Privacy Policy

HomyZone is a home-services marketplace operated by Yash Mehulbhai Mandaliya, 99/a, Harekrushnanagar society, Radhakrushna ni baju ma, 80 FT Road, Surendranagar, Gujarat, 363002, India (“HomyZone”, “we”, “us”). We connect customers who book fixed-price home services with independent professionals who carry them out, in Ahmedabad, Gujarat. For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

This policy applies to three things: the HomyZone app for customers, the HomyZone Partner app for professionals, and this website, homyzone.in. The website is a catalogue: it lets you browse services and prices and then sends you to the app. Bookings, payments and accounts exist only in the apps, so most of what follows is about them.

This policy is governed by the DPDP Act and the rules made under it, and by the Information Technology Act, 2000 and the rules under it — including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — to the extent they remain in force. It should be read with our customer terms and partner terms. For any request about your data, write to homyzone.support@gmail.com or use the grievance contact in section 11.

We collect only what running the platform needs. Most of it you give us directly; some is generated as you use the apps.

Online payments, professional subscription fees and refunds are processed by Razorpay Software Private Limited (“Razorpay”), an RBI-authorised payment aggregator. When you pay online, the payment screen is Razorpay’s: your card number, expiry, CVV, UPI ID and bank login are entered into and handled by Razorpay, never by HomyZone.

• We receive from Razorpay only what we need to run the booking: a payment identifier, the amount, the payment method type (for example “UPI” or “card”), its status, and the masked last digits of a card where Razorpay provides them.
• We do not store full card numbers, CVVs, UPI PINs, net-banking credentials or wallet passwords, and no such data passes through our servers.
• Razorpay processes your payment data as an independent entity under Razorpay’s privacy policy, and is PCI-DSS certified for the handling of card data.
• Refunds are issued through Razorpay to the original payment method. How and when they arrive is described in our Refund & Cancellation Policy.

The apps use two Firebase services, provided by Google LLC and its affiliates (“Google”): sign-in and push notifications. We do not use Firebase Analytics, Crashlytics or any Firebase database. Each service collects a little data of its own in order to work. Google processes it on our behalf under Firebase’s privacy and security notice and Google’s privacy policy.

We process personal data for the following purposes, and for no others without telling you first.

• To fulfil bookings. Creating your account, recording the booking, routing it to professionals who offer that exact job within range, sharing the address with the assigned professional, running the PINs, tracking arrival, and closing the job.
• To match professionals. Using a professional’s categories, chosen jobs, location, rating and availability to decide which offers they receive.
• To take payment and settle money. Processing online payments through Razorpay, recording cash bookings, calculating cancellation charges, cashback coins, commission, dues, wallets and payouts, and issuing refunds.
• To keep you informed. Push notifications, SMS and in-app messages about your bookings, payments, plan and account. These are service messages, not marketing.
• To support you. Answering questions through HomyBot and our team, and resolving disputes and refund requests, for which we look at the booking’s history, location records and any photos or notes attached to it.
• For safety and integrity. Verifying professionals, controlling when phone numbers are revealed, detecting no-shows, repeated cancellations, off-platform dealing, fraud and abuse of the OTP or payment flows, and suspending accounts where the terms allow.
• To improve the platform. Our own request logs and booking records, used to understand what works and fix what does not.
• To meet our legal obligations. Keeping tax and accounting records, responding to lawful requests from authorities, and enforcing our terms.
• Marketing, only with your consent. If we send offers or news about HomyZone, you can opt out at any time in the app or by writing to us, and we will stop.

Under the DPDP Act we process personal data either with your consent, given for a specific purpose, or for a legitimate use the Act recognises. When you create an account you tick a box to say you have read and agree to the terms and this policy — it is never ticked for you — and that is your consent to the processing described in sections 2 to 7 for the purpose of using the platform. We record which version you agreed to and when. If we make a material change — to charges, refunds, penalties or the data we collect — the app asks you to agree again before you continue. Consent is not required where you have voluntarily given us data to receive a service you asked for, or where the law requires us to process it.

You can withdraw consent at any time — by turning off a permission such as location or notifications on your phone, by opting out of marketing, or by asking us to delete your account. Withdrawing consent does not affect processing already carried out, and some features cannot work without the data they depend on: a booking cannot be delivered without an address, and an account cannot exist without a mobile number.

We do not sell personal data, and we do not share it with anyone for their own marketing. We share it only as follows.

