Privacy Policy
Effective Date:
How Aria Infotech collects, uses and protects personal data on this website and in the ARIA CRM platform, and the rights you have over your data under Indian law.
1.Introduction
Aria Infotech (“Aria Infotech”, “we”, “us” or “our”) is a software company based in India. We build and run ARIA, a customer relationship management (CRM) platform for real-estate brokerages.
This Privacy Policy explains what personal data we collect, why we collect it, who we share it with and the choices you have. It applies when you:
- visit this website, book a demo or ask for a free trial;
- use the ARIA platform and its web or mobile apps; or
- contact us about sales, support or billing.
We follow the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”) and the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). This policy is the notice those laws require us to give you.
Our two roles
When we decide how data is used. For website visitors, demo and trial requests, customer accounts, billing and support, we decide why and how personal data is processed. The DPDP Act calls this role a Data Fiduciary. Contact us directly about this data.
When our customers decide. Brokerages store details of their own leads, buyers, job applicants and staff in ARIA. For that data the brokerage is the Data Fiduciary and we are its Data Processor. We handle it only on the brokerage’s instructions. If a brokerage entered your details into ARIA, please contact that brokerage first. If you write to us, we will pass your request on and help the brokerage respond.
2.Information We Collect
We collect only what we need to answer enquiries, run the platform and bill for it.
Information you give us
- Demo and trial requests: your name, work email, phone number, brokerage name, role, team size, the product areas you are interested in and any message you write.
- Account details: the name, email, phone number, role, branch and sign-in details of each user a customer adds.
- Billing details: billing contact, company name and address, GSTIN and payment records. Our payment provider processes card and bank details. We do not store full card numbers.
- Messages: emails, support requests, call notes and feedback you send us.
Information collected automatically
- On this website: when you submit a form we record your IP address, browser type, the page you first arrived on, the site that referred you and any campaign tags in the link you followed. This tells us which campaigns bring enquiries.
- On the platform: sign-in times, IP addresses, device and browser details, and a log of actions taken in the account. We use these for security, troubleshooting and accountability.
Information from other sources
- Leads sent to a customer’s account by property portals, ad platforms or website forms the customer has connected.
- Business contact details from public sources, used for business-to-business outreach.
Data our customers store in ARIA
Depending on the features a brokerage uses, this can include:
- contact details, property preferences, budgets, site visits and notes about leads and buyers;
- call recordings, transcripts and summaries, and WhatsApp and call logs;
- resumes, application details and assessment results of job applicants;
- staff records, timesheets, attendance check-ins with location, and commission records.
Sensitive personal data
The SPDI Rules treat passwords and financial information as sensitive. We collect these only when needed and with your consent. Passwords are stored in a hashed form that cannot be read. Customers should not upload other sensitive data, such as health or biometric information, unless it is necessary and lawful.
3.How We Use Information
We use personal data only for the purposes below, and only as far as each purpose needs.
| Why we use it | What we use | Our basis |
|---|---|---|
| Reply to demo and trial requests | Your request details and campaign tags | Your consent, given when you send the form |
| Provide and support the ARIA platform | Account details, usage logs and customer data | Our contract with the customer, and the customer’s instructions |
| Billing, invoices and tax records | Billing details and payment records | Our contract, and tax and company law |
| Security and fraud prevention | IP addresses, device details and logs | Legitimate uses under the DPDP Act, and legal duties |
| Service updates and marketing | Contact details | Our contract for service messages; your consent for marketing |
| Meeting legal obligations | Whatever the law requires | Legal duties |
Consent
Where we rely on consent, we ask for it clearly and for a specific purpose. You can withdraw it at any time by writing to info@ariainfotech.com or by using the unsubscribe link in any marketing email. Withdrawing consent does not affect what we did before. If the consent was needed to provide a service, we may have to stop providing it.
AI features
ARIA uses artificial intelligence to transcribe and summarise calls, draft follow-ups and sales pitches, build landing pages and assess resumes. The results are drafts for a person to review. In hiring, an application that our checks flag always goes to a human reviewer. No applicant is rejected by an automated flag alone. We do not allow our AI providers to use customer data to train their own models.
We do not sell personal data, and we do not use customer data for our own marketing.
5.Third-Party Services
We share personal data only in the cases below.
Service providers
Trusted companies help us run our services: cloud hosting and databases, email delivery, telephony and call recording, AI processing, payments and support tools. They may use the data only to provide their service to us, under contracts that require security and confidentiality. Customers can ask us for our current list of providers.
