Policy
Privacy Policy
Last updated · Quiro Tech Solutions, Chennai
What is live today. You can use the website or mobile app to search for a record, verify your mobile number with a one-time code, and buy and download a record. When you search, the location and record identifiers needed to find the document are sent to the record service; analytics and error-monitoring vendors receive only the minimised data described below. A record is fetched and shown to you before any charge, and the server decides price, entitlement and what you may do next.
This policy explains what we collect, why, how long we keep it, and who else sees it. It is written to be checkable against what the service actually does.
1 Which law governs this
India's Digital Personal Data Protection Act 2023 entered phased commencement on 13 November 2025. Its definitions, Data Protection Board and certain institutional provisions are in force; the principal processing, notice, consent and data-principal-rights provisions are scheduled for 13 May 2027.
Until that later phase commences, section 43A of the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 continue to govern the processing described here. We will update this policy when the next phase takes effect.
2 What we collect
| What | Why | Where it goes |
|---|---|---|
| Your IP address | Rate limiting only, so one source cannot flood feedback and Maps-link requests | For Maps-link requests, a separate rate-limit ledger in Cloudflare D1. For feedback, a counter in the record service's memory. Neither is stored alongside your feedback or reply contact details |
| Your feedback message, page and reply contact details, with a signed-in account reference and masked number when available | To read your feedback and reply. Reply contact details can be supplied with the submission or attached from your signed-in session, including your mobile number | The record service's database in Mumbai, with a copy sent to the team by email |
| Your mobile number | To sign you in, show you your records, and issue the invoice when you buy | The record service. It keeps an HMAC for lookup, a masked display value and the encrypted full mobile number while your account is active. If you erase the account, the active-account copy is removed; the encrypted number remains only on the statutory tax invoice for the period the law requires |
| What you searched for | The district, taluk, village and survey number, so the record can be fetched | The record service, and the government portal it is fetched from |
| The record you bought, and the government data behind it | It is the thing you paid for, and the evidence of what the register said | Cloudflare R2, referenced by the record service |
| Your prepaid balance: the money you add, what you spend it on, and any refund you ask for | To hold your money, pay for records from it, refund it, and keep the accounts the law requires | The record service keeps the amounts and dates, the Razorpay payment and refund references, whether you added money on the website or in the app, and any reason our team records when it reviews a refund or corrects your balance. These records are tied to your account rather than written with your number |
| Your sign-in session | To keep you signed in without asking for a code every time | The record service keeps a hashed token, a hashed IP, a shortened browser or app description and your masked number. The mobile app keeps its sign-in credentials in secure device storage; they contain no phone or parcel value |
| How you use View Patta | To understand page visits and whether the record-search and purchase flow works | Production analytics only, using the limited website and mobile events described below |
| Your notification token | To tell your phone when a record is ready so you do not have to keep the app open | The record service and notification providers, only after notification permission is granted and you are signed in |
| Your phone's location, only when you tap the locate button in the Survey Number Finder | To find the survey number of the land you are on | The record service, which uses it to answer and does not keep it. The app asks for location first, and only while you are using it |
No name, email address, address or password is required for phone-OTP sign-in. Signing in is a one-time code to your mobile number — there is no password to choose or lose. Adding money to a prepaid balance needs none of them either. Feedback may include reply contact details as described above.
A record you buy is a copy of a public government register, so it contains the details the register holds about that parcel and its owners. Those may be someone other than you. We do not add to it, and we do not use it for anything but delivering your copy.
The feedback form also carries a hidden field that real people never fill in. If it arrives filled, the submission is rejected as automated. Its contents are never stored — it exists only to say no.
3 What we do not do
- Limited analytics. Production website pages use Google Analytics and PostHog, and the production mobile app uses PostHog. We send limited events to understand visits and whether the record-search and purchase flow works; events do not include phone numbers, record identifiers, owner names or free text. PostHog works out an approximate location, such as your city, from the connection.
- Page counting by our host. Cloudflare Web Analytics is added by our host rather than shipped in our code, so it is not covered by the line above. It counts page views and how quickly pages load. It sets no cookie on this site and cannot follow you to other sites.