• Account data is kept while your account is active. When you delete your account, or ask us to, we delete or anonymise your profile within 30 days, except as noted below.
• Booking, payment and payout records are kept for as long as Indian tax, company and accounting law requires (currently up to eight years from the end of the relevant financial year), and for as long as needed to resolve a dispute raised within the terms’ window or to enforce a claim.
• Live location is used in real time. A professional’s current position is held only while they have a live job; the retained record of a job is its timestamps and locations at the points the platform checks — acceptance, arrival, start, completion — not a continuous trail.
• Aadhaar data is kept while the professional’s account exists, so that one card cannot verify two accounts. A hand-sent card photo is deleted the moment it is approved or rejected.
• Dispute evidence — photos, notes, call records — is kept for the dispute window and then for as long as an open dispute needs it.
• Server request logs are kept only as long as needed for security, support and fixing faults.
• Suspension and abuse records may be kept after an account is closed, so that a person removed for fraud, safety complaints or off-platform dealing cannot simply re-register.

We take the reasonable security safeguards the DPDP Act requires, and we design the product so that the most sensitive moments in a job are protected by the mechanism itself, not only by policy.

• All traffic between the apps, this website and our servers is encrypted in transit (TLS), and data held in Firebase is encrypted at rest by Google.
• A professional's live position is stored only while they hold a live job, and only the current position — no history and no trail of where they have been.
• Login is by one-time password to your mobile number; there are no passwords to leak. Professionals' payout withdrawals are protected by a separate passkey that is rotated every 30 days and locked after repeated wrong attempts.
• Card, UPI and bank credentials never touch our systems — Razorpay holds them under PCI-DSS.
• Phone numbers are revealed between the two sides of a job only when the job needs it, numbers typed into chat before then are masked, and a job cannot start or close without the customer's PINs.
• The full Aadhaar number is never stored: a professional's Secure QR is verified against UIDAI's own published certificates on our server, and only the last 4 digits are kept.
• Identity documents and garage cards are kept in private storage, outside anything the web serves, and reach only the professional who uploaded them and authorised staff.
• Access to personal data inside HomyZone is limited to staff who need it for support, operations or safety, and is governed by confidentiality obligations.
• Every request to our backend is authenticated, and each account can reach only its own records.
• If a personal data breach affects you, we will notify you and the Data Protection Board of India in the manner and within the time the DPDP Act and its rules require.

No system is perfectly secure. Keep your phone locked, do not share OTPs or PINs with anyone other than the professional at your door, and tell us at once if you suspect your account has been misused.

As a Data Principal you have the following rights, which you can exercise through the app or by writing to the Grievance Officer in section 11. We will verify that a request comes from the account holder before acting on it.

If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner the DPDP Act and its rules provide. Nothing in this policy limits any other remedy available to you under Indian law.

In line with the DPDP Act, the Information Technology Act and the Consumer Protection (E-Commerce) Rules, 2020, we have appointed a Grievance Officer. Write to them for any request about your data, any complaint about this policy, or anything you believe we have got wrong.

We acknowledge every grievance within 48 hours and resolve it within 30 days of receipt. Please include the mobile number on your account and, if the concern is about a booking, the booking ID, so that we can find the right records quickly.

HomyZone is for adults. Our terms require every customer and professional to be 18 or older, and we do not knowingly collect personal data from anyone under 18. A person under 18 may not create an account; if a service is needed for a child or a teenager, a parent or guardian books it from their own account and is present for it.

Where the DPDP Act would require verifiable parental consent before processing a child's data, we will not process it without that consent. If you believe a minor has created an account, or that we hold a child's data without a guardian's consent, tell the Grievance Officer and we will delete it.

This website is a catalogue and does not track you across the web. At the date of this policy it sets one cookie of its own:

Our hosting provider keeps ordinary server logs — IP address, browser, pages requested, timestamps — for security and to keep the site running, and clears them on its standard schedule. We do not currently run third-party analytics or advertising trackers on the website. If we add web analytics in future, we will update this section first and, where the law requires it, ask for your consent before it runs. You can clear or block cookies in your browser at any time; the site will simply revert to the light theme.

The app-download buttons on this site point to Google Play, which applies its own privacy policy from the moment you land there.

Firebase data (your phone number for sign-in, and push-notification tokens) may be stored and processed on Google's servers in India or in other countries where Google operates. Razorpay stores payment data in India, as the Reserve Bank of India requires. Address lookups (section 7) are answered by OpenStreetMap servers in Europe. Where personal data leaves India, it is transferred only to countries the Central Government has not restricted under the DPDP Act, and only to providers that protect it under contract to at least the standard of this policy.

We may update this policy as the platform, the law or our providers change. The date at the top and bottom of this page is the date of the current version. For a material change we will tell you in the app or by notification before it takes effect; continuing to use HomyZone after that date means you accept the updated policy. Earlier versions are available on request.

Last updated: 30 October 2026.