Privacy Policy

1. Who we are and what this policy covers

1.1 This Privacy Policy is issued by Bricko Catalyst Private Limited, registered office in Nagpur, Maharashtra, India ("Bricko", "we", "us"). It applies to personal data we process when you use:

• Bricko ERP, Bricko CRM and Unified Finance at brickoerp.com, its sign-in and sign-up sub-domains (including app.brickoerp.com and in.brickoerp.com), customer workspaces on *.brickoerp.com and the BrickoERP app for Android and iOS, used by builders and their teams (the "Platform");
• BrickoMart at brickomart.com, including the buyer, supplier, consultant, brand and delivery-partner portals and web app (the "Marketplace");
• Bricko Homes, the Home Buyer Portal at bricko.in and its app, where home buyers see their bookings, payments and documents (the "Portal");
• the connection between the Platform and the Marketplace, which lets a verified builder's team buy materials for the company (Section 5.6);
• our mobile and progressive web apps, driver app, APIs, websites, help content and communications (together with the above, the "Services").

1.2 This policy is published under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Section 16 contains additional information for users outside India.

1.3 Two roles. For most data, Bricko decides why and how it is processed and is the data fiduciary (controller). For data that builders and other organisations put into their own Platform workspaces, the organisation is the data fiduciary and Bricko is its data processor; Section 11 explains what that means for you.

1.4 "Personal data" means any data about an individual who is identifiable by or in relation to that data. This policy does not cover data that cannot identify anyone, such as aggregated statistics.

2. The personal data we collect

We collect the following categories of personal data. Items marked ◆ are required to provide the relevant Service; the rest are optional or depend on the features you use.

2.1 Account and identity data

Name ◆, mobile number ◆, email address ◆, password (stored only as a one-way hash; passwords are sensitive personal data under Indian law) ◆, one-time passcode logs, role (builder, buyer, supplier, consultant, brand, delivery partner, home buyer) ◆, company or trade name, designation, profile photo, preferred language, the country you choose when you sign up, and the terms and policy versions you accepted and when.

2.2 Business and verification data

For suppliers, consultants, brands and Platform customers: PAN ◆, GSTIN (where registered), CIN or Udyam number, registered and business addresses ◆, GST registration certificate, trade licence or professional registration details, RERA registration numbers (builders and agents), authorised-signatory name and contact, the identity details and documents used to verify a business and its owner, director or proprietor before it can start working on the Platform, and, for payouts, bank account number, IFSC and account-holder name or UPI ID ◆. Bank and UPI details are treated as sensitive personal data under Indian law.

2.3 Location data

The site pincode or city you enter ◆ (used to show suppliers who deliver to you); your precise device location only if you choose "Use my current location" or enable it in the app; delivery addresses; and, for delivery partners, live GPS location while a delivery is in progress.

2.4 Transaction and activity data

Requests for quotation and quotes, carts, orders, invoices, payment status and references, delivery and tracking events, returns and disputes, consultation bookings and enquiries, brand leads, reviews and ratings, ad bookings, ad-credit balances and campaign performance, and, on the Platform, leads, follow-ups, bookings, demands, receipts, payments, approvals, tasks, notes, messages between colleagues and other business records, photos and files you upload (such as site photos, payment proofs and documents), and an audit trail of who did what and when, which protects business records and helps resolve disputes.

2.5 Home-buyer data

If you are a home buyer: the homes you view and shortlist, enquiries you send, and — where your builder uses the Portal — your booking details, unit, payment schedule, demand notes, receipts, documents and correspondence that the builder shares through the Portal. If your builder collects KYC documents through the Portal, we store them on the builder's behalf.

2.6 Payment data

Online payments are processed by banks and payment aggregators authorised by the Reserve Bank of India. We never see or store full card numbers, CVV, card expiry, UPI PIN or net-banking credentials. We receive the transaction reference, amount, status, time and a masked identifier of the instrument (for example the last four digits).

2.7 Communications

Messages you exchange with other users through the Services, support requests and tickets, call and WhatsApp interactions with our team, your notification settings and the consents you give or withdraw.

