Privacy Policy

Rechecko is jointly owned and operated by Social Titli (a digital marketing agency) and Aryan Sharma ("Rechecko", "we", "us"), Solus building, 1902, Hiranandani Estate, Thane, Maharashtra 400607. This policy explains how we handle personal data when you visit our website at rechecko.com or use the Rechecko web application (together, the "service"). Rechecko is lead and campaign management software for real-estate channel partners (brokers): it collects enquiries from property portals, websites and ad platforms into one register, and lets channel partners create and manage their ad campaigns on Meta, Google Ads and LinkedIn.

We act in two different roles, and this matters for your rights:

• For your account data (the channel partner and their team members using Rechecko), we are the Data Fiduciary / controller.
• For lead data (the prospective buyers whose enquiries a channel partner brings into Rechecko), the channel partner is the Data Fiduciary / controller and we process that data only on their instructions, as their Data Processor. If you are a prospective buyer, please contact the channel partner you enquired with first; we will assist them in responding to you.

We process personal data in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, as well as the Information Technology Act, 2000 and the rules made under it. In DPDP terms, you are a Data Principal, and this policy is our notice to you under Section 5 of the Act. See Your rights under the DPDP Act for what that means for you.

Account and organisation data

• Email address and password (stored only as a one-way bcrypt hash — we never see your password).
• Onboarding details: your organisation's name, type of firm, team size, how you heard about us, and similar information you choose to provide.
• Team members you invite, and the roles you assign them.

Lead data you bring into Rechecko

• Contact and enquiry details of prospective buyers — typically name, phone number, email, the project or listing they enquired about, answers to lead-form questions, and the source and campaign of the enquiry.
• Raw webhook deliveries from portals and websites, kept so failed deliveries can be replayed. These are deleted automatically after 30 days.

Connected platform data

• When you connect Meta, Google Ads or LinkedIn, we receive OAuth access tokens and the advertising data you authorise. Exactly what we access from each platform, and why, is set out in Data from Google, Meta and LinkedIn below.

Content you upload

• Project details and images, ad creatives, and CSV files you import.

Technical data

• Server logs such as IP address, browser type, request times and error information, used for security and troubleshooting.

• To provide the service: collecting, de-duplicating and displaying your leads, and creating and managing your campaigns.
• To authenticate you and keep your account and organisation secure.
• To provide support and send essential service messages (for example, security or policy notices).
• To detect, prevent and investigate abuse, fraud and security incidents.
• To comply with legal obligations.

Under the DPDP Act we process personal data only for a lawful purpose, on one of these grounds:

• Consent (Section 6) — when you create an account, accept an invitation, connect an ad platform or upload data, you consent to the processing described in this policy for those purposes. Your consent covers only these purposes, and you can withdraw it at any time.
• Certain legitimate uses (Section 7) — for example, when you voluntarily give us data for a specific purpose such as a support request, or where processing is needed to comply with law or a court order.

We collect only the personal data needed for these purposes, take reasonable steps to keep it accurate and complete, and stop using it once you withdraw consent or the purpose is served.

Lead data belongs to the channel partner. We process it only to provide the service to that channel partner. We do not sell lead data, do not use it to market to those individuals ourselves, and do not share it between different channel partners.

When a channel partner builds an advertising audience from their leads, email addresses and phone numbers are hashed (SHA-256) before they are sent to the ad platform.

Channel partners are responsible for having a lawful basis — such as the individual's consent — to collect each lead and to contact them, including compliance with TRAI's commercial communication regulations.

You choose whether to connect an advertising platform. When you do, you sign in on that platform and approve the permissions below; Rechecko then accesses your account only to perform the actions you request in Rechecko. We ask only for advertising permissions — we never access your personal profile, posts, messages, contacts, email, files or friends on any platform.

Google (Google Ads API)

• Permission requested: https://www.googleapis.com/auth/adwords ("See, edit, create and delete your Google Ads accounts and data").
• Data accessed: the Google Ads accounts you can access (customer IDs and names), campaigns, ad groups, ads, keywords, assets, budgets, targeting, performance metrics, and submissions to lead forms you run in Google Ads.
• How we use it: to let you choose an ad account, create, edit, pause and remove campaigns, ads and keywords from Rechecko, show campaign performance, and bring lead-form submissions into your lead register.

Meta (Facebook and Instagram)

• Permissions requested: ads_management, business_management, pages_show_list, pages_read_engagement, pages_manage_ads and leads_retrieval; instagram_basic only if you choose to run ads on your linked Instagram account.
• Data accessed: the business portfolios, ad accounts and Facebook Pages you manage (names and IDs), the Instagram account linked to your Page (if enabled), your campaigns, ad sets, ads, creatives, audiences and performance insights, and the lead forms on your Pages together with the leads submitted to them (such as the person's name, phone number, email and answers to your form questions).
• How we use it: to let you choose a Page and ad account, create and manage lead-generation campaigns and lead forms, show performance, build custom audiences from your own leads when you ask, and bring Lead Ads submissions into your lead register.

LinkedIn (LinkedIn Marketing API)

• Permissions requested: r_ads, rw_ads and r_ads_reporting; and r_marketing_leadgen_automation once lead-form access is enabled for Rechecko.
• Data accessed: the ad accounts you have access to, campaign groups, campaigns, creatives and ad performance reporting, and — with lead-form access — the responses submitted to your Lead Gen Forms.
• How we use it: to let you create and manage campaigns, show performance, and bring Lead Gen Form responses into your lead register.

