Privacy Policy

This Privacy Policy describes how Bhoomi Dwellers (“we”, “us”, or “our”) collects, uses, stores, and shares information in connection with:

• The Bhoomi Dwellers CRM web application, hosted at www.bhoomidwellers.com; and
• The associated Android application (package ID: com.bhoomidwellers.crm) provided for mobile access.

This policy applies to authorized employees and users of the Bhoomi Dwellers CRM only. It does not apply to third-party services or websites that may be linked from within the application.

By using the application, you acknowledge that you have read and understood this policy.

Bhoomi Dwellers operates a real-estate Customer Relationship Management (CRM) platform used internally by its employees to manage leads, customer enquiries, bookings, site visits, and related sales activity. The system is a private, business-facing application. It is not a consumer application open to the general public.

This policy covers the information that the CRM system collects and processes as part of its normal operation, including:

• Information about authorized employees and users who log in to the system;
• Information about leads, customers, and enquiries entered into the CRM by authorized employees;
• Technical, device, and usage information collected automatically during system operation.

3.1 Account and Authentication Information

When an authorized employee logs in, the following information is collected and stored:

• Name and email address — used to identify the user and authenticate their session.
• Role — the employee's assigned CRM role (e.g., Admin, Sales Manager, Caller, Receptionist, Site Head, Sourcing Manager), which determines their access level.
• Password — stored in a securely hashed format. Plaintext passwords are never stored or transmitted after entry.
• Session data — a secure, HttpOnly session cookie is issued upon login to exclusively identify the authenticated session.

3.2 Customer, Lead, and CRM Information

Authorized employees enter and manage records about prospective customers and real-estate enquiries. This information is entered by employees on behalf of the business and may include:

• Customer and lead names, phone numbers, email addresses, and physical addresses.
• Enquiry details such as property interest, budget, source channel, and status.
• Site visit records, follow-up notes, and booking information.
• Financial information related to bookings (amounts, payment schedules — no payment card data is collected).
• Channel partner and commission information.

3.3 Device and Technical Information

When an employee logs in or uses the application, the following technical information is automatically collected:

• IP address — recorded at login for security and audit purposes.
• Device details — used to identify the device type, operating system, and browser (e.g., “Android Device”).
• Session timestamps — login time, last heartbeat, and session activity timestamps.

3.4 Location Information

Location is required to log in. When an employee attempts to log in to the CRM, the application requests precise GPS coordinates from the device. This is enforced securely: a login request is rejected if valid GPS coordinates are not provided.

• Location is obtained at the time of login only. The application does not track location continuously in the background.
• The GPS coordinates provided at login are stored on the employee session record to verify presence and for attendance management.
• Coordinates are reverse-geocoded into a human-readable location name via a secure geocoding service partner. Only the coordinates are sent; no account identifiers are included.

3.5 Call and Communication Information

The CRM includes functionality for employees to initiate and log communications to leads and customers:

• Call session records — metadata including lead ID, phone number dialled, employee identifier, and call duration/status are recorded. Phone numbers are always read from the database, never supplied directly at call time.
• Call recordings — audio files uploaded manually by an employee are stored securely in cloud-based object storage. Recordings are accessible only to authorized employees.
• Telephony integrations — the system optionally integrates with telephony and AI voice partners for click-to-call and AI-assisted calls. When enabled, necessary phone numbers are securely transmitted to these service partners to facilitate the call.
• WhatsApp messaging — the system optionally integrates with official messaging partners to send communications to leads. Message logs are stored securely in the CRM database.

3.6 Employee Activity and Telemetry

The CRM collects employee activity information for operational management:

• Session heartbeats — while logged in, the application periodically registers the current CRM module and idle status to power a live activity view for administrators.
• Activity logs — actions such as opening a lead, adding a follow-up, or scheduling a visit are recorded.
• Attendance records — employees mark their attendance, capturing login times and status.
• Audit logs — sensitive actions (such as failed logins or record deletions) are logged for security oversight.

3.7 Media and File Access

The Android application declares permissions related to media and file access to support core functionality:

• READ_MEDIA_AUDIO — used to read and upload audio files (call recordings) from the device.
• READ_EXTERNAL_STORAGE — used for file access on older Android versions.

3.8 Cookies and Local Storage

The application uses a secure session cookie to maintain authenticated sessions. This cookie is set upon login and expires after 7 days. No third-party advertising or tracking cookies are used. Local storage may be used solely to store interface preferences (such as color themes), which do not leave your device.

Information collected through the CRM is used for the following purposes:

• Authentication and access control — to verify employee identity and enforce role-based access.
• CRM operations — to enable employees to manage real-estate leads, enquiries, and bookings.
• Workforce management — to record employee login times, locations, and attendance.
• Communication — to facilitate integrated phone calls and messaging services.
• Security and audit — to detect unauthorized access attempts and maintain operational audit trails.
• Operational notifications — to send essential security emails (e.g., login alerts).

We do not sell personal information to third parties. Information may be shared in the following limited circumstances:

• Within the organization — CRM data is visible to authorized employees based on role permissions.
• Service providers — we use specialized cloud infrastructure providers to operate the application securely. Each provider receives only the data necessary to provide their service.
• Legal requirements — we may disclose information if required by applicable law, court order, or legitimate governmental authority.

The application relies on trusted enterprise service providers to deliver secure and reliable functionality:

Application data and call recordings are stored securely using enterprise-grade cloud infrastructure hosted in the Asia-Pacific region.

We implement reasonable technical and organizational safeguards to protect the information we hold, including:

• Session cookies are HttpOnly, Secure, and cryptographically signed.
• All database connections and application traffic are strictly encrypted via TLS/SSL.
• Role-based access control is enforced at both the application and API layers.
• Significant administrative and security events are actively logged.
• The Android application enforces strict HTTPS security policies for all WebView traffic.

While we utilize industry-standard practices, no security measure is absolute. We cannot guarantee the security of information in all circumstances.

Information entered into the CRM is retained for as long as it is reasonably necessary for the business, operational, legal, or audit purposes described in this policy.

Uploaded call recordings may be permanently deleted by authorized administrators from within the application. All deletions are permanently logged in the system audit trail.

Employee session records, attendance records, and activity logs are retained as part of ongoing CRM operations.

As the Bhoomi Dwellers CRM is a private business application used by authorized employees, the following applies:

• Employees may update their profile information and password through the application's Settings page.
• Employees may view their own session history and actively terminate their live sessions.
• Employees who wish to request correction or deletion of their information may contact their system administrator.
• Location access may be denied in device settings; however, denying location permission will prevent login to the application, as location is a required input for authentication.

The Android application (package ID: com.bhoomidwellers.crm) requires the following permissions to function:

The application does not use camera, microphone, contacts, SMS, or background location permissions. No advertising SDKs are included.

The Bhoomi Dwellers CRM is a private business application intended for use exclusively by adult employees of Bhoomi Dwellers. It is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date at the top of this page. We encourage users to review this page periodically.

Continued use of the application after changes are published constitutes acceptance of the updated policy.

If you have questions, concerns, or requests related to this Privacy Policy or the handling of your personal information, please contact us: