Legal
Privacy Policy
Last updated 22 August 2026 · Applies to dinom.ai and the DINOM application
The short version. DINOM is business software sold to real-estate developers. Almost all the personal data that moves through it belongs to their enquiries and buyers, not to us — we hold it on the developer's instructions and we do not sell it, mine it across customers, or use it to train models. Where a developer connects an advertising account, we read cost and campaign figures and nothing else.
1. Who we are
DINOM (“DINOM”, “we”, “us”) operates dinom.ai and the DINOM application, a control surface used by real-estate developers in India to run sales and construction on one record.
DINOM is the trade name of a sole proprietorship registered in Gujarat, India. There is no company: the proprietor, and the person legally answerable for everything on this page, is Panchal Nisarg Prashantbhai.
Place of business: Ahmedabad, Gujarat, India
Contact: founders@dinom.ai
The full registered address is on our GST registration and is provided on request.
2. Two different roles, and why it matters to you
Which rights you have, and who you exercise them against, depends on which of these describes you. We keep the two apart because merging them would be convenient for us and misleading to you.
| If you are | Our role | What that means |
|---|---|---|
| A developer who licenses DINOM, or a member of their team with a login | Data Fiduciary | We decide what is collected about your account and why. Requests under section 4 come to us. |
| A homebuyer or enquiry whose details sit inside a developer's workspace | Data Processor | The developer decides what is held about you and for how long. We process it only on their instructions. Your rights are exercised against them; we will help them answer, and we act the moment they instruct us. |
| A marketing agency opening a brief link | Processor for the developer | We hold the brief, your proposals and the files you upload, on behalf of the developer who sent you the link. |
If you are a buyer and you do not know which developer holds your details, write to us and we will identify the workspace and pass your request on.
3. What we process
This is the full list, by category. If something is not here, we do not process it.
| Category | What it contains | Why |
|---|---|---|
| Account | Name, work email, role, workspace membership, sign-in timestamps | To give you a login, and to enforce which workspace you can see |
| Enquiries and buyers | Name, phone number, email where given, where the enquiry came from, budget and requirement notes, status history, site-visit records | Held for the developer so they can follow up on their own enquiries |
| Voice calls | Where the developer uses the AI voice feature: the recording, the transcript, a summary, and answers extracted from it such as budget or timeline | So the developer has a record of a call their own system placed |
| Messages | WhatsApp and in-app messages exchanged with an enquiry through DINOM | To deliver the message and keep the thread |
| Marketing work | Briefs, proposals, comments, and files an agency uploads against a brief | So a developer and their agency can agree work in one place |
| Connected advertising accounts | An access credential, and campaign, cost and conversion-count figures read from the platform. See section 5. | To show advertising spend against the developer's own sales figures |
| Technical | IP address, browser and device type, error reports, request logs | To keep the service running, and to investigate faults and abuse |
What we do not do
- We do not sell personal data, and we do not share it for anyone else's advertising.
- We do not combine one customer's data with another's. A workspace is isolated at the database, not by a filter in the application.
- We do not use customer data, call recordings or transcripts to train machine-learning models, ours or a vendor's.
- We run no advertising on this site and set no advertising cookies.
4. Your rights
Under the Digital Personal Data Protection Act, 2023, you may ask for access to your personal data, correction of anything inaccurate, erasure, and the identity of anyone we shared it with. You may withdraw consent at any time, and you may nominate someone to exercise these rights if you die or become incapacitated.
Write to founders@dinom.ai. We answer within 30 days. Deletion is set out in full at dinom.ai/data-deletion.
One honest limit. If you are a buyer, we cannot delete your record on your say-so alone — it is the developer's record, and they may have their own obligation to keep it. We will pass your request on, tell you which workspace it went to, and act the moment they instruct us.
5. Connected advertising accounts
A developer may connect their own Google Ads or Meta advertising account so that spend appears next to the enquiries it produced. This is optional. DINOM works without it, and spend is typed in by hand instead.