How we store, protect and share this data

• Access tokens are encrypted at rest and are used only by our servers to call the platform on your behalf; they are never shown in the app or sent to your browser.
• Campaign data and leads synced from a platform are stored in your organisation's private workspace and are visible only to members of your organisation, according to the roles you assign.
• We do not sell this data, do not use it to show you advertising, do not use it to determine credit-worthiness or for lending, and do not use it to develop, improve or train generalised artificial-intelligence or machine-learning models.
• We share it only with the platform it came from (when you ask us to publish or update something), with the hosting providers that run Rechecko for us, if required by law, or as part of a merger or acquisition with the same protections. Our staff do not read it except with your permission, to investigate a security issue or abuse, or to comply with law.

Retention and deletion

• When you disconnect a platform on the Connections page, its access token is deleted immediately and Rechecko can no longer reach that account. You can also revoke access from the platform's own settings at any time.
• Campaigns, performance history and leads already synced stay in your account so your records remain complete, until you delete them, ask us to delete them, or close your account. We delete them within 30 days of a verified request — see Data Deletion.

Platform policies we follow

Rechecko's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our use of data from Meta follows the Meta Platform Terms, and our use of data from LinkedIn follows the LinkedIn API Terms of Use.

We do not sell personal data. We share it only with:

• Ad platforms you connect (Meta, Google, LinkedIn), when you instruct us to — for example, to publish a campaign or build an audience.
• Service providers who host and operate our infrastructure (cloud hosting, databases, file storage, email delivery), bound by confidentiality and data-protection obligations.
• Authorities, where required by law or a valid legal process.
• A successor, if our business is merged or acquired, subject to this policy.

• Account and organisation data: for as long as your account is active.
• Lead data: until the channel partner deletes it or closes their account.
• Raw inbound webhook deliveries: 30 days.
• After account closure, we delete or anonymise your data within 90 days, except where we must keep it longer by law (for example, invoices and tax records).
• As the DPDP Act requires, we erase personal data once you withdraw consent or once it is no longer needed for the purpose it was collected for, unless the law requires us to keep it.

We use encryption in transit (HTTPS), encryption at rest for platform access tokens, hashed passwords, role-based access control within each organisation, and separation of each organisation's data. No system is perfectly secure. If we become aware of a personal data breach, we will tell affected users without delay — what happened, its likely impact, what we are doing about it and what you can do — and report it to the Data Protection Board of India within 72 hours, as the DPDP Act and Rules require.

As a Data Principal under the DPDP Act, you have the right to:

• Access information (Section 11) — a summary of the personal data we process about you and the processing we do, and who we have shared it with.
• Correction and erasure (Section 12) — have inaccurate or incomplete data corrected, completed or updated, and have data erased when it is no longer needed.
• Withdraw consent (Section 6) — as easily as you gave it. Withdrawing doesn't affect processing already done, but we will stop and erase the data unless the law requires us to keep it. Some features (such as a connected ad platform) stop working without it.
• Grievance redressal (Section 13) — have your complaints handled by our Grievance Officer (see below).
• Nominate (Section 14) — name another person to exercise your rights if you die or become unable to do so.

To use any of these rights, write to [email protected] from your account's email address. We may need to verify your identity first, and we will respond within the timelines in the DPDP Rules — and in any case within 90 days. If your data came to Rechecko through a channel partner (for example, an enquiry you made about a property), that channel partner is the Data Fiduciary: please contact them first, and we will help them respond.

You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India. If you are not satisfied with how we handle a grievance, you may complain to the Data Protection Board of India, and appeal its decisions to the Telecom Disputes Settlement and Appellate Tribunal.

The DPDP Act also asks Data Principals not to give false information, impersonate someone else, or file frivolous complaints (Section 15).

Rechecko uses only the browser storage strictly needed to keep you signed in and remember interface preferences. We do not use advertising or cross-site tracking cookies. See our Cookie Policy.

Rechecko is a business service and is not intended for anyone under 18. In line with Section 9 of the DPDP Act, we do not knowingly process the personal data of children, and we do not track, behaviourally monitor or target advertising at children. If you believe a child has given us personal data, contact us and we will delete it.

Data may be processed on servers in India or other countries where our service providers operate. Any transfer outside India is made only as permitted under Section 16 of the DPDP Act, and never to a country the Government of India has restricted. Ad platforms you connect process data under their own terms and may do so outside India.

For any concern about how your personal data is handled, contact our Grievance Officer:

Grievance Officer
Rechecko — Social Titli and Aryan Sharma, Solus building, 1902, Hiranandani Estate, Thane, Maharashtra 400607
[email protected]

We will acknowledge your grievance within 24 hours and aim to resolve it within 15 days. If you are not satisfied, you may approach the Data Protection Board of India.

• Rechecko, Social Titli and Aryan Sharma, Solus building, 1902, Hiranandani Estate, Thane, Maharashtra 400607
• Privacy questions and requests: [email protected]
• Help with your account: [email protected]
• Grievances: [email protected]

We may update this policy from time to time. We will change the "Last updated" date above and, for significant changes, notify account holders by email or in the app before they take effect.