This policy explains what personal data Listro collects, why, who we share it with, where it is processed, how long we keep it, and the rights you have over it. It is written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.
Effective 2 October 2026 · These documents are published in English only. Translations may be provided for convenience, but the English text governs.
1. Who is responsible
Listro Tech, a sole proprietorship of Hassain Basha is the Data Fiduciary for the personal data described here: we decide why and how it is processed. A sole proprietorship is not a separate company, so the proprietor named here is personally responsible for meeting these commitments. Principal place of business: No. 380, 1st Block, 2nd Stage, HBR Layout, Bengaluru, Karnataka 560043, India. Contact for any privacy matter: [email protected].
2. Account and profile data
Your phone number (used to sign in with a one-time code), your name, profile photo, city, and — if you set up a business workspace — the business name, billing address and GSTIN you provide. Your phone number, the one-time code and any password are encrypted in your browser before they are sent to us, on top of the encrypted (HTTPS) connection.
3. Identity verification (KYC)
Verification is optional — you do not need it to buy or sell; it earns a trust badge, better ranking for your listings and a larger free-listing allowance. Before anything is captured we show you what is read, why and what is kept, and ask for your consent; we record that consent and which version of the notice you saw. For instant Aadhaar verification we read the digitally signed Aadhaar QR you scan or upload and check UIDAI's signature. From it we keep only the last four digits of your Aadhaar number and your name, date of birth, gender and address (the last four stored encrypted) — never the full Aadhaar number, and never your Aadhaar photograph (only a one-way fingerprint of it, which cannot be turned back into the image). If the QR cannot be read automatically, the picture you uploaded is sent to an authorised reviewer to verify by hand and is kept securely for that purpose; because a card photo can show the full number, we recommend uploading a masked Aadhaar (only the last four digits visible), which you can download from UIDAI. For other documents (PAN, driving licence, passport, voter ID) we keep the document number in encrypted form and the image you upload, which only authorised reviewers can open, and only to decide your verification. You can withdraw consent and ask us to delete these details at any time.
4. Listings, chats, calls and location
What you post — listings, photos, videos, prices, offers and reviews. Messages, voice notes, photos and locations you send in chat. For in-app voice calls we record who called whom, when and for how long; call audio travels directly between the two devices or through our relay servers, encrypted, and is not recorded by us. Location: the city or area you choose, the location you attach to a listing, and a location you deliberately share in a chat. If you allow it, your device's location is used to suggest your area; you can refuse or withdraw this permission in your device settings at any time.
5. Device, usage and security data
Device identifier, device model, operating system and app version; a push-notification token if you allow notifications; IP address; and the pages and features you use. We use IP addresses and request records to keep the service secure — rate limiting, blocking automated abuse and investigating fraud — and a bot check (Cloudflare Turnstile) on sign-in to confirm a real person is asking for a code. Product analytics are aggregated and you can opt out from Settings → Privacy.
6. Payments
Payments for plans, subscriptions and boosts are processed by our payment partners. We receive the payment status, amount, reference numbers and the last digits or type of the method used — never your full card number, CVV or UPI PIN. Invoices carry the billing details you provide, as tax law requires.
7. Why we use your data
To create and run your account and show your listings (you asked us to — DPDP Act s.4 and s.7(a)); to verify your identity when you choose to, and to show the resulting badge, rank listings and set free-listing allowances (your consent); to prevent fraud, spam and abuse and keep users safe (s.7, legitimate uses, and our legal duties as an intermediary); to process payments and keep tax records (legal obligation); to send service messages such as OTPs, chat and offer alerts; to answer support requests and grievances; and, unless you opt out, to understand product usage in aggregate. We do not sell your personal data, and we do not use it to build advertising profiles.
8. What other users can see
Your display name, profile photo, city, verification badges, trust indicators and active listings are visible to other users. Your phone number is not shown publicly — contact happens through in-app chat and calls. Anything you send in a chat is visible to the person you are talking to, and may be reviewed by us if it is reported.
9. Who we share it with
Only service providers that run parts of the platform for us, each limited by contract to our instructions and to what that task needs: MSG91 (sending one-time codes by SMS or WhatsApp); Razorpay and Cashfree (payments); Cloudflare (network security, the sign-in bot check, and storage and delivery of photos and media); Google Firebase (push notifications); our cloud hosting provider (servers and databases, in Mumbai); and our AI provider, when you choose AI-assisted listing (the photos you select are sent to draft the listing) and to help screen content for safety. We also disclose data where an Indian law, court or authorised government agency requires it, and to a successor business if Listro is transferred, under this policy. We do not sell or rent personal data.
10. Processing outside India
Our servers and databases are in Mumbai, India. Some providers process data outside India: photos and media are stored and delivered through Cloudflare's global network, push notifications go through Google Firebase, and AI-assisted listing and content screening use an AI provider abroad. The DPDP Act permits this except to countries the Government of India restricts, and we do not transfer data to any restricted country. Wherever data is processed, we require the provider to protect it to the standard in this policy.
11. How long we keep it
Account and listing data: while your account is open. Short-lived security logs (request and error logs): deleted within days. Product analytics events: up to 180 days. One-time codes: expire within minutes and are never stored in readable form. Transaction and tax records: for the period tax law requires (generally 6 years from the end of the relevant financial year, longer if a proceeding is pending). After you delete your account we remove or anonymise your personal data, except records we must keep by law and safety records about accounts actioned for fraud or abuse, kept so the same person cannot simply return.
12. Your rights
Under the DPDP Act you can: get a summary of the personal data we hold about you and how we use it; have it corrected, completed or updated (most of it you can edit in the app); have it erased by deleting your account; withdraw consent where we rely on it — as easily as you gave it, without affecting what was done before; nominate someone to exercise your rights if you die or become unable to; and have a grievance redressed. To make a request, raise a ticket from Help → Talk to support in the Listro app or on the website (listro.in/help/contact) — the fastest route — or write to the Grievance Officer at the address below. We may need to confirm it is you before acting, and we respond within the time the law sets.
13. Security
Encrypted connections (HTTPS) everywhere; sign-in details encrypted again in the browser before they are sent; ID numbers stored encrypted and Aadhaar stored only in masked form; short-lived access tokens; access to personal data limited to people who need it, with every access to identity details logged. No system is perfectly secure. If a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires.
14. Children
Listro is not for anyone under 18, and we do not knowingly collect data from children. If we learn that we have, we will delete the account and its data.
15. Changes, Grievance Officer and complaints
We will post material changes to this policy on this page with a new effective date, and tell you in the app before they take effect. For the quickest answer to any privacy question, raise a ticket from Help → Talk to support in the Listro app or on the website (listro.in/help/contact). Grievance Officer: Hassain Basha, [email protected]. Grievances are acknowledged and resolved within the timelines required by applicable law. If you are not satisfied with our response you may complain to the Data Protection Board of India.