2.8 Device and usage data

IP address, device and browser type, operating system, app version, language, screen size, pages and screens viewed, clicks, searches, referring URL, timestamps, crash reports, and identifiers from cookies and similar technologies (Section 7). We derive approximate location from IP address.

2.9 Data other people give us about you

• Builders and other Platform customers upload data about their customers, leads, employees, vendors and contacts into their workspaces.
• Suppliers and brands upload distributor, dealer and customer details.
• Other users may mention you in reviews, referrals, enquiries or team invitations.
• Verification sources such as GST and company registries, and screening lists maintained by governments and international bodies.

2.10 Our phone apps

The BrickoERP and Bricko Homes apps collect a notification token from Google Firebase so we can send you notifications, and only if you allow notifications. They do not collect your location, your phone's contacts, call logs or browsing history, do not use an advertising ID and show no ads. Location features described in Section 2.3 apply only to the Marketplace and the delivery-partner app.

3. Why we use your data and the legal basis

We use personal data for the purposes below. Under the Digital Personal Data Protection Act, 2023, we rely on your consent — given by a separate, specific affirmative act (for example ticking a box at sign-up, enabling a feature, or submitting a form) after you have seen the notice for that purpose, never pre-ticked and never bundled with another choice — or on a legitimate use expressly permitted by that Act, which for us means data you voluntarily provide for a specified purpose without objecting, compliance with a law, court order or lawful request, or responding to an emergency. We keep a record of every consent (who, when, which notice version, which purposes). Where we rely on consent, you may withdraw it at any time, as easily as you gave it (Section 10).

We do not make decisions that have legal or similarly significant effects on you by automated means alone. We do not use personal data to train AI models without telling you and obtaining your consent.

4. Advertising on Bricko

4.1 Advertising is the only service Bricko charges for, so it is important to explain how it works.

4.2 How Ads are matched. Sponsored placements and Ads shown on the Services are selected using: the category, product or page you are looking at; the site pincode or city you have entered; your role (for example buyer, builder or consultant); and the advertiser's own targeting choices such as category and region. We do not build profiles of your behaviour across other websites or apps to target Ads, and we do not use sensitive personal data for advertising.

4.3 What advertisers get. Advertisers receive aggregated statistics: number of displays, placement periods and, where applicable, clicks or enquiries. They do not receive your personal data unless you choose to send them an enquiry or lead through the Ad, in which case they receive only what you submit, for that enquiry only.

4.4 Labelling. Paid placements are labelled "Sponsored", "Featured" or "Ad". Where an advertiser is a related party of Bricko or its directors, we say so on the placement.

4.5 Children. We do not direct advertising at children and do not allow anyone under 18 to use the Services.

4.6 Measuring our own website. On brickoerp.com (not inside logged-in portals) we use PostHog, a product-analytics service, to count visits and see which pages and buttons people use, how they arrived (for example a search engine, a shared link or a campaign tag in the link) and their approximate city and country. It sets no cookies: what it needs is kept in your browser tab only and is cleared when you close the tab. The IP address is used only to work out the approximate location and is then deleted; it is not stored. It does not record your screen, and it is not used for advertising or shared with advertising networks. If your browser sends a Do Not Track signal, it does not run.

4.7 Where a sign-up came from. When you click to sign up or sign in from our website, the link carries the page you came from, the first page you visited and any campaign tags, so that BrickoERP can record which pages and campaigns bring new accounts. If you create an account, this is stored with it as part of your account data.

5. Who we share personal data with

We share personal data only as described here. We do not sell personal data, and we do not share it with third-party advertising networks.

5.1 Other users, to complete what you asked for.

• When you place an order or request a quote on the Marketplace, the supplier receives your name, company, delivery (site) address, phone number, GSTIN (if you provide it for invoicing) and the order details. The delivery partner receives the delivery address, contact name and phone number.
• When you book or contact a consultant, the consultant receives your name, contact details and the enquiry.
• When you send an enquiry or lead to a brand through its page or an Ad, the brand receives what you submitted.
• Suppliers, consultants and brands show public profiles (business name, address, contact, catalogue, ratings) to all users.
• Home buyers' booking data is visible to their builder; builders' project information is visible to the home buyers of that project.
• Platform customers' data is visible to the users they add to their workspace, according to the roles they set.

