Privacy Policy
Effective 27 June 2026. Compliant with the Digital Personal Data Protection Act, 2023. View Terms & Conditions →
Effective Date: 27 June 2026 | Last Updated: 23 July 2026
This Privacy Policy explains how Vilkanundo (operated by Domoimate), the operator of vilkanundo.com and the Vilkanundo mobile app (together, the "Platform"), collects, uses, stores, shares, and protects your personal data, in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and applicable rules thereunder.
BY CREATING AN ACCOUNT, YOU CONSENT TO THE COLLECTION AND PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS PRIVACY POLICY. ACCOUNT CREATION IS ONLY PERMITTED AFTER YOU ACCEPT THIS POLICY VIA THE MANDATORY CONSENT CHECKBOX AT SIGN-UP.
1. Information We Collect
1.1 Information you provide directly
- Name, mobile number, email address, and password at registration (you may sign in with a Google account, a verified mobile number via OTP, an email/password, or a combination of these linked to one account)
- Profile details (location, profile photo)
- Listing details — item description, price, category, photos, video, location
- Business details, where you register or apply for business verification
- Messages you send to other Users through the Platform's chat feature
- Communications with us (support requests, bug reports and any attached screenshots, grievance complaints)
1.2 Information collected automatically
- Device information, IP address, browser type, operating system
- Usage data (pages viewed, searches, listings viewed/clicked, login times)
- Approximate or precise device location, only when you grant location permission for a location-based feature (e.g. "Near me", distance sorting)
- A device push-notification token (via Google Firebase Cloud Messaging), only if you enable notifications, used solely to deliver alerts to your device
- Cookies and similar tracking technologies (see Section 5)
1.3 Information from third parties
If you sign up or sign in via a third-party login (e.g., Google), we receive basic profile information as permitted by that service. If you sign in with a mobile number, we receive delivery confirmation from our SMS/OTP gateway provider but not the content of the SMS itself.
1.4 Identity verification (Aadhaar KYC)
Sellers may optionally verify their identity using Aadhaar OTP verification. This is processed entirely by Cashfree Payments India Pvt. Ltd. through its government-authorised Verification Suite (KYC) API. Your Aadhaar number is transmitted securely to Cashfree solely to trigger a one-time UIDAI OTP; we never store your full Aadhaar number on our servers. Upon successful verification we retain only: (a) your name as returned by the KYC provider, (b) the last four digits of the Aadhaar number in masked form (e.g., XXXX XXXX 1234), and (c) a one-way cryptographic fingerprint used exclusively to prevent the same Aadhaar from being used on multiple accounts. This fingerprint cannot be reversed to recover the Aadhaar number. We do not collect or process any biometric information.
1.5 Wallet and referral activity
If you participate in the Refer & Earn program, we record your referral code, the accounts it is used by, and the resulting Wallet credit history on your account, in order to administer the program and prevent abuse.
2. Purpose of Collection and Use
We collect and use your personal data to:
- Create and manage your account, including resolving sign-in across Google, mobile-OTP, and email/password so that the same verified identity always reaches the same account;
- Enable you to post Listings, message other Users, and connect with them;
- Operate the mandatory sign-up consent and verification process;
- Send you OTPs for sign-in or verification, and (where enabled) push notifications about relevant account activity;
- Provide location-based features such as "Near me" and distance sorting, when you grant location permission;
- Administer the Wallet and Refer & Earn program;
- Communicate with you (account notices, support, bug reports, grievance responses);
- Maintain administrative and evidentiary records of deleted Listings for a minimum of three (3) years, for fraud-prevention, dispute-resolution, and legal-compliance purposes;
- Detect, prevent, and investigate fraud, misuse, or violations of our Terms;
- Improve and secure the Platform;
- Comply with legal obligations, including responding to lawful requests from law enforcement or regulators.
