Privacy Policy

1. About this notice

Kontraq ("we", "us") runs a B2B marketplace that connects Builders, Contractors and Suppliers in Indian civil construction. This notice explains, in one place, what personal data we collect, why we use it, who we share it with, how long we keep it, and how you can use your rights. It is given under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025.

For this data, Kontraq is the Data Fiduciary: we decide why and how it is processed.

This notice is available in English and Hindi. Switch language with the EN / हिंदी control at the top of the page.

2. Who to contact

For any question about your personal data, to use your rights, or to raise a grievance, write to privacy@kontraq.com. The Grievance Officer named in section 17 answers these messages on our behalf.

Please write from the email address or phone number registered on your account, so we can identify you.

3. Personal data we collect and why

We collect only what the marketplace needs. Each item and its purpose:

• Account details: name, email address, phone number, role (Builder, Contractor or Supplier) and preferred language. If you sign in with Google, we receive your name, email and profile picture; if you sign in with a password, we store only a secure hash of it. Used to create your account, sign you in and contact you about your account.
• Location: operating city and address. Used to show you nearby works and enquiries and to show your location on your profile.
• Business details: company or team name, contact person, office or business address, GST number, PAN, trade licence number, website, social media links, years in business, employee count and turnover range. Used to build your public business profile and to verify your business.
• Profile details: bio, experience, languages, tools owned, rate range, certifications, profile photo, logo and portfolio photos. Used to build your profile and to match Contractors and Suppliers to works and enquiries.
• Verification documents: the type and copy of any identity document you share with us for verification (for example PAN or voter ID). Used only to verify that you are who you say you are. Only our verification team can see it; it is never shown on your profile.
• Marketplace activity: works and Bills of Quantities you post, bids, material enquiries, awards, ratings, reviews, and the photos and documents attached to them. Used to run the marketplace and to show your track record.
• Notifications and preferences: web push subscription, browser and device type, theme and language settings. Used to send the notifications you turn on and to remember your settings.
• Usage analytics (only if you agree): a pseudonymous ID, your account ID and role, pages and features used, and error reports. Used to understand how the product is used and to fix crashes. This is off unless you tick the analytics box, and never includes your name, email or phone.
• Security logs: sign-in events, IP address and timestamps of access to your data. Used to detect, investigate and prevent unauthorised access, as the DPDP Rules require.

4. Why we are allowed to use it

• Your consent: you give it by ticking the Terms and Privacy box when you set up your account. It covers everything in section 3 except usage analytics.
• Separate, optional consent for analytics: the analytics box is unticked by default. Saying no does not limit anything else on Kontraq.
• Legitimate uses allowed by law: we may also process personal data without consent where section 7 of the DPDP Act allows it, such as to comply with a law, a court order, or a lawful request from a government authority.

We do not use your personal data for any purpose not listed in this notice. If we want to use it for a new purpose, we will ask for your consent first.

5. Who we share it with

We never sell your personal data. It is shared only as follows:

• Other users: your business profile, ratings and reviews are visible to other users. Your bids are visible only to the Builder or Supplier you send them to. Your phone number is shown only to the party you are dealing with on a work or enquiry.
• Supabase (India): stores our database, files and sign-in data on servers in Mumbai, India, and runs our notification and background services.
• Vercel: hosts and delivers the Kontraq website through its global network.
• Google: Google sign-in (if you use it), and Google Gemini AI to read the Bill of Quantities text of a posted work (see section 7).
• PostHog (European Union): product analytics and error reports, only if you agreed to analytics.
• Browser push services: your browser's push service (for example from Google, Mozilla or Apple) delivers notifications you turn on.
• Authorities: when Indian law, a court order or a lawful government request requires it.

These service providers process data only on our instructions and under contract.

6. Where your data is stored

Your account data and files are stored in India (Mumbai). Some service providers in section 5 process data outside India: Vercel and Google on their global networks, and PostHog in the European Union. We transfer data outside India only as the DPDP Act allows, and never to a country the Government of India has restricted.

7. Google sign-in and AI

With Google sign-in we receive only your name, email address and profile picture. We do not access your Google contacts, calendar or other Google services. Our use of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements.

AI skill tagging

When a Builder posts a work, we send its Bill of Quantities text to Google Gemini to suggest the construction skills it needs. This:

• is used only to match works with suitable Contractors
• never decides anything about your account, verification or eligibility
• can be corrected: you can edit the suggested skills on your work

8. How long we keep it

• We keep your personal data while your account is active.
• When you withdraw consent or your account is closed, we stop using your data to provide the service. As the DPDP Rules require, we keep the data and the logs of how it was processed for one year from the date of that processing, only to detect and investigate misuse, and then erase it.
• We keep data longer only where another law requires it, for example tax and GST records.

9. How we protect it

We take reasonable security safeguards, as required by the DPDP Rules, including:

• encryption of data in transit (TLS) and at rest
• access control on every database table, so each user can reach only the data they are allowed to see
• logs and monitoring of access to personal data, to detect and investigate unauthorised access
• backups, so the service can continue if data is lost or damaged

10. Your rights

Under the DPDP Act you have the right to:

• Access: get a summary of the personal data we process about you, what we do with it, and the names of everyone we have shared it with
• Correction and erasure: have your data corrected, completed or updated, and have it erased unless we must keep it for a purpose you still use or by law (see section 8). You can edit most profile details yourself in the app.
• Withdraw consent: at any time, as easily as you gave it. Turn analytics off in Settings. To withdraw consent for everything else, write to us; we will then stop providing the service and close your account. Withdrawal does not affect processing done before it.
• Nominate: name another person who can use these rights for you if you die or become unable to use them
• Grievance redressal: have your complaint about how we handle your data heard and answered

How to make a request

Write to privacy@kontraq.com from your registered email address or phone number, and tell us which right you want to use. We may ask for details to confirm it is you.

We will respond to every request and grievance within 90 days of receiving it.

11. Complaints to the Data Protection Board

If you are not satisfied with how we handle your grievance, you may complain to the Data Protection Board of India, set up under the DPDP Act. The law asks you to raise the grievance with us first, at privacy@kontraq.com.

The Board works as a digital office, so complaints can be filed online.

12. Your duties

The DPDP Act also asks you to:

• follow the law when using your rights
• not pretend to be someone else when giving your personal data
• not hide material information when sharing identity or address documents
• not file false or frivolous grievances or complaints
• give only genuine information when asking for correction or erasure

13. If there is a data breach

If a breach affects your personal data, we will tell you without delay through your account or registered contact details: what happened, how it may affect you, what we are doing about it, and what you can do to protect yourself. We will also report it to the Data Protection Board as the DPDP Rules require.

14. Cookies and local storage

We use essential cookies and local storage to keep you signed in and to remember your theme and language. We do not use advertising cookies. If you agreed to analytics, PostHog also stores a pseudonymous ID in your browser; turning analytics off in Settings stops this.

15. Children

Kontraq is for businesses, and you must be 18 or older to use it. We do not knowingly collect data from anyone under 18. If you think a minor has given us personal data, contact us and we will erase it.

16. Changes to this notice

If we change this notice, we will tell you in the app before the change applies. If a change means using your data in a new way, we will ask for your consent again. Each version is dated at the top of this page.

17. Contact us

For privacy questions, requests to use your rights, or grievances:

Grievance Officer:

To be appointed. Until then, write to the email below.

Email:

privacy@kontraq.com

Platform:

kontraq.com