Everyone who receives personal data through the Services must use it only for that transaction and protect it (see our Terms of Service, Section 13).

5.2 Service providers who work for us, under contracts that require them to protect the data and use it only on our instructions: cloud hosting and storage; SMS, WhatsApp, email and push-notification providers; payment aggregators and banks; mapping and geocoding; customer-support and ticketing tools; analytics; verification and screening services; document generation; and professional advisers. These include Google Firebase (notifications on our phone apps), Cloudflare (bot protection on sign-in), business-verification providers that check GSTIN and company-registration details, and Anthropic, the AI provider behind Bricko AI (see 5.7). When a builder turns on SMS or WhatsApp messages, or connects its own calling, call-transcription or AI note-taking accounts, those providers receive what is needed to deliver that feature, on the builder's instructions. A list of our principal sub-processors is available on request to Platform customers.

5.3 Our group companies, for group administration, security, finance and compliance, under an intra-group data-transfer agreement that applies the protections in this policy.

5.4 Authorities and third parties when the law requires: courts, law-enforcement agencies, CERT-In, the Data Protection Board of India, tax and regulatory authorities, and real-estate regulators, in response to lawful orders and requests; or where necessary to protect the rights, property or safety of Bricko, our users or the public.

5.5 A buyer or successor of our business, in a merger, acquisition, financing or sale of assets, in which case this policy continues to apply to your data and we will notify you of any change in control.

5.6 The Platform–Marketplace connection. When a verified builder connects its company to BrickoMart, we send BrickoMart the company's business details and, for team members the builder allows to order, their name, email and phone number, so those people can buy materials for the company. This stops when the builder disconnects, when a person loses that access, or when their account is deleted.

5.7 Bricko AI. Bricko AI is an optional assistant in BrickoERP and Bricko Homes (in beta). When a builder uses it to read a brochure, drawing, price list or RERA certificate, to read their setup answers, or to draft a bill of quantities or schedule, and when a home buyer asks a question about a project on Bricko Homes, the content involved is sent to our AI provider, Anthropic, PBC, which processes it outside India (mainly in the United States) and returns the result. Our contract with Anthropic does not permit it to use this content to train its models. The results are saved in the builder's workspace like the rest of their data, and builders check and confirm them before relying on them. Builders can set up and run their projects without Bricko AI.

6. Where your data is stored and international transfers

6.1 Our primary systems and backups are hosted in data centres in India. Some service providers (for example email, messaging and analytics providers, and our AI provider for Bricko AI described in 5.7) may process data outside India.

6.2 When personal data is transferred outside India, we do so in accordance with the Digital Personal Data Protection Act, 2023 (which permits transfers except to countries restricted by the Central Government) and sectoral rules, and we require the recipient to protect the data to the standard required by this policy. Logs we must keep under CERT-In directions are kept in India.

6.3 For users in the European Economic Area, the United Kingdom and other countries with transfer restrictions, see Section 16.

7. Cookies and similar technologies

7.1 We use cookies, local storage and similar technologies to:

• Run the Services (strictly necessary) — keep you signed in, remember your site pincode and cart, protect forms against cross-site request forgery, balance load and detect abuse. These cannot be switched off without breaking the Services.
• Remember preferences — language, theme, dismissed notices.
• Measure and improve — understand which pages and features are used, find errors, and measure our own marketing on public pages (Section 4.6).

7.2 Your choices. You can delete or block cookies in your browser settings; most browsers also let you block third-party cookies. Where the law requires it, we show a cookie banner on our public websites and set non-essential cookies only after you accept. Opting out of analytics cookies does not affect the Services.

7.3 Our website analytics (Section 4.6) do not run when your browser sends a "Do Not Track" signal. We also honour Global Privacy Control signals where the law requires it.

