KhojMitra
Last updated: May 2026
Your privacy matters to us. This Policy explains how we collect, use, and protect your personal data in compliance with the Digital Personal Data Protection Act, 2023 and other applicable Indian laws.
KhojMitra ("we", "us", "our") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy ("Policy") explains how we collect, use, store, share, and protect information about you when you use the KhojMitra website and mobile application ("Platform"). This Policy is published in compliance with: • Digital Personal Data Protection Act, 2023 ("DPDP Act") • Information Technology Act, 2000 ("IT Act") • Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 • Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 By using the Platform, you ("Data Principal" under the DPDP Act) consent to the collection and use of your information as described in this Policy.
We collect the following categories of information: (a) Account Information — When you sign in with Google, we receive your name, email address, and profile picture as provided by Google's OAuth service. (b) Location Data — With your explicit permission, we access your device's GPS coordinates to show nearby businesses and sort results by distance. Coordinates are stored in your browser's local storage and are sent to our servers transiently during each search query for distance calculation — they are not stored in our database or linked to your account. See Section 6 for full details. (c) City Preference — Your selected city is stored locally on your device (browser localStorage). It is not associated with your account on our servers. (d) Usage Data — We may collect information about pages visited, search queries, businesses saved, and other interactions with the Platform to improve our services. (e) Business Listing Data — Information submitted by business owners including business name, address, phone number, operating hours, category, and images. (f) Third-Party Sourced Business Data — Some business listings are sourced from publicly available directories and third-party data providers. This data relates to businesses, not individual users. (g) Payment Data — If you purchase a Boost / Sponsored Slot, we collect your 12-digit UTR (Unique Transaction Reference) number and optionally a payment screenshot that you submit through the Boost form. We do NOT collect or store your bank account details, UPI PIN, card numbers, or any other sensitive financial credentials. Payments are made directly through your UPI app to our UPI ID — KhojMitra never has access to your payment credentials. (h) Device & Technical Data — Browser type, operating system, IP address, and anonymised analytics data collected to maintain security and improve performance.
Under the Digital Personal Data Protection Act, 2023, we process your personal data on the following lawful bases: (a) Consent — For optional features such as location access, personalised recommendations, and marketing communications. You may withdraw consent at any time. (b) Legitimate Uses — As defined under Section 7 of the DPDP Act, including compliance with legal obligations, safety and security purposes, employment-related processing, and provision of services you have requested. (c) Contractual Necessity — Processing required to provide the services you have signed up for (account creation, business listing management, etc.). We process only the minimum personal data necessary for the stated purpose ("data minimisation principle").
We use the information we collect to: • Provide, maintain, and improve the Platform and its features • Authenticate your identity and manage your account • Display business listings relevant to your location or selected city • Enable business owners to manage and update their listings • Send transactional communications (e.g., account-related notifications) • Detect, investigate, and prevent fraudulent, abusive, or illegal activity • Comply with legal obligations under Indian law • Respond to your queries and support requests • Conduct internal analytics to improve the Platform We do not use your personal data for automated decision-making that produces legal or similarly significant effects without your consent.
KhojMitra uses Google OAuth 2.0 for user authentication. When you sign in with Google, you authorise Google to share your basic profile information (name, email address, profile photo) with KhojMitra. We do not access your Google Contacts, Gmail, Drive, Calendar, or any other Google service beyond authentication. Your Google credentials are never stored by KhojMitra; authentication tokens are managed securely by Supabase Auth. For information on how Google handles your data, please review Google's Privacy Policy at https://policies.google.com/privacy.
Location access is entirely optional. We request your device location to: • Sort nearby businesses by distance from your current position • Auto-detect your city for a personalised experience How your location data is handled: (a) Storage on your device — Your GPS coordinates (latitude and longitude) are saved in your browser's local storage (km_gps_lat, km_gps_lng) so the app can use them across pages without asking again. (b) Transmission to our servers — When you search for businesses, your GPS coordinates are sent to our servers (Supabase) as part of the search query solely to calculate distances and sort results by proximity. This is a transient, query-level transmission. (c) Not stored in our database — Your GPS coordinates are used only to process your search query and are NOT stored in our database, NOT linked to your account or profile, and NOT retained after the query completes. (d) Not shared with third parties — Your location data is never sold, shared with advertisers, or disclosed to any third party except as required by law. You may revoke location permission at any time in your device or browser settings. The Platform will continue to function using your manually selected city.
KhojMitra aggregates business information from multiple sources including (a) direct submissions by business owners, and (b) publicly available third-party data sources. Business information (business name, address, phone number, category) displayed on the Platform is considered public information. If you are a business owner and wish to: • Claim your listing: Register as a Business Owner on KhojMitra • Correct inaccurate information: Email [email protected] • Remove your listing: Contact our Grievance Officer at [email protected] We will process verified requests within 15 business days.
