Privacy Policy

Zameen Mitra

Last updated: 19 September 2026

1. WHO CONTROLS YOUR DATA

Zameen Mitra is operated by Midpath Software Private Limited ("Midpath", "we", "us"), 95-B, Vidhyut Nagar, Jaipur – 302019. This Policy explains how we handle personal data in connection with our platform and services.

Grievance Officer: Arjoonn Sharma
Email: grievance@midpathsoftware.com
Address: Midpath Software Private Limited, 95-B, Vidhyut Nagar, Jaipur – 302019

Security and suspected data-breach reports: security@midpathsoftware.com

2. DATA WE COLLECT

Depending on how you use the platform, we may collect:

• Account and contact data, such as your phone number and account identifiers;
• authentication, consent, login, security, SMS, and WhatsApp communication records;
• transaction, wallet, invoice, and service-request records;
• property identifiers and details needed for requested services;
• photographs, locations, measurements, and other material submitted for GPS surveys or related services;
• support requests and communications;
• device, browser, IP address, cookie, session, usage, and diagnostic information;
• advertising identifiers and attribution data, including Google gclid, wbraid and gbraid identifiers and Meta click identifiers; and
• payment and conversion information associated with advertising attribution.

Payment-card and banking credentials are processed by Razorpay. Midpath does not receive or store full card credentials.

Government documents and user submissions may contain personal data about owners, neighbours, family members, occupants, or other persons who are not the account holder. We handle personal data in our possession under this Policy even where it originated from a government system. Users must have a lawful basis to submit another person's personal data.

3. HOW WE USE DATA

We process data as necessary to:

• create, authenticate, and secure accounts;
• accept payment, maintain wallet and accounting records, and prevent fraud;
• locate documents and provide reports, ownership chains, mediation, consultation, khata/khasra discovery, GPS surveys, and related services;
• permit employees or contractors to validate outputs and perform quality control;
• send requested OTPs and service updates by SMS or, where consented, WhatsApp;
• provide support and respond to rights requests;
• maintain, analyse, troubleshoot, and improve the platform;
• measure Google and Meta advertising performance and report eligible conversions;
• establish, exercise, or defend legal claims and comply with law.

Automated tools may assist with locating records, generating reports, quality checks, fraud prevention, and advertising measurement. We do not use solely automated processing to make decisions that produce legal or similarly significant effects concerning users.

We rely, as applicable, on your consent, steps requested by you before or during our service relationship, performance of our agreement, compliance with legal obligations, and other grounds permitted by applicable law. Data identified as required when collected is needed to provide the relevant account or service; without it, we may be unable to fulfil the request. Optional data may be refused without affecting unrelated services.

You may withdraw consent for future optional processing as easily as it was given, including through the relevant account or communication setting or by emailing grievance@midpathsoftware.com. Withdrawal does not affect processing already lawfully completed.

4. SHARING AND SERVICE PROVIDERS

We do not sell personal data. We disclose only what is reasonably required to:

• Linode, for infrastructure hosting;
• Razorpay, for payment processing;
• 2Factor, for SMS OTP delivery;
• Meta/WhatsApp, where WhatsApp messaging is selected;
• Google and Meta, for advertising measurement and conversion attribution;
• employees and independent contractors performing or validating a requested service; and
• advisers, courts, regulators, law-enforcement authorities, or other persons where required by law or necessary to protect rights and security.

Consultants receive property details needed for their assignment, but are not given the customer's phone number for service delivery. Employees and contractors are subject to confidentiality, purpose and access restrictions, security obligations, and requirements to return or delete data when it is no longer required. Access is limited to assigned work.

Providers process data under their own terms and applicable safeguards. Some providers may process data outside India. Where required, we use contractual or other legally recognised safeguards and comply with restrictions imposed by Indian law.

Our analytics is operated using a self-hosted Umami installation. It helps us understand platform use; associated technical information remains on infrastructure controlled by or for Midpath.

5. COOKIES AND ADVERTISING IDENTIFIERS

We use cookies and similar storage for login sessions, security, preferences, analytics, and advertising attribution. Advertising parameters may be stored so a later payment can be attributed to a Google or Meta advertisement. We may send the relevant advertising identifier, conversion time, transaction reference, and conversion value to the applicable advertising provider. You can reject or delete non-essential cookies through available cookie controls or browser settings; essential platform functions may then fail. Rejecting advertising storage does not affect unrelated paid services.

6. RETENTION AND DELETION

Unless a longer period is required by law or necessary for an active dispute, investigation, or legal claim, we generally retain:

• service documents, photographs, measurements, and GPS data for three years after service completion;
• account, support, consent, communication, and security records for three years after account closure;
• financial, tax, wallet, and transaction records for eight years; and
• advertising identifiers and attribution records for one year.

Backup data follows the same applicable retention period and is then removed through the ordinary backup deletion cycle. Data may be deleted or de-identified earlier when no longer needed.

You may request closure of your account and deletion of eligible personal data controlled by Midpath. We will delete or de-identify eligible account personal data through our operational retention process. We may retain financial, legal, fraud-prevention, security, and transaction records where required or reasonably necessary, while restricting their use to those purposes.

A deletion request does not remove public records or original documents held on government systems. It also does not require Midpath to alter an official government record. Where a government document is obtained as part of a service, retention or deletion is subject to legal obligations and the need to document that service.

Backup copies will not be restored for active use except for disaster recovery or legal necessity.

7. YOUR CHOICES AND RIGHTS

Subject to applicable law and identity verification, you may ask us to:

• confirm whether we process your personal data;
• provide access to, or correct, eligible personal data;
• withdraw consent for future optional processing;
• close your account and delete eligible personal data controlled by Midpath;
• nominate another person to exercise applicable rights in the event of your death or incapacity, where this right applies; or
• address a privacy grievance.

Requests should be sent to grievance@midpathsoftware.com from or with sufficient proof of the account concerned. We will acknowledge grievances within 48 hours and seek to resolve them within 30 days. We may refuse or limit a request where the data is not controlled by Midpath, the request would affect another person's rights, or retention is required or permitted by law. If you remain dissatisfied, you may use any escalation or complaint mechanism available under applicable data-protection law.

8. SECURITY

We use reasonable administrative, technical, and organisational safeguards appropriate to the data and service, including access controls and measures intended to detect and respond to security incidents. No internet transmission, third-party system, or storage method can be guaranteed completely secure. Users should protect their devices and promptly report suspected unauthorised account use to security@midpathsoftware.com. We will investigate personal-data breaches and notify affected persons and authorities where and within the time required by law.

9. CHILDREN

The platform is for persons aged 18 or older. We do not knowingly offer accounts to children. If you believe a child has provided account PII, contact us.

10. CHANGES AND BUSINESS TRANSFERS

We may update this Policy as our services, providers, or legal obligations change. Material changes will be notified through the platform or another reasonable channel. If Midpath undergoes a merger, acquisition, restructuring, or asset transfer, relevant data may transfer subject to this Policy and applicable law.

11. CONTACT

Privacy requests and complaints:
Arjoonn Sharma, Grievance Officer
grievance@midpathsoftware.com

Security reports: security@midpathsoftware.com
Legal questions: legal@midpathsoftware.com

Midpath Software Private Limited
CIN: U72900RJ2021PTC076949
95-B, Vidhyut Nagar, Jaipur – 302019