- Error monitoring. Staging and production use Sentry for sanitised technical diagnostics from the website and mobile app. Reports do not include phone numbers, record identifiers, owner names or free text. Reports carry your approximate location — country, state and city, worked out from the connection, or as Cloudflare resolves it for reports from our server — but never your IP address.
- Maps drawn by Google. The Sub-Registrar Office Finder shows a Google map of the office you choose. Each Sub-Registrar Office page shows a map of its office, only after you tap Show map. Once a map loads, Google receives the office location and your IP address, but nothing you typed. The Survey Number Finder's map also comes from Google, which receives the area you are viewing and any place you search for.
- Our own fonts. Our typefaces are served from our own domain, so none of our own font requests reach another company. A Google map, where one loads, fetches Google's fonts from Google.
- No tracking cookies. See the cookies section below for what does and does not get set.
- No selling or sharing for marketing. We do not sell personal information, and we do not pass it to anyone for their own marketing.
5 How long we keep it
| What | How long | How that happens |
|---|---|---|
| IP rate-limit records | Entries older than seven days become eligible for cleanup | The Maps-link endpoint occasionally deletes older entries on later requests. There is no timed deletion job, so entries can remain longer when cleanup has not run. The feedback counter is kept only in memory and expires after an hour |
| Your feedback and reply contact details | Kept until removed by the team; there is no automatic deletion schedule | Write to privacy@viewpatta.com to ask us to remove your feedback and its reply contact details |
| A record you bought | 180 days from purchase | Your access closes and the document is deleted by a nightly job |
| The government data your record was built from | 180 days from purchase | Deleted by the same nightly job |
| Your order and its invoice | For the statutory GST retention period | The order, payment evidence and statutory tax invoice are retained. The invoice keeps the encrypted full mobile number used for the purchase even if you later delete your account |
| Your prepaid balance history | Kept with no deletion date, including after you delete your account | Money held for you has to be accounted for, so top-ups, spends, refunds and lapses are never edited or deleted. After you delete your account they stay tied to an internal reference, not to your number. A tax invoice for a refund fee is kept like any invoice, with the encrypted full mobile number when it was issued while your account was active |
| Your sign-in session | 30 days after you last use it, and at most 180 days from signing in | Using the site pushes the first window out again; the second is fixed at sign-in and nothing extends it. Expires on its own; signing out ends it immediately |
If a payment dispute is raised on an order, the record and the data behind it are both kept until the dispute closes, however old they are — they are the evidence of what the register said when you bought it.
The waitlist is closed. We deleted its existing signup entries on 1 October 2026 after sending the one-time launch update. Deleted entries may remain temporarily in Cloudflare’s database recovery history until its recovery window ends; we do not keep a separate waitlist archive.
6 Who else sees it
| Who | What they see | Status |
|---|---|---|
| Cloudflare | Hosts the site and the database, so it necessarily handles every request, including IP addresses | In use today |
| Cloudflare Turnstile | Signals from your browser at sign-in, to tell a person from a bot. Never your phone number, and never what you searched for | At sign-in only |
| Cloudflare Web Analytics | Page views and how quickly pages load, added by our host rather than by our code. No cookie, and nothing that identifies you | In use today |
| Google Analytics / Tag Manager | Production page and funnel events without property identifiers or free text | Production only |
| PostHog | Limited production website and mobile product events without phone, record or owner details, and an approximate location worked out from the connection | Production only |
| Sentry | Sanitised website and mobile app diagnostics, with approximate location but without IP address, phone, record or owner details | Staging and production |
| Google Maps | For an office map, the office location and nothing you typed. For the Survey Number Finder's map, the area you are viewing and any place you search for. Either way, your IP address and browser details, as with any page load. If you are signed in to Google, your browser may also send Google's own cookies. In the mobile app, Google's map software also sends Google diagnostic and usage information about the map | When a map loads |
| Razorpay | Payment information and the mobile number needed to process a payment. Card, UPI and bank credentials go directly to Razorpay; we receive only payment status and a reference. When you add money, the payment order also carries an internal reference to your account and to that top-up, and a refund of unspent balance is sent to Razorpay as a refund of the original payment. Razorpay's checkout also records details about your device and how you use it, under Razorpay's own policy | When you choose to pay or add money, and when a refund is paid |
| Expo Push Service, then Firebase Cloud Messaging on Android or Apple Push Notification service on iPhone | Notification delivery for a generic record-ready message after permission is granted and you are signed in. Once a phone is registered, the app's notification software keeps Expo's copy of its device token current, with no account details, until the app is deleted | Only if notification permission is granted and you are signed in |
| 2Factor (SMS) | Your number, to deliver your one-time sign-in code | In use today |
| Tamil Nadu government portals | The location and record you ask for, so it can be fetched. Never your phone number | In use today |
We will also disclose information where the law requires it, and we will tell you when we are permitted to.
