Who we are and how to reach us
1.1 Chartermont Private Limited, a private limited company incorporated under the Companies Act, 2013, address KIITNEST, Campus 15-B, KIIT, Bhubaneswar, Odisha 751024.
1.2 Grievance Officer and privacy contact: Asmit Tripathy, Grievance Officer. Email contact@bhoomiscan.in. Form: https://www.bhoomiscan.in/grievance. This person answers questions about how we process Personal Data, as required by section 8(9) of the DPDP Act.
Our role depends on whose data it is
| Whose data | Example | Our role | Who decides why it is processed |
|---|---|---|---|
| (a) Your own account data | Your name, phone, email, payments, use of the Service | Data Fiduciary | We do |
| (b) Other people's data in Documents a Professional User uploads | Sellers, buyers, witnesses and heirs named in a deed an advocate, bank, NBFC or developer uploads for its client | Data Processor for that Professional User | The Professional User is the Data Fiduciary. We process only on its instructions, under the Data Processing Addendum (https://www.bhoomiscan.in/dpa) |
| (c) Documents an individual sends us for Assisted Verification | A buyer sends us the EC and RoR of land they want to buy | Data Fiduciary | We do, for the single purpose of that verification |
If you are named in a Document uploaded by a Professional User and want to exercise your rights, please contact that User. You may also write to us; we will pass your request on and help them answer it.
What we collect
3.1 Account data: name, mobile number, email, organisation, city and district, Bar Council enrolment number and year (if you give them), notification choices, and a record of the policies and consents you accepted (version, time, IP address and browser).
3.2 Documents you upload or send: ECs, RoRs (khatiyans), sale deeds and other land documents, and the text we read from them by OCR. These usually contain other people's names, guardian names, ages, addresses and land details. Deeds sometimes print the Aadhaar number or PAN of the parties or witnesses. We record those exactly as printed, because the advocate needs them to match the parties against their identity documents. We do not use them for any other purpose.
3.3 Searches you run: names, guardian names, plot, khata and village details you search, and the results.
3.4 Requests: what you write to us through enquiry, support, EC request and grievance forms, and on WhatsApp, including photos you send.
3.5 Payments: order and payment references, amounts and invoices. Card and bank details are collected by Razorpay, not by us.
3.6 Technical data: IP address, device and browser details, pages visited, error logs, and, only if you allow analytics cookies, analytics data (see the Cookie Policy).
3.7 What we do not collect from you: we do not ask for or keep your own Aadhaar, PAN or other KYC documents. We are not a bank, an NBFC or an RBI-regulated entity, and KYC rules do not apply to our Service.
Why we use it, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Create and run your Account, sign you in | Account data | Your consent (DPDP Act s.6), given at sign-up |
| Read your Documents, search Public Records and courts, prepare Reports | Documents, searches | Your consent; for case (b) in section 2, the Professional User's instructions |
| Take payments, issue invoices, keep accounts | Payment data | Your consent, and our legal duties under tax and company law (s.7) |
| Answer requests and grievances | Requests | Your consent, and the duty to handle grievances (s.8(10)) |
| Keep the Service secure, prevent fraud and abuse, keep logs | Technical data | Our legal duty to keep reasonable security safeguards (s.8(5)) and the DPDP Rules' log-keeping duty |
| Analytics | Analytics data | Separate, optional consent, off until you allow it |
| Improve our models with de-identified data | De-identified Reports | Separate, optional consent, off until you switch it on |
4.1 Public Records. Records published by Government portals, such as RoRs on Bhulekh and court records on eCourts, are made public under law. The DPDP Act does not apply to Personal Data that a person under a legal duty has made publicly available (s.3(c)(ii)) [CHECK with advocate how far this covers each source]. We still handle such data with the same care as everything else.
4.2 Consent you give is free, specific, informed and unambiguous. You give it by ticking a box that is not ticked in advance. You can withdraw it at any time, as easily as you gave it (section 10). Withdrawal does not affect processing already done, but we may then be unable to provide the part of the Service that needs it.
