diagnostics, with approximate location but without IP address, phone, record or owner details | Staging and production |
| Razorpay | Payment information and the mobile number needed to process a payment. Card, UPI and bank credentials go directly to Razorpay; we receive only payment status and a reference | When you choose to pay |
| Expo Push Service and Firebase Cloud Messaging | Notification delivery for a generic record-ready message after permission is granted and you are signed in | Only if Android notification permission is granted and you are signed in |
| 2Factor (SMS) | Your number, to deliver your one-time sign-in code | In use today |
| Tamil Nadu government portals | The location and record you ask for, so it can be fetched. Never your phone number | In use today |
We will also disclose information where the law requires it, and we will tell you when we are permitted to.
7 How it is protected
The website, mobile app and record service use HTTPS. Waitlist data sits in Cloudflare's managed database. Purchase data sits in the record service's database, reachable only over an authenticated tunnel and not exposed directly to the internet. Access is limited to the people who need it. The full mobile number is encrypted; lookup uses an HMAC and ordinary screens use a masked value. Account erasure removes the active-account copy, subject to the encrypted number retained with the statutory invoice for the period the law requires.
No system is beyond compromise. If a breach affects your information we will tell you what happened, what it touched and what to do, rather than describing it as an incident and moving on.
8 What you can ask us to do
- See what we hold. If you have only joined the waitlist, that is one phone number, a date, and how you arrived. If you have bought a record, it also includes your orders, your invoices and your sign-in sessions.
- Correct it. Tell us the right value and we will change it.
- Delete it. We will remove your waitlist entry. Deleting your phone-OTP account rotates its lookup key, clears the active mobile number, ends every session, removes notification registrations, and deletes any record and government data still held rather than waiting out the windows above.
- What survives, and why. The order, payment evidence and statutory tax invoice remain for the period the law requires. The invoice keeps the encrypted full mobile number used for the purchase; it is not used to restore the deleted account or give access to the old records.
- Withdraw consent. Ask us to delete, and that is how.
In the app, this is Account → Delete my data. It sends a code to your number, and deleting happens as soon as you enter it.
Otherwise — on the web, or if you have already removed the app — use our account deletion page or write to privacy@viewpatta.com. Ask from the number you signed up with, or tell us the number, so we can find the right record. We aim to respond within 30 days.
9 Complaints
Privacy complaints go to privacy@viewpatta.com; anything else to support@viewpatta.com. We acknowledge within 48 hours and aim to resolve within one month.
10 Children
The service is for adults. We do not knowingly collect information from anyone under 18. If you believe a child's number has been submitted, write to privacy@viewpatta.com and we will remove it.
11 Where the data sits
The site runs on Cloudflare's global network, so a request may be handled by whichever location is nearest you and data may be processed outside India in the course of that. The waitlist database is a Cloudflare D1 database. The record service — which holds your orders, invoices and sessions — runs in Mumbai, India. The documents themselves are stored in Cloudflare R2. The mobile app's secure credentials, private caches and any file you save remain on your device. We do not choose to move your information abroad for any other purpose.
12 Changes to this policy
We will update this when what we do changes — and specifically when the next phase of the DPDP Act and Rules takes effect. The date at the top tells you when it last changed.
13 Contact
Quiro Tech Solutions, 19, Sri Chakra 1st Cross Street, Sri Padmavathi Nagar, Iyyappanthangal, Chennai 600056, Tamil Nadu, India. Privacy: privacy@viewpatta.com. Everything else: support@viewpatta.com. Phone and address are also on the contact page.