Integrations a customer connects
Customers can link ARIA to services such as WhatsApp Business, telephony providers, Google and Meta advertising, and property portals including 99acres, MagicBricks and NoBroker. Data then moves between ARIA and that service as the customer sets it up. The other service’s own terms and privacy policy apply to what it does with the data. A customer can disconnect an integration at any time.
Legal requests
We may disclose data to a government agency that is authorised by law to ask for it, for example to verify identity or to investigate an offence. Rule 6 of the SPDI Rules allows this without your consent. We check that each request is lawful before we respond.
Business changes
If Aria Infotech is merged, acquired or restructured, personal data may pass to the new owner, who must honour this policy.
Anyone who receives personal data from us may not pass it on except as described here.
6.Data Security
We protect personal data with reasonable security practices, as section 43A of the Information Technology Act, 2000, Rule 8 of the SPDI Rules and section 8 of the DPDP Act require. Our measures include:
- encryption of data in transit (TLS) and at rest;
- role-based access, so each user sees only what their role needs;
- hashed passwords and least-privilege access for our own staff;
- audit logs of important actions, including changes to commission records;
- regular backups, monitoring and security updates; and
- confidentiality duties for employees, contractors and service providers.
If a breach happens
We will act quickly to contain it. We will tell the Data Protection Board of India and each affected person, as the DPDP Act requires. We will report cyber security incidents to CERT-In within six hours of noticing them. Where the data belongs to a customer, we will tell that customer without delay.
No system is completely secure. Please keep your password private and tell us at once if you think someone else has used your account.
Our Data Privacy page describes these measures in more detail.
7.Data Retention
We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires. After that we delete it or make it anonymous.
| Data | How long we keep it |
|---|---|
| Demo and trial requests that do not become customers | Up to 24 months after our last contact, or sooner if you ask |
| Customer and user account details | While the account is active, then as set out under “Deleting an account” |
| Data customers store in ARIA | As the customer instructs. After a subscription ends, deleted from live systems within 90 days |
| Backups | Up to 35 days on a rolling basis |
| Security and system logs | At least one year, and at least 180 days within India, as the law requires |
| Invoices and accounting records | Up to 8 years, under company and tax law |
Deleting an account
An account administrator can ask us to delete a workspace and all its data by writing to info@ariainfotech.com from a registered address. Administrators can export their data first. Once we have verified the request, we delete the data from live systems within 30 days. Copies in backups are removed as those backups expire.
We may keep limited records where the law requires it, such as invoices and security logs, or to deal with legal claims.
8.User Rights
Under the DPDP Act and the SPDI Rules you have the right to:
- access a summary of the personal data we hold about you and who we have shared it with;
- correct or update data that is wrong, incomplete or out of date;
- erase data we no longer need, unless the law requires us to keep it;
- withdraw consent at any time;
- nominate another person to use your rights if you die or are unable to; and
- raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.
How to use your rights
Write to info@ariainfotech.com. We may ask you to confirm who you are. We aim to reply within 30 days. There is no charge. Our Data Privacy page has a ready-made request for each right.
If you are in the European Economic Area or the United Kingdom
Where the General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing, you also have the rights to restrict or object to processing, to data portability, and to complain to your local data protection authority.
9.Children’s Privacy
Our website and the ARIA platform are made for businesses. They are not meant for anyone under 18, and we do not knowingly collect personal data from children.
The DPDP Act requires a parent’s verifiable consent before a child’s data is processed. If we learn that we hold a child’s data without that consent, we will delete it. If you believe a child has given us personal data, please write to info@ariainfotech.com.
10.International Data Transfers
We store personal data on servers run by our cloud hosting providers. Some of our service providers may process data in countries outside India.
When data leaves India, we make sure it receives the same level of protection that we apply ourselves, as Rule 7 of the SPDI Rules requires. We do not transfer personal data to any country the Government of India has restricted under section 16 of the DPDP Act. Where the GDPR applies, we transfer data only with appropriate safeguards in place.
11.Changes to this Policy
We may update this policy when our services, our practices or the law change. The effective date at the top of the page shows the current version. If a change is significant, we will tell customers by email or in the platform before it takes effect. If a change needs fresh consent, we will ask for it. You can ask us for earlier versions.
12.Contact Us
For any question about this policy or your personal data, write to info@ariainfotech.com.
Grievance Officer
Under Rule 5(9) of the SPDI Rules and the DPDP Act, our Grievance Officer handles complaints about how we use personal data. We respond to every grievance within one month.
The Grievance Officer
Aria Infotech, India
- Hours
- Monday to Friday, 10:00 to 18:00 IST, excluding public holidays
If you are not satisfied with our reply, you may complain to the Data Protection Board of India. This policy is governed by the laws of India. Disputes fall under the jurisdiction of the competent courts in India.
See also our Terms of Service.