Privacy Policy

By using and/or accessing the Casa Quanto website (“Platform”), the User (hereinafter referred to as “You”, “Your” or “Yourself”) consent to this privacy policy (“Policy”) with Idyaite Technology Solutions Private Limited, a company incorporated under the laws of India (hereinafter referred to as the “Company”, “Idyaite”, “We”, “Us”, or “Our” and terms of similar meaning), the owner and administrator of the Platform.

We respect the privacy of our Users and are committed to protecting Your Personal Data. This Privacy Policy explains how Your Personal Data is collected, used, disclosed, stored, and otherwise processed by Us, in the capacity of a Data Fiduciary, in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Rules (“DPDP Rules”) made thereunder, or the analogous Applicable Laws based on Your jurisdiction, as may be amended from time to time. This Policy also describes the choices available to You including the manner in which You may access, review, update, correct such Personal Data. If You do not agree with the terms of this Privacy Policy, You must not access or use the Platform or the Services.

This Privacy Policy, together with its Annexures, shall be read in conjunction with the Terms of Use and any other policies, terms, or documents expressly referenced therein. In the event of any conflict between the Terms of Use and this Privacy Policy, the provisions of this Policy shall prevail to the extent of such inconsistency, unless expressly provided otherwise.

1. Applicability.

This Policy applies to all Users (whether individuals or organizations) who access or use the Platform, irrespective of the country or jurisdiction from which the Platform is accessed or used. As the Platform is accessible to Users globally, this Policy is designed to address the privacy and data protection requirements applicable to the processing of Personal Data under relevant Applicable Laws. Depending on the User’s jurisdiction, the User may be entitled to certain rights and protections under applicable privacy and data protection laws, as further set out in Annexure A to this Policy.

2. Definitions.

1. “Applicable Laws” means all applicable statutory laws, rules, regulations, notifications, directions, and judicial orders in force within the territory of India, including the DPDP Act, 2023, the DPDP Rules, 2025, the Information Technology Act, 2000, and any rules or notifications framed thereunder; and, in relation to Users accessing or using the Platform from jurisdictions outside India, the applicable privacy and data protection laws specified in Annexure A.
2. “Artificial Intelligence” or “AI” means the automated computational algorithms, machine learning models, and generative design tools deployed on or integrated with the Platform.
3. “Data Fiduciary” means any person who, alone or in conjunction with other persons, determines the purpose and means of processing of Personal Data and, where appliable, includes any person or entity that is referred to as a ‘Data Controller’ or by any other analogous term under applicable data protection or privacy laws in jurisdictions outside India.
4. “Data Processor” means any person who processes personal data on behalf of a Data Fiduciary.
5. “Data Principal” means the individual (You), to whom the Personal Data relates and, where applicable, includes any person or entity that is referred to as a ‘Data Subject’ or by any other analogous term under applicable data protection or privacy laws in jurisdictions outside India.
6. “Grievance Officer” means the officer designated by the Company to handle queries, process User rights’ requests, and resolve grievances raised by the Users regarding the processing of their Personal Data under this Policy.
7. “Personal Data” means any data about an individual who is identifiable by or in relation to such data, collected or processed by the Company through or in connection with the Platform.
8. “Central Government” means the Central Government of India, exercising administrative, regulatory, and rule-making authority under the Applicable Laws.
9. “Platform” means the online webpage, digital interface, and associated web domains of Casa Quanto operated by the Company and utilized by the Users to avail of the Services.
10. “Services” means the various services offered on the Platform to Users from time to time, including but not limited to Smart Floor Plan Analysis, Room-by-Room Customizer, Style Curated Catalogue and AI Design and Interior Design Partner Assistance.

3. Information We Collect.

1. During Your access to Our Platform, We may collect and process various categories of Your Personal Data, provided voluntarily by You, including the following:

1. During the initial account registration and subscription plan selection on the Platform, We collect information including Your full name, mobile number, e-mail address (optional), billing details, and postal ZIP/pin code.
2. When You purchase any of Our subscription plans, We may collect all information necessary to complete the transaction including your name, credit/debit card information and other essential billing information. We will not however, store the aforementioned financial information in Our databases.
3. If You provide Us with feedback or contact Us via email, We will collect Your name and email address, as well as any other content included in the aforementioned email, in order to send You a response.
4. When You post reviews on Our platform, the information contained in Your posting (i.e. Your name, city and country) will be stored on Our servers and other Users will be able to see it as well.