How AI is used
5.1 We use automated systems, including large language models, to read Documents and draft Reports. Today these are Google's Gemini models on Google Cloud Vertex AI and Google Document AI for OCR.
5.2 Under the Google Cloud terms we use, Google does not use our data to train its models. We do not use your data to train models unless you switch on model improvement, and then only in de-identified form.
5.3 AI output can be wrong. Every Report shows its sources. A Professional Title Opinion is always written and signed by an Empanelled Advocate, never by an AI system. See the Responsible AI Policy (https://www.bhoomiscan.in/responsible-ai).
Transfers outside India
7.1 Some Sub-processors process data outside India, mainly in the United States (marked in the table above). Section 16 of the DPDP Act allows this unless the Central Government restricts transfer to a country. No such restriction applies to these countries as at the date of this policy [CHECK before go-live]. If one is imposed, we will stop or move that processing.
7.2 Our main database is in India (Mumbai).
How long we keep it
| Data | How long we keep it | What happens then |
|---|---|---|
| Account data (name, phone, email, profile) | While your account is open, then 3 years after closure | Deleted |
| Uploaded document files and their OCR text | 90 days from upload | Deleted. The finished report, including the facts it records, stays in your account as account data |
| Invoices and payment records | 8 years from the end of the financial year | Deleted |
| Security, access and error logs | 1 year | Deleted |
| Support tickets, enquiries and grievances | 1 year after closure (grievance register: 3 years) | Deleted |
| WhatsApp messages and attachments you send us | 90 days | Deleted |
| Record of your consents and policy acceptances | While your account is open, then 3 years | Deleted |
| Analytics cookies (only if you allow them) | Up to 13 months | Expire in your browser |
| Identity documents (Aadhaar, PAN, KYC) of our own users | We do not collect them | Not applicable |
8.1 We keep data longer only where a law requires it, or for an open dispute, a grievance or a legal claim, and only for as long as that lasts. When a period ends, an automated job deletes the data and records that it did so.
8.2 If you withdraw consent or close your Account, we delete your data on the same schedule, except what a law requires us to keep.
Security
9.1 We protect Personal Data with reasonable security safeguards (DPDP Act s.8(5)), including encryption in transit and at rest, access rules on every database table, private storage, short-lived download links, and a log of who opened each document. More detail is at https://www.bhoomiscan.in/security.
9.2 Personal Data Breach. If a breach affects you, we tell you without delay what happened, what it may mean for you, what we are doing, and what you can do. We report it to the Data Protection Board of India without delay, with a detailed report within 72 hours of becoming aware of it, as the DPDP Rules require.
Your rights
10.1 Under the DPDP Act you may:
- access a summary of your Personal Data and how it is processed, and the people we shared it with (s.11);
- correct, complete, update or erase it (s.12);
- withdraw consent at any time (s.6(4));
- have a grievance resolved (s.13);
- nominate a person to exercise your rights if you die or become unable to (s.14).
10.2 Use the Data rights page in your account settings, or write to contact@bhoomiscan.in. We acknowledge every request within 24 hours and complete it within 15 days. If we cannot do what you ask, for example because a law requires us to keep a record, we tell you why.
10.3 If you are not satisfied with our answer, you may complain to the Data Protection Board of India. The Board expects you to use our grievance process first (s.13(3)).
10.4 Please give us true information and do not file false or frivolous complaints (s.15).
Children and minors in land records
11.1 The Service is for adults. We do not knowingly open an Account for anyone under 18. If we learn that we have, we close it and delete its data.
11.2 Land records often name minors as co-owners, heirs or legal representatives. We process such data only as it appears in the Documents and Public Records of a matter, only to verify title, and never to track, profile or advertise to a child (DPDP Act s.9(3)). Where we act as Data Fiduciary for such data, we rely on the basis in section 4 and keep it to the minimum needed [CHECK with advocate whether verifiable parental consent under s.9(1) is required where we are the Fiduciary].
Changes to this policy
We will tell you about material changes by email or in the product at least 30 days before they apply, and ask for your consent again where the law requires it. Each version carries a number and date; earlier versions are available on request.