7 How it is protected
The website, mobile app and record service use HTTPS. Maps-link rate-limit records sit in Cloudflare's managed database. Feedback, reply contact details, purchase data and prepaid balance data sit in the record service's database, reachable only over an authenticated tunnel and not exposed directly to the internet. Access is limited to the people who need it. Our team can see a buyer's balance, its history and refund requests, to review refunds and correct mistakes; each correction and refund decision is logged with who made it. In the record service, the full mobile number is encrypted; lookup uses an HMAC and ordinary screens use a masked value. Account erasure removes the active-account copy, subject to the encrypted number retained with the statutory invoice for the period the law requires.
No system is beyond compromise. If a breach affects your information we will tell you what happened, what it touched and what to do, rather than describing it as an incident and moving on.
8 What you can ask us to do
- See what we hold. You can ask about your feedback and reply contact details, phone-OTP account, orders, invoices, prepaid balance and sign-in sessions.
- Correct it. Tell us the right value and we will change it.
- Delete it. Write to privacy@viewpatta.com to ask us to remove feedback and reply contact details. Deleting your phone-OTP account rotates its lookup key, clears the active mobile number, ends every session, removes notification registrations, and deletes any record and government data still held rather than waiting out the windows above. If your prepaid balance still holds money, we ask you to confirm first, and the unused balance then lapses rather than being refunded; see the refunds page. If you delete your account, a report you paid for that had not reached you is cancelled and the payment is not refunded.
- What survives, and why. The order, payment evidence and statutory tax invoice remain for the period the law requires. The invoice keeps the encrypted full mobile number used for the purchase; it is not used to restore the deleted account or give access to the old records. Your prepaid balance history also remains, tied to an internal reference rather than your number.
- Withdraw consent. Ask us to delete, and that is how.
In the app, this is Account → Delete my data. It sends a code to your number, and deleting happens as soon as you enter it.
Otherwise — on the web, or if you have already removed the app — use our account deletion page or write to privacy@viewpatta.com. Ask from the number you signed up with, or tell us the number, so we can find the right record. We aim to respond within 30 days.
9 Complaints
Privacy complaints go to privacy@viewpatta.com; anything else to support@viewpatta.com. We acknowledge within 48 hours and aim to resolve within one month.
10 Children
The service is for adults. We do not knowingly collect information from anyone under 18. If you believe a child's number has been submitted, write to privacy@viewpatta.com and we will remove it.
11 Where the data sits
The site runs on Cloudflare's global network, so a request may be handled by whichever location is nearest you and data may be processed outside India in the course of that. Feedback, reply contact details and IP rate-limit records are stored in Cloudflare D1. The record service — which holds your orders, invoices, prepaid balance and sessions — runs in Mumbai, India. The documents themselves are stored in Cloudflare R2. The mobile app's secure credentials, private caches and any file you save remain on your device. We do not choose to move your information abroad for any other purpose.
12 Changes to this policy
We will update this when what we do changes — and specifically when the next phase of the DPDP Act and Rules takes effect. The date at the top tells you when it last changed.
13 Contact
Quiro Tech Solutions, 19, Sri Chakra 1st Cross Street, Sri Padmavathi Nagar, Iyyappanthangal, Chennai 600056, Tamil Nadu, India. Privacy: privacy@viewpatta.com. Everything else: support@viewpatta.com. Phone and address are also on the contact page.