1. In addition to the information voluntarily provided by You, We automatically record and process certain technical and usage-related Personal Data (generated when You navigate, browse or utilize the Platform) to make our Platform and Services more useful to You. We use this information, which does not identify individual Users, to analyze trends, to administer the Platform, to track Users’ movements around the Platform and to gather demographic information about our User base as a whole. We may link this automatically-collected data to Personal Data for the purposes of security and to detect fraudulent activity. Such information may include the following:

1. Your Internet Protocol (IP) address, mobile device unique identification numbers, operating system type and version, browser specifications, and hardware characteristics.
2. We also collect log data detailing Your interactions with the Platform, such as timestamps of access, duration of active sessions, feature utilization, interactions with the AI summaries, clickstream paths, and referring URLs.

4. Consent Requirements.

1. We process Your Personal Data on the basis of Your consent, signified through Your clear affirmative action by signing up on the Platform. When You register an account on this Platform and choose a subscription plan, pursuant to signing up, You consent to Our collection, storage, use, disclosure and other processing of Your Personal Data, including cache information, for the purpose of making the Platform and/or Our Services available to You. You will be presented with a clear notice requesting Your consent for Us to process Your Personal Data for specific purposes.
2. When You create an account on the Platform, We may periodically send You free newsletters and e-mails that directly promote the use of Our Platform or Services. When You receive newsletters or promotional communications from Us, You may indicate a preference to stop receiving further communications from Us and You will have the opportunity to ‘opt-out’ by following the unsubscribe instructions provided in the e-mail You receive (or) by adjusting Your email preferences from within your account setting page (or) by contacting Our Grievance Officer directly.
3. You possess the absolute statutory right to withdraw Your consent for the processing of Your Personal Data on this Platform at any time. You may exercise this right by submitting a written request to our designated Grievance Officer by sending an email to grievance@idyaite.ai. The withdrawal of consent operates prospectively and shall not affect the lawfulness of processing any Personal Data prior to such withdrawal. In case You choose to withdraw Your consent, then Your access to the Platform may be limited, since the provision of our Services relies on essential Your Personal Data. In such cases, We might not be able to provide Our Services to You.

5. Purpose of Processing.

1. We shall process Your Personal Data collected through the Platform strictly for lawful and specific purposes to provide the Services requested by You. The specific purposes for which Your Personal Data is collected and processed are as provided below:

1. To establish, operate, personalize and maintain Your account on Our Platform. This includes verifying Your identity during signing up, facilitating Your choice and purchases of interior design subscription plans, configuring Your account dashboard, and enabling access to Our AI-powered design features, preliminary layouts, and portfolio catalogues that are tailored as per Your requirements.
2. If You reach out to Us with questions, request design consultation details, or seek assistance regarding subscription plans, We may process Your contact details and communication logs specifically to respond to You, address Your queries, and provide effective customer support.
3. All technical and automated usage data are processed to monitor the performance and structural health of Our Platform. This allows Us to diagnose technical glitches, maintain network integrity, ensure optimal server responsiveness, and improve the overall usability of Our digital interface.
4. Automatically collected usage data are processed to conduct statistical analysis, internal research, analyze design trends, evaluate the popularity of different subscription plans, and understand the overall Platform engagements. This helps Us refine Our AI algorithms and enhance Our catalogues.
5. To protect Our Platform, Users, and business operations, We process personal and technical data to detect, prevent, investigate, and respond to potential security threats, unauthorized access, fraudulent subscription transactions, and other malicious activities.

6. Data Sharing and Disclosure.

1. We do not sell, rent, or trade Your Personal Data to any third party for independent commercial or marketing purposes. We disclose or share Your Personal Data to any of Our affiliates and subsidiaries strictly on a need-to-know basis for specified, lawful purposes directly related to the Services provided by Us.
2. Depending on Your interactions on Our Platform and Your chosen subscription plan, Personal Data may be shared with the following categories of recipients of the Personal Data:

1. To enable the custom design and preliminary planning stages of Your chosen subscription plan, We share Your Personal Data with Our in-house interior designers or with third-party interior designers whom You have selected and onboarded on the Platform.
2. We may engage certain trusted third-party service providers as Data Processors who may process Your Personal Data in a secure and confidential manner on Our behalf, strictly adhering to the contractual instructions documented between the Data Processor and Us. These include, but are not limited to, cloud hosting providers operating servers within India, and payment gateways for subscription billings. The aforementioned Data Processors are required not to use Your Personal Data other than to provide the Services requested by You on the Platform.
3. We may disclose Your Personal Data to government agencies, regulatory bodies, courts, or law enforcement entities when required to comply with Applicable Laws, judicial orders, decrees, or statutory obligations.
4. In the event of any business restructuring or sale of Company assets, Your Personal Data may be transferred as a part of the business transactions, subject to the successor entity honoring the commitments made under this Privacy Policy.

