ToLetBook ("we", "us", "our") operates the ToLetBook mobile app and website (toletbook.in), a property management and rental platform connecting property owners and tenants in India. This policy explains what information we collect, why, and how it's handled.
1. Information we collect
Account information
Name, phone number, email address, and password (stored as a salted hash, never in plain text)
City and role (owner or tenant)
Government ID and identity verification
Aadhaar number and Aadhaar card photos — collected when an owner onboards a tenant, to record on the tenancy and (where used) on rental agreement paperwork. This is a legal requirement for rental documentation in India.
DigiLocker-verified identity — if you choose to verify your identity, we redirect you to DigiLocker (a Government of India service) via our verification partner, Cashfree Payments. We receive back your UIDAI-verified name only — we do not receive or store your Aadhaar number, biometrics, or any other DigiLocker document contents through this flow.
Financial information
Rent amount, deposit amount, and payment history you record in the app
UPI ID and bank account details, if an owner chooses to add them for receiving rent
Payments made through the app are processed by Razorpay, a licensed payment gateway — we do not store your card, UPI PIN, or net-banking credentials; Razorpay handles that directly under its own security standards
Photos and documents
Property photos, Aadhaar card photos, and (where applicable) uploaded rental agreement documents, which you choose to add via your device's camera or file picker
Location
If you choose to pin a property's location on the map, we collect the GPS coordinates you select. This is optional — the app works without it.
Automatically collected
Basic device and usage information (e.g. push-notification token, if you enable notifications) needed to operate the app reliably
Product usage analytics — which screens you visit and which buttons you tap — via PostHog, to help us understand which features are actually used. Session recording is switched off, and PostHog never captures what you type into any field. Aadhaar numbers, photos, and bank details are never sent to PostHog.
2. How we use your information
To operate core features: property listings, tenant onboarding, rent tracking, maintenance requests, and the TO-LET marketplace
To process real payments (rent, deposits, subscriptions, government e-stamp fees) via Razorpay
To verify identity via DigiLocker (through Cashfree) where you opt in
To generate government e-stamped rental agreements via our stamping partner, eSahayak, where you opt in (this feature is currently paused — see in-app notice)
To send you notifications about rent due dates, maintenance updates, and account activity
To prevent fraud and enforce our terms
3. Who we share information with
Partner
What they receive
Why
Razorpay
Payment amount, payer contact details
Processing rent, deposit, subscription, and e-stamp fee payments
Cashfree Payments
A verification request; they return your UIDAI-verified name
DigiLocker-based identity verification
eSahayak
Party names, property address, rent terms (no Aadhaar number)
Government e-stamp procurement for rental agreements, where opted in
Google (Maps, Sign-In)
Location you choose to pin; basic profile if you use Google Sign-In
Map display and optional Google login
PostHog
Screen visits and button taps, linked to an internal account ID (not your name, email, or phone)
Understanding which features are used, to improve the app
We do not sell your personal information to anyone. We do not share Aadhaar numbers or photos with any of the above partners — those stay on our servers.
4. Data storage and security
Your data is stored on servers we operate, secured over HTTPS in transit
Aadhaar numbers are encrypted at rest in our database
Passwords are stored as salted hashes, never in plain text
Only the owner and tenant party to a specific tenancy — and our support team when needed to resolve an issue — can see that tenancy's details
5. Your choices
DigiLocker verification, location pinning, and photo uploads are all optional
You can update your profile information at any time from Settings
You can request deletion of your account and associated data by contacting us at the email below — we'll delete what we can and explain if any records (e.g. completed payment records) must be retained for legal/accounting reasons
6. Children's privacy
ToLetBook is intended for adults (18+) entering into or managing rental agreements. We do not knowingly collect information from children.
7. Changes to this policy
We may update this policy as the app changes. We'll update the "Last updated" date above when we do.