Legal & Support

1. Introduction

This Privacy Policy explains how Naatil.com (“Naatil”, “we”, “us” or “our”) collects, uses, stores, shares and protects your personal data when you use the Naatil.com website, the Naatil mobile application and related services (together, the “Platform”). Naatil is a community platform for Kerala, India, offering a local business directory, news, transport information and other local services.

We process personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and rules made under them. By using the Platform, or by giving consent where we ask for it, you agree to the practices described in this policy. If you do not agree, please do not use the Platform.

2. Who We Are (Data Fiduciary)

For the purposes of the DPDP Act, the data fiduciary responsible for your personal data is THOMPSON CONSULTING (OPC) PRIVATE LIMITED, operating the Platform under the brand “Naatil.com”. You can reach us at info@naatil.com. Our contact channel for privacy complaints is given in Section 12 below.

3. Information We Collect

We collect the following categories of personal data:

Directory usage measurement — we count listing views and clicks on phone and WhatsApp controls. To reduce repeated counts, the server derives a daily keyed hash from the connection IP address and browser user agent; this feature does not store the raw IP address or user agent or set a tracking cookie. Temporary receipts deduplicate an action within an hour. Older receipts are removed in bounded cleanup batches when tracking activity occurs, so deletion is not a guaranteed fixed-time expiry. Daily aggregate action counts are retained. These counts do not establish unique people, completed calls or completed transactions.

Contact and correction requests — the name, email, optional phone number, listing reference and message you submit. These are stored in a private admin queue for handling and follow-up; an email notification may also be sent to the operator. The submission reference confirms storage, not email delivery or completion of a correction.

• Account information — your name, email address, phone number and a password (stored only as a one-way cryptographic hash) when you register a customer account, and business-contact details when you register as a business owner.
• Google sign-in profile — if you choose to sign in with Google, we receive your name, email address and Google account identifier from Google. We do not receive your Google password.
• Location data— approximate or precise location, only when you use location-based features such as “near me” search. Location is used to show relevant results and is requested through your browser or device, which you can refuse.
• Business listing data — if you list a business: business name, category, address, phone numbers, opening hours, services, descriptions and related details you submit. Listing data is published publicly on the Platform by design.
• Reviews and other content — reviews, ratings and other content you post, together with your display name, which appear publicly.
• Uploaded images — photos you upload (for example business photos), which are stored on our cloud object storage (Cloudflare R2) and served publicly as part of listings.
• Cookies and authentication tokens — see Section 5.
• Technical and usage data — IP address, browser/device information and request logs generated automatically when you use the Platform, used for security, rate-limiting and troubleshooting.
• Communications — messages you send us through contact forms or email.

We do not knowingly collect sensitive personal data such as financial account details, health data or biometric data. Naatil does not process payments: where online payment is offered you pay the business directly via UPI from your own UPI app, and businesses pay Naatil for promotional placements by direct UPI transfer. Your card, bank and UPI credentials never touch our servers — we store only order/payment status and, where you choose to provide it, a UPI transaction reference (UTR) for verification.

4. How We Use Your Data and Legal Basis

We process your personal data for the following purposes:

• To create and operate your account and authenticate you (performance of the service you requested; your consent).
• To publish business listings, reviews and other content you choose to submit (your consent; the purpose for which you voluntarily provided the data).
• To show location-relevant results when you use “near me” features (your consent, given via your device’s location permission).
• To process orders and appointments you place through the Platform, share them with the business you ordered from, and track their payment status (performance of the service you requested).
• To send transactional emails such as email verification, one-time passcodes (OTP), password resets and order notifications (performance of the service; legitimate use).
• To keep the Platform secure — fraud prevention, abuse detection, rate-limiting and log analysis (legitimate use).
• To respond to your enquiries and grievances (legitimate use; legal obligation).
• To comply with applicable law, court orders or lawful requests from authorities (legal obligation).

We do not sell your personal data. The Platform does display third-party advertising supplied by Google AdSense. Advertising involves cookies and similar identifiers — see Section 5 for what they do and how to opt out.

5. Cookies and Authentication Tokens

The Platform uses a small number of strictly necessary cookies. When you sign in, we set an httpOnly authentication cookie containing a signed session token (a JSON Web Token) that keeps you logged in for up to 7 days. Separate cookies are used for customer, business-owner and administrator sessions. We may also store preferences (such as your language choice, English or Malayalam) in your browser’s local storage.

Advertising cookies.We display advertisements served by Google AdSense. Google and its partners use cookies and similar identifiers to serve and measure those advertisements, and Google’s use of advertising cookies enables it and its partners to serve ads based on your visits to this Platform and/or other sites on the internet. These cookies are set by Google, not by us, and we do not receive the browsing profiles they are based on.