3. Legal Basis for Processing
We process your personal data on the basis of your explicit consent, given at the time of account sign-up, and as otherwise necessary to perform our obligations to you, comply with law, or for legitimate uses recognised under the DPDP Act (such as fraud prevention and record-keeping for legal claims). Location and notification permissions are separately requested by your device or browser and are entirely optional.
You may withdraw consent at any time by contacting us (Section 12), though this may result in suspension of your account.
4. How We Share Your Information
- With other Users: Listing details and any information you choose to share in chat may be visible to Users you interact with.
- With service providers: We share data with third parties who help us operate the Platform, strictly for that purpose — including cloud hosting and file storage, our SMS/OTP gateway for mobile sign-in, Google Firebase for push notifications, Cashfree Payments for Aadhaar identity verification (Section 1.4), and AI service providers used for optional features such as listing-content translation and automated content-moderation screening — under contractual confidentiality obligations.
- For legal reasons: We may disclose your data, including retained records of deleted Listings, to law enforcement, courts, or regulators where required by law.
- We do not sell your personal data to third parties for unrelated marketing purposes.
5. Cookies and Tracking Technologies
We use cookies and similar technologies to keep you logged in, remember preferences, and understand how the Platform is used. You can control cookies through your browser settings; disabling them may affect Platform functionality.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Active account & profile data | While account is active, plus a reasonable period after closure for legal/audit purposes |
| Listings (deleted/expired) | Minimum 3 years from date of deletion |
| Chat messages | While your account and the related Listing conversation remain active, plus a reasonable period thereafter for dispute/fraud investigation |
| Transaction/dispute-related communications | Up to 3 years for evidentiary purposes |
| Wallet / referral ledger | While account is active, plus a reasonable period after closure for audit purposes |
| Bug reports and support communications | Up to 2 years, for quality and follow-up purposes |
| Device push-notification tokens | Until notifications are disabled or the app is uninstalled/token expires |
| Location data (per-request) | Not stored beyond the session used to serve the location-based result, unless you save a location as a default |
| Login/security logs | 12 months |
After the applicable retention period, data is securely deleted or anonymised, unless a longer period is required by law or an ongoing legal/dispute matter.
7. Data Security
We implement reasonable technical and organisational security measures, including encryption, access controls, and OTP-based authentication, to protect your data against unauthorised access, alteration, or loss. However, no system is completely secure, and we cannot guarantee absolute security.
8. Your Rights (under the DPDP Act, 2023)
Subject to applicable law, you have the right to:
- Access a summary of the personal data we hold about you;
- Request correction or updating of inaccurate or incomplete data;
- Request erasure of your personal data, subject to our legal retention obligations;
- Withdraw consent at any time, including revoking location or notification permissions from your device settings;
- Nominate another individual to exercise your rights in the event of death or incapacity;
- Lodge a complaint with our Grievance Officer, and thereafter with the Data Protection Board of India.
9. Children's Privacy
The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a minor has registered, we will take steps to delete the relevant account and data.
10. Data Breach Notification
In the event of a personal data breach likely to cause harm, we will take prompt steps to notify affected Users and the Data Protection Board of India, as required under the DPDP Act.
11. Third-Party Links
The Platform may link to third-party websites or services. This Privacy Policy does not apply to those third parties, and we encourage you to review their privacy policies separately.
12. Grievance Officer / Data Protection Contact
In accordance with the DPDP Act, 2023 and the IT Rules, 2021, you may contact our Grievance Officer for privacy-related complaints or data rights requests:
- Email: [email protected]
- Address: Domoimate, Ekp Arcade, Ekkapramba, near Ozhukur Road, 673641, Kerala, India
We will acknowledge complaints within 24 hours and aim to resolve them within 15 days.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be notified via the Platform or email, and continued use after such changes constitutes acceptance of the updated policy.
14. Contact Us
Email: [email protected] | Address: Domoimate, Ekp Arcade, Ekkapramba, near Ozhukur Road, 673641, Kerala, India