1. Any cross-border transfer of Personal Data shall be strictly governed by the Applicable Laws established by the Central Government governing the same. The Company shall not transfer Personal Data to any country, territory, or jurisdictions outside India that is notified or restricted by the Central Government. Where cross-border transfers are permitted, We ensure that appropriate contractual, technical, and organizational safeguards are taken to maintain the security and confidentiality of Your Personal Data.
2. You acknowledge that the terms of this Privacy Policy do not apply to any websites You are redirected to in the event of You clicking on any link on Our Platform that navigates You to another website. We have no control over, do not review, and cannot be responsible for, these outside websites or their content. We will not, without your express consent, disclose Your Personal Data to third parties for the purposes of direct marketing.

7. Cookies and Tracking Technologies.

1. We may use cookies, web beacons, pixels, software development kits (SDKs) and similar technologies on the Platform to enable and secure the Platform, remember Your preferences, analyse usage and improve the functionality and User experience of the Services. Cookies are small text files stored on Your device that enable the Platform to recognise Your device, maintain sessions and remember certain preferences.
2. We may use session cookies, which expire when You close the Platform, and persistent cookies, which remain on Your device for a specified period or until deleted. These technologies may include essential cookies required for the operation and security of the Platform, as well as functionality, preference, analytics and performance cookies.
3. Where any non-essential cookies or tracking technologies involve the processing of Your Personal Data and require consent under Applicable Law, We shall obtain such consent through an appropriate cookie banner or preference-management mechanism. You may manage, modify or withdraw Your preferences for such technologies at any time through the available Platform settings or other mechanisms provided by Us.
4. Disabling or deleting certain cookies may affect the availability or functionality of certain features of the Platform.

8. Data Storage and Security.

1. The Platform implements commercially reasonable technical, organizational, and administrative measures to safeguard Your Personal Data, including access controls, encryptions, secure storage, and regular security assessments.
2. All Personal Data collected through Our Platform is stored in password protected systems, protected by firewalls, and hosted within encrypted cloud environments operating on secure infrastructures within India.
3. Access to personal, billing, and preliminary project information is restricted to the authorized team members, in-house designers, and designated service providers who require such access for the purpose of providing the specific Services.
4. We employ industry-standard protocols, including User authentications, and secure data backups to protect Your Personal Data from unauthorized access, loss, misuse, alteration, or destruction.
5. In the event of a Personal Data breach compromising the security, confidentiality, or integrity of your Personal Data, the Company shall immediately take action and remedial measures as under Applicable Law.
6. While We strive to safeguard and protect Your Personal Data, no transmission over the internet or storage system can be completely secure. You are therefore encouraged to maintain the confidentiality of the credentials of Your User account and exercise caution when transmitting your Personal Data digitally.

9. Data Principal Rights.

1. As a Data Principal, You may exercise your statutory rights of access, correction or erasure of Your Personal Data; nominate any other individual to exercise Your rights; withdraw Your consent and obtain redressal for any grievance relating to Your Personal Data processed on Our Platform.
2. You can exercise these rights directly by submitting a formal request by email to Our Grievance Officer using the contact details provided at the end of this Policy. To protect Your privacy and security, We may require reasonable account credentials to verify Your identity before fulfilling Your request.
3. You may delete Your account by submitting an email requesting such deletion to the Grievance Officer. On receipt of the same, the Company shall, within a reasonable time, cease and cause its Data Processors to cease the processing of Your Personal Data.

10. Children’s Data.

1. This Platform and the Services offered are strictly intended for individuals who have attained at least eighteen (18) years of age. The Company does not knowingly solicit, collect, process, or store Personal Data relating to minors or children under the age of eighteen (18) years of age.
2. If the Company becomes aware that the Personal Data of a minor has been inadvertently collected without verifiable parental or legal guardian consent, We shall take prompt steps to permanently erase such Personal Data from Our active databases and servers. If You are a parent or legal guardian and believe that Your child/ward has submitted their Personal Data through Our Platform, please notify Our Grievance Officer immediately so that appropriate corrective action can be taken.