You can turn off personalised advertising in Google Ads Settings, and opt out of third-party vendors’ use of cookies for personalised advertising at aboutads.info/choices. Turning personalised ads off does not remove advertising; it makes it less relevant. You can also delete cookies through your browser settings; doing so will sign you out.

6. Third-Party Services (Data Processors)

We share personal data only with service providers that help us run the Platform, and only to the extent needed:

• Cloudflare, Inc. — hosting, content delivery, security (Cloudflare Workers) and image storage (Cloudflare R2).
• Neon — managed PostgreSQL database hosting, where account, listing, review and order records are stored.
• Amazon Web Services (Amazon SES) — delivery of transactional emails (verification, OTP, password reset, notifications).
• Google LLC — if you use “Sign in with Google”, Google processes your sign-in under its own privacy policy and shares your basic profile with us; Google Maps is used to display business locations.
• Google LLC (AdSense) — serves the advertisements displayed on the Platform and, for that purpose, receives your IP address, device and browser information and the pages you view, under Google’s own privacy and advertising terms.
• Meta Platforms (WhatsApp Business) — where a business or you choose WhatsApp communication, messages are delivered via the WhatsApp Business Platform under Meta’s terms.
• Amazon Web Services (Amazon Bedrock) — if you use the optional AI shop assistant, your chat messages and the shop’s catalogue are processed by Anthropic’s Claude model hosted on Amazon Bedrock to generate responses; no account is required and chats are not used to identify you.

These providers act on our instructions and are bound by their own contractual and legal obligations. Some of them store or process data on servers located outside India; where that happens, transfers are made in accordance with applicable Indian law. We may also disclose data where required by law or to protect the rights, safety or property of Naatil, our users or the public.

7. Data Retention

We keep personal data only as long as needed for the purposes above:

• Account data — retained while your account is active. When you delete your account (Section 9), your profile is immediately anonymised: your name, email, phone and Google identifier are removed or replaced with non-identifying values.
• Reviews and listings — public content may remain on the Platform after account deletion, but is no longer linked to your identity (shown as “Deleted User”).
• Order and payment records — retained as required by Indian tax, accounting and consumer-protection law.
• Technical logs — retained for short periods for security and troubleshooting and then deleted or aggregated.

8. Your Rights

Under the DPDP Act, you have the right to:

• Access — obtain a summary of the personal data we hold about you and how it has been processed.
• Correction and updating — correct inaccurate or incomplete data. You can edit your name and phone number from your profile page, or contact us for other corrections.
• Erasure (account deletion) — delete your account and personal data at any time from the Settings page (see Section 9), or by emailing us.
• Withdraw consent — withdraw consent at any time where processing is based on consent (for example, by disabling location access or deleting your account). Withdrawal does not affect processing done before withdrawal.
• Grievance redressal — raise a privacy complaint with the operator (Section 12) and, if unresolved, escalate to the Data Protection Board of India.
• Nominate — nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, use the in-product options mentioned above or email info@naatil.com from your registered email address. We may need to verify your identity before acting on a request, and we respond within the timelines required by law.

9. Deleting Your Account

You can delete your Naatil customer account yourself at any time from the Settings page. Deletion is immediate and cannot be undone. When you delete your account:

• Your name, email address, phone number and Google sign-in link are removed from your account record and replaced with non-identifying values.
• You are signed out and can no longer log in to that account.
• Reviews you posted may remain visible but are attributed to “Deleted User”.
• Order records required for legal, tax or accounting purposes are retained in anonymised form for the period required by law.

If you cannot access your account, email info@naatil.com from your registered address and we will process the deletion for you.

10. Children’s Privacy

The Platform is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided us personal data, contact us and we will delete it.

11. Security Measures

We apply reasonable technical and organisational safeguards appropriate to the data we hold, including:

• Encryption of all traffic in transit (HTTPS/TLS) and encryption at rest by our hosting and database providers.
• Passwords stored only as salted bcrypt hashes — we never store or see your plain-text password.
• Signed, httpOnly, same-site session cookies; short-lived OTPs; and rate-limiting on login and OTP endpoints.
• Validation of uploaded files, sanitisation of user-generated HTML, and security headers on all responses.
• Access to production systems restricted to authorised personnel.

No system is completely secure, but if a personal data breach occurs we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

12. Privacy Complaints and Grievances

Send privacy complaints to the operator using the contact details below. You may also use the contact form and retain the saved reference.

We acknowledge grievances promptly and aim to resolve them within the timelines prescribed under applicable law. If you are not satisfied with our response, you may approach the Data Protection Board of India.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows the current version. For material changes we will give notice on the Platform or by email. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

14. Governing Law

This Privacy Policy is governed by the laws of India. Subject to any mandatory provisions of applicable law, the courts at Kerala, India shall have jurisdiction over disputes arising out of or relating to this policy.

15. Contact Us

For questions about this policy or your personal data, contact us at info@naatil.com.