When you purchase a Boost / Sponsored Listing on KhojMitra, the following data is collected and processed: (a) UTR Number — Your 12-digit Unique Transaction Reference submitted by you as payment proof. This is stored in our database linked to your boost request for verification and dispute resolution. (b) Payment Screenshot — An optional screenshot of your UPI payment confirmation that you choose to upload. This is stored in our secure cloud storage (Supabase Storage) and used solely for payment verification by our admin team. (c) Boost Details — Start date, end date, amount paid, business ID, and category scope selected for the boost. (d) What We Do NOT Collect — KhojMitra does not collect, store, or have access to your bank account number, IFSC code, UPI PIN, credit/debit card details, or any other sensitive financial credentials. All payments are made directly through your UPI app; KhojMitra only receives the payment notification and the UTR you submit. (e) Retention — Payment records (UTR, amount, dates) are retained for a minimum of 3 years for accounting, tax, and legal compliance purposes, even after account deletion. (f) Access — Payment data is accessible only to KhojMitra's authorised admin personnel for verification purposes and is not shared with any third party except as required by law (e.g., tax authorities).
Your data is stored on Supabase infrastructure. We implement the following security measures: • TLS 1.2+ encryption for all data in transit • AES-256 encryption for data at rest • Row-Level Security (RLS) policies ensuring users access only their own data • Regular security reviews and access control audits • Secure OAuth authentication — no passwords stored by KhojMitra Despite these measures, no data transmission or storage system can be guaranteed 100% secure. You use the Platform at your own risk. In the event of a data breach that is likely to adversely affect your rights, we will notify you and the appropriate authorities as required by applicable law, including the DPDP Act 2023.
KhojMitra uses browser local storage (not third-party cookies) to: • Maintain your login session • Remember your selected city preference • Store GPS coordinates temporarily for distance sorting (on-device only) • Record whether you have completed the onboarding flow We do not use third-party advertising cookies, cross-site tracking pixels, or behavioural advertising technologies. We may use anonymised, aggregated analytics (without personal identifiers) to understand Platform usage patterns.
We do not sell, rent, or trade your personal data. We may share your information in the following limited circumstances: (a) Service Providers — Supabase (database, authentication, and storage infrastructure) and Google (OAuth authentication). These providers process data on our behalf under appropriate data processing agreements. (b) Business Listing Information — Business names, addresses, phone numbers, categories, and images submitted by or about a business are publicly visible to all Platform users by design. (c) Legal Requirements — We may disclose your information if required to do so by Indian law, court order, government authority, or to protect the rights, property, or safety of KhojMitra, our users, or the public. (d) Business Transfers — In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections. We will never share your personal data with third parties for their direct marketing purposes without your explicit consent.
KhojMitra uses Supabase for data infrastructure. Your data may be stored and processed outside India. We ensure that any cross-border transfer of personal data complies with the provisions of the Digital Personal Data Protection Act, 2023 and any regulations or adequacy notifications issued thereunder by the Government of India. By using the Platform and providing your data, you consent to such transfers subject to the protections described in this Policy.
We retain your personal data only for as long as necessary to fulfil the purposes outlined in this Policy: • Account data: Retained while your account is active • Business listing data: Retained until listing is removed or account is deleted • Usage/analytics data: Retained in anonymised form for up to 24 months • Support communications: Retained for up to 12 months Upon account deletion request, your personal data will be permanently deleted within 30 days, except where retention is required by applicable law (e.g., tax records, legal proceedings). Publicly submitted business listing information may be retained in anonymised/aggregated form.
Under the Digital Personal Data Protection Act, 2023, you have the following rights: (a) Right to Access — Request a summary of the personal data we hold about you and how it is being processed. (b) Right to Correction & Erasure — Request correction of inaccurate or incomplete personal data, or erasure of data that is no longer necessary for the stated purpose. (c) Right to Grievance Redressal — File a complaint with our Grievance Officer (see Section 15). If unresolved, you may approach the Data Protection Board of India once constituted. (d) Right to Nominate — Nominate another individual to exercise your data rights in the event of your death or incapacity. (e) Right to Withdraw Consent — Where processing is based on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing before withdrawal. To exercise any of these rights, contact us at [email protected] or our Grievance Officer. We will respond within 15 days.
KhojMitra is not intended for children under the age of 18. We do not knowingly collect personal data from minors without verifiable parental consent, as required under the DPDP Act 2023. If you believe a minor has created an account or provided personal data without appropriate consent, please contact us at [email protected] immediately and we will delete the data promptly.
In accordance with the IT (Intermediary Guidelines) Rules 2021 and the DPDP Act 2023, KhojMitra has appointed a Grievance Officer: Grievance Officer: [Name] Designation: Grievance Officer, KhojMitra Email: [email protected] Availability: Monday–Friday, 10:00 AM – 6:00 PM IST Complaints will be acknowledged within 24 hours and resolved within 15 days of receipt. If a complaint is not resolved to your satisfaction, you may escalate to the Data Protection Board of India (when constituted) or approach the appropriate consumer forum under the Consumer Protection Act, 2019.
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify users of material changes by posting the updated Policy on the Platform with a revised "Last updated" date, and where practicable, via in-app notification or email. Continued use of the Platform after the effective date of changes constitutes your acceptance of the revised Policy.
For general privacy inquiries: Email: [email protected] Website: https://khojmitra.in For data access, correction, deletion, or complaint: Email: [email protected] Grievance Officer details: See Section 15
© 2026 KhojMitra. All rights reserved.