11. Data Retention and Erasure.

1. We shall retain Your Personal Data only for as long as reasonably necessary to fulfil the purposes for which it was collected and processed, including for providing and administering the Services, managing Your account and subscription, providing customer support, maintaining business and transaction records, ensuring the security and integrity of the Platform, complying with legal and regulatory obligations, resolving disputes and enforcing Our agreements.
2. Upon termination or deletion of Your account, We may retain certain Personal Data and other information for a reasonable period where necessary for the purposes set out above, including for archival, legal, regulatory, security, fraud prevention, dispute resolution or record-keeping purposes. Where a specific retention period is prescribed or permitted under Applicable Laws, We shall retain such Personal Data for the applicable period. Otherwise, Personal Data shall be retained only for so long as reasonably necessary for the relevant purpose and shall thereafter be securely deleted, anonymized or irreversibly de-identified.
3. Where You withdraw consent for the processing of Your Personal Data or request deletion of Your Personal Data, We shall, subject to Applicable Laws and any other lawful basis for continued processing, cease the relevant processing and delete, anonymize or irreversibly de-identify the Personal Data that is no longer required to be retained. Your withdrawal of consent or deletion request shall not affect the lawfulness of processing carried out prior to such withdrawal or request.
4. Notwithstanding the foregoing, We may retain anonymized or aggregated information, including statistical information, processing logs, traffic data and technical records that do not identify You, for as long as reasonably necessary for legitimate business, analytical, security or operational purposes, or as required or permitted under Applicable Laws.
5. Where Personal Data is required to be retained beyond the period otherwise applicable due to a legal, regulatory, contractual, security or dispute-related requirement, such Personal Data shall be retained only for the period necessary to satisfy that requirement and shall thereafter be securely deleted, anonymized or irreversibly de-identified in accordance with Our applicable data retention practices.

12. Amendments.

1. The Company reserves the right to update, modify, or revise this Privacy Policy and any Annexures hereto at any time to reflect changes in Our business practices, technological advancements, or Applicable Laws. Minor changes to the Policy shall be indicated by updating the ‘Last Updated’ date at the top of this Policy while major changes shall be communicated sending a notification to Your registered email address/mobile number prior to the changes taking effect.
2. Your continued access to or use of the Platform following the notification or publication of an updated Privacy Policy constitutes Your acknowledgement and acceptance of the revised terms. We encourage You to review this Policy periodically to remain informed about how We process Your Personal Data.

13. Grievance Redressal.

1. If You have any questions, concerns, or complaints regarding this Privacy Policy or the processing of Your Personal Data, You have the right to seek efficient and transparent redressal of your queries and grievances through Our designated Grievance Officer.
2. The Company shall acknowledge receipt of Your grievance within 8 hours and shall make reasonable efforts to investigate, resolve, and respond to Your grievance within 3 days.
3. The complete contact details of Our Grievance Officer are as follows:

Name: Mr. Rajasimha Karanam

Designation: Chief Executive Officer

Email: Rajasimha.karanam@idyaite.ai

Phone No.: 9845966134

Timings: 9:00am to 5:00pm IST

ANNEXURE A

Jurisdiction-Specific Provisions

The provisions set out below apply in addition to the Privacy Policy where applicable based on Your location or the data protection laws governing the processing of Your Personal Data. In the event of any inconsistency between these provisions and the remainder of this Privacy Policy, these provisions shall prevail to the extent required by Applicable Law.

1. European Economic Area and the United Kingdom.

1. If You are located in the European Economic Area (“EEA”), the processing of Your Personal Data may be subject to the Regulation (EU) 2016/679 (“GDPR”), where the GDPR applies to Our processing activities.
2. In addition to the rights available to You under this Policy, You shall have the additional rights to:

1. Request restriction of Us processing Your Personal Data;
2. Request the portability of Your Personal Data; and
3. Object to certain processing of Personal Data, including processing based on legitimate interests and, where applicable, direct marketing.

1. Where Your Personal Data is transferred from the EEA to a country outside the EEA, We will take steps to ensure that such transfer is carried out in accordance with Chapter V of the GDPR, including, where applicable, on the basis of an adequacy decision, appropriate safeguards such as the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism.
2. If You are located in the United Kingdom (“UK”), the processing of Your Personal Data may be subject to the UK GDPR and the Data Protection Act, 2018.
3. Where the UK GDPR applies to such transfers, We will comply with the applicable requirements governing restricted transfers of Personal Data outside the UK. Depending on the circumstances, this may include relying on UK adequacy regulations, implementing appropriate safeguards such as the UK International Data Transfer Agreement (“IDTA”) or UK Addendum to the European Union Standard Contractual Clauses, or relying on another lawful transfer mechanism permitted under the UK GDPR.