- We only read. We do not create, change, pause or delete campaigns, and we do not spend money.
- Google will ask you to grant more than we use. Its consent screen says DINOM may “see, edit, create and delete” your Google Ads accounts and data. That is because the Google Ads API has exactly one permission and no read-only version of it — it is the only thing Google can offer, not a description of what we do. What we actually do is the line above, and the Limited Use commitment further down binds us to it.
- What we read is cost, campaign and conversion-count figures. We do not read audience lists, customer-match lists, or any personal data held inside the advertising account.
- The credential is encrypted at rest. It is never shown in the application, never returned to a browser, and never written to a log.
- Disconnecting removes the credential immediately. Figures already read stay in the developer's own reporting until they delete them.
Google API Services — Limited Use
DINOM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Data obtained through Google APIs is used only to provide and improve the reporting features the developer connected it for. It is not sold; it is not transferred to third parties except as needed to provide that feature or as required by law; it is not used for advertising; and it is not read by a human except with the developer's explicit consent, for security purposes, or where the law requires it.
6. Who else touches the data
We use a small number of processors. Each is bound by contract to handle the data only for the purpose named here.
| Processor | What it handles | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | Region selected at setup; India where available |
| Vercel | Website and application hosting | Global edge |
| LiveKit, Sarvam AI, OpenAI | Voice calls: audio transport, speech recognition, and the model that speaks | Outside India |
| Vobiz | The telephony trunk that puts the call on a mobile network | India |
| Meta (WhatsApp Business Platform) | Delivery of WhatsApp messages | Outside India |
| Google, Meta (advertising APIs) | Source of connected spend figures. We read from them; we send them no personal data. | Outside India |
Some of these operate outside India, so personal data is transferred abroad in the course of providing the service. We do not transfer to any territory the Central Government has restricted under section 16 of the DPDP Act.
7. How long we keep it
- Enquiries, calls, messages and marketing work — for as long as the developer's workspace is active. On termination, deleted within 90 days, unless they ask for it back sooner or the law requires us to hold it.
- Account records — while the account exists, then 90 days.
- Advertising credentials — until disconnected, then at once.
- Technical logs — up to 12 months.
- Records the law requires us to keep — invoices and tax records, for the statutory period.
8. Security
Every workspace is separated at the database by row-level security, so a query that escapes the application still cannot cross into another customer's data. Credentials for connected accounts are held in an encrypted secrets store and are not readable by the application's ordinary queries. Traffic is encrypted in transit. Access to production is limited to named people and is logged.
No system is perfect. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the DPDP Act requires.
9. Calls, and who is answerable for them
Where a developer uses the voice feature, DINOM places the call on their behalf and at their instruction. The developer is responsible for having a lawful basis to contact that person, for honouring Do Not Disturb registration and TRAI's telecom rules, and for stopping when asked to. The call announces that it is an automated assistant. We keep the recording for the developer and use it for nothing else.
10. Children
DINOM is business software and is not directed at children. We do not knowingly process the personal data of anyone under 18. If you believe we have, write to us and we will delete it.
11. Cookies
The application sets only cookies that are strictly necessary: your sign-in session, and a short-lived cookie during a connection handshake that exists to prevent request forgery. This website stores your light or dark preference in your own browser. Neither carries analytics or advertising cookies.
12. Changes
If we change this policy in a way that materially affects you, we will say so in the application and by email to workspace administrators before it takes effect. The date at the top always reflects the current version.
13. Grievance officer
Under the DPDP Act and the Information Technology (Intermediary Guidelines) Rules, you may raise a complaint with our Grievance Officer:
Name: Panchal Nisarg Prashantbhai
Email: founders@dinom.ai
Ahmedabad, Gujarat, India
DINOM is a sole proprietorship, so the Grievance Officer and the proprietor are the same person. That is stated rather than dressed up as a department, because a name you can write to is worth more than a title nobody holds.
We acknowledge within 24 hours and resolve within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.