8. How we protect your data

8.1 We apply reasonable security safeguards appropriate to the data we hold, including: encryption of data in transit (TLS) and at rest; hashed passwords and one-time passcodes; optional two-factor sign-in for users, which a company can require for chosen roles; verification of every business before it can work on the Platform; strict separation of each customer's data from every other customer's; role-based access control and multi-factor authentication for administrative access; logging and monitoring to detect, investigate and remediate unauthorised access; regular backups and business-continuity measures; secure development practices and periodic vulnerability testing; and contractual security obligations on our service providers. Our information-security programme is aligned with ISO/IEC 27001.

8.2 No system is completely secure. Keep your password and one-time passcodes private, use a strong, unique password, and tell us immediately at [email protected] if you suspect any unauthorised access to your account.

8.3 If a breach happens. If a personal-data breach affects you, we will tell you without delay through your account or your registered contact details, describing what happened, the likely consequences, what we are doing about it, what you can do to protect yourself and whom to contact. We report cyber-security incidents to CERT-In within 6 hours of noticing them, intimate the Data Protection Board of India without delay and file its detailed report within 72 hours, and notify Platform customers whose data is affected within 24 hours so that they can meet their own obligations.

9. How long we keep your data

We keep personal data only as long as needed for the purposes in Section 3, and then delete or anonymise it, unless the law requires us to keep it longer. Our standard periods are:

10. Your rights and choices

10.1 Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you, how we use it and whom we have shared it with;
• Correct, complete or update inaccurate or incomplete data;
• Erase your personal data when it is no longer needed for the purpose it was collected for, unless the law requires us to keep it;
• Withdraw consent at any time, as easily as you gave it; we will stop the processing that relied on it (this does not affect processing already carried out, and some Services may stop working);
• Nominate another person to exercise your rights if you die or become incapacitated;
• Raise a grievance with us (Section 15) and, if you are not satisfied with our response, complain to the Data Protection Board of India.

10.2 How to exercise them. Most of these you can do yourself: update your profile, download your data, change notification preferences or delete your account from your account settings. Otherwise, write to [email protected] from your registered email address (or use the request form in Help) and tell us which right you are exercising and the account or email the request relates to. We may ask you to verify your identity. We respond within 30 days.

10.3 Marketing. You can opt out of marketing messages at any time by using the unsubscribe link in an email, replying STOP to an SMS or WhatsApp message, changing your notification settings, or writing to us. We honour the TRAI Do-Not-Disturb registry. Transactional and service messages (such as one-time passcodes and order updates) continue while you use the Services.

10.4 Location. You can turn off precise location in your device settings at any time; you can still use the Services by entering a pincode.

10.5 Data held for a builder or other Platform customer. If your request concerns data that a builder or other organisation holds in its Platform workspace, please contact that organisation; if you write to us, we will forward your request to it and help it respond (Section 11).

10.6 Your duties. The Act also asks you not to impersonate anyone, not to suppress material information when providing data for an identity document, and not to make false or frivolous complaints.

10.7 Deleting your BrickoERP or Bricko Homes account. You can delete your account yourself at any time: in the BrickoERP app, Menu → Delete my account; on the website, Settings → Security → Delete my account. The steps are also at app.brickoerp.com/delete-account.

• Your account is paused at once and deleted after 7 days. Sign in during those 7 days to keep it.
• Any BrickoMart access through your company ends at once.
• Deleted: your name, email, phone number, photo, sign-in, team memberships, notification tokens and personal notifications.
• Kept by your company: business records you created, such as bookings, receipts, invoices, approvals and the audit trail, which the law requires the company to keep. They show "Deleted user" in place of your name.
• If you are the only owner of a team that has other people in it, you must first make someone else an owner.
• Can't sign in? Write to [email protected] from the email address on your account and we will help.

11. Data we process for builders and other Platform customers

11.1 When a builder, developer or other organisation uses the Platform, it decides what data to upload about its customers, leads, home buyers, employees, vendors and contacts, and why. That organisation is the data fiduciary for that data; Bricko is its processor and acts only on its documented instructions, under a Data Processing Addendum.

11.2 As processor we: process Customer Data only to provide and secure the Services; apply the safeguards in Section 8; notify the customer of any personal-data breach affecting its data within 24 hours of becoming aware of it; engage sub-processors only under written contracts and maintain a list for customers; assist the customer in responding to data-principal requests; and delete or return Customer Data at the end of the relationship (Section 9).

11.3 If you are a home buyer, employee or contact of such an organisation and you have questions about how your data is used, please contact the organisation. Its privacy notice, not this policy, governs that use.

12. Children

The Services are for adults and businesses. We do not knowingly collect personal data from anyone under 18, and we do not track or target advertising at children. If you believe a child has provided personal data to us, write to [email protected] and we will delete it.

13. Links to other sites

The Services contain links to sites and services we do not control — payment gateways, banks, lenders, maps, messaging apps, government and RERA portals, and the websites of suppliers, brands and builders. Their privacy practices are their own; read their policies before giving them any data.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "last updated" date and, for material changes, notify you by email, in-app notice or a notice on the website at least 15 days before the change takes effect, unless a change is needed urgently to comply with law. Earlier versions are available on request.

15. Contact and grievance redressal

15.1 Grievance Officer (appointed under the Information Technology Act, 2000 and the rules made under it, the Consumer Protection (E-Commerce) Rules, 2020 and the Digital Personal Data Protection Act, 2023):

15.2 Write to the Grievance Officer with any question, request or complaint about this policy or your personal data. We acknowledge every grievance within 24 hours with a ticket number and resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India after exhausting this process.

15.3 For questions about orders, deliveries or your BrickoMart account, you can also write to [email protected]. For your BrickoERP or Bricko Homes account, including deleting it, write to [email protected].

16. Additional information for users outside India

Bricko Catalyst Private Limited is the data controller for users everywhere. If you use the Services from outside India, the following also applies.

16.1 European Economic Area and United Kingdom

• Legal bases. We process your personal data because it is necessary to perform our contract with you (providing the Services you sign up for); because of our legitimate interests (securing the Services, preventing fraud, improving features, and, for business users, direct marketing of our own services, which you can object to at any time); to comply with legal obligations; or with your consent (for example non-essential cookies and marketing to individuals), which you can withdraw at any time.
• Your rights. In addition to the rights in Section 10, you have the rights of access, rectification, erasure, restriction of processing, data portability, objection (including to direct marketing), and the right not to be subject to solely automated decisions with legal or similarly significant effects. You may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk).
• International transfers. Your data is transferred to and processed in India. India has not been the subject of an adequacy decision by the European Commission or the UK Government. We rely on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, together with supplementary measures, for such transfers. You can ask for a copy of the relevant clauses at [email protected].
• Representative. Where the law requires us to appoint a representative in the EU or the UK, we will publish the representative's details here.
• Platform customers in the EEA or UK are offered a Data Processing Addendum incorporating the Standard Contractual Clauses and UK Addendum.

16.2 United States

We do not sell personal information. We do not share personal information for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes other than providing the Services. Residents of states with comprehensive privacy laws may have the right to know, access, correct, delete and port their personal information, to opt out of targeted advertising or sales, and not to be discriminated against for exercising those rights. To exercise them, use the methods in Section 10.2; you may use an authorised agent, and if we deny a request you may appeal by replying to our decision.

16.3 United Arab Emirates and other GCC countries

We process personal data in accordance with the applicable federal and free-zone data-protection laws. Where those laws require consent for a transfer outside the country, we obtain it when you create your account.

16.4 Everywhere else

Where the law of your country gives you additional rights or requires additional protections, we will honour them. Contact us using Section 15.

17. Company information

Bricko Catalyst Private Limited · Registered office: Nagpur, Maharashtra, India · Phone: +91 75061 38282 · Email: [email protected] · Marketplace support: [email protected] · BrickoERP and Bricko Homes support: [email protected] · Grievance Officer: Sreyas Nair, Director ([email protected]).

Previous versions: Rev. 2.2 (16 October 2026), superseded by Rev. 2.3 on 17 October 2026 (website analytics and sign-up source, Sections 4.6 and 4.7); Rev. 2.1 (11 October 2026), superseded by Rev. 2.2 on 16 October 2026 (Bricko AI, Section 5.7); Rev. 2.0 (9 October 2026); Privacy Policy, August 2026.