2. China.

1. If You are located in the People’s Republic of China (“China”), the processing of Your Personal Data may be subject to the Personal Information Protection Law of the People’s Republic of China (“PIPL”) and other Applicable Laws and regulations relating to the protection of personal information.
2. References in this Privacy Policy to ‘Personal Data’ shall include ‘Personal Information’ as defined under the PIPL and references to ‘Data Fiduciary’ shall, where applicable, include the concept of a ‘Personal Information Processor’ under the PIPL.
3. Where We transfer Personal Information collected from You in China, outside China, We will take such measures as may be required under applicable Chinese laws and regulations governing cross-border provision of Personal Information.

3. Brazil and Other South American Jurisdictions.

1. If You are located in Brazil, the processing of Your Personal Data may be subject to Law No. 13, 709/2018 - Lei Geral de Proteção de Dados Pessoais (“LGPD”). For the purposes of the LGPD, Data Fiduciary shall, where applicable, include the concept of a ‘Controlador’ under the LGPD.
2. In addition to the rights specified in this Privacy Policy, You shall have the right to:

1. Request the anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed Personal Data;
2. Request the portability of Your Personal Data subject to the applicable regulations;
3. Obtain information about the public or private entities with which We have shared your Personal Data; and
4. Obtain information about how to and the consequences of refusing consent.

1. Where we transfer Personal Data from Brazil to another country, we will carry out such transfer in accordance with the requirements and safeguards applicable to international transfers under the LGPD and regulations issued by the Brazilian data protection authority, where applicable.
2. If You are located in a country other than Brazil in South America, the applicable data protection or privacy laws of that country shall apply to Our processing of Your Personal Data.

4. Canada.

1. If You are located in Canada, the processing of Your Personal Data may be subject to the applicable Canadian federal or provincial privacy legislation including the Personal Information Protection and Electronic Documents Act ("PIPEDA"); the Personal Information Protection Act, SBC 2003, c 63 (British Columbia); the Personal Information Protection Act, SA 2003, c P-6.5 (Alberta); and the Act respecting the protection of personal information in the private sector, CQLR c P-39.1 (the "Quebec Private Sector Act"), where applicable. ‘Personal Data’ includes ‘personal information’ as defined under the PIPEDA.
2. Where the Company uses Your Personal Data to render a decision based on automated processing, the Company will inform You of this at or before the time of the decision. On request, You may obtain the personal information used to render the decision, the reasons and the principal factors that led to it, and may have the decision reviewed by a member of the Company’s personnel.
3. Where applicable Canadian privacy laws impose requirements in relation to the transfer or disclosure of Personal Data outside Canada, we will take the measures required by those laws. Personal Data transferred outside Canada may be subject to the laws of the jurisdiction in which it is processed and may be accessible to governmental authorities or law enforcement agencies in accordance with Applicable Law.

5. Australia.

1. If You are located in Australia, the processing of Your Personal Data may be subject to the Privacy Act 1988 (Cth), as amended from time to time (the "Privacy Act"), including the Australian Privacy Principles set out in Schedule 1 to the Privacy Act. ‘Personal Data’ includes ‘personal information’ as defined under the Privacy Act.
2. The Company uses AI tools to generate the Design Output based on personal information You provide, including uploaded floor plan images and stated style and room-type preferences. Where such use could reasonably be expected to significantly affect Your rights or interests, the Company will, in accordance with Australian Privacy Principle 1.7 (effective from 10 December 2026), describe in this Policy:

1. The kinds of personal information used in the operation of the relevant automated processes;
2. The kinds of decisions made solely by such automated processes; and
3. The kinds of decisions for which such automated processes do a thing that is substantially and directly related to the making of the decision.

1. The Company is based in India, and Personal Data collected from Australian residents is transferred to, and processed on, servers located in India. Before disclosing Personal Data to an overseas recipient, the Company takes such steps as are reasonable in the circumstances to ensure that the recipient does not breach the Australian Privacy Principles in relation to that Personal Data, except where an exception under Australian Privacy Principle 8.2 applies.

6. California and other States of the United States of America.

1. If you are a resident of California and the California Consumer Privacy Act (CCPA) applies to You, You shall have the rights described below under the CCPA, as amended by the California Privacy Rights Act. ‘Personal Data’ includes ‘personal information’ as defined under the CCPA.
2. In addition to the rights provided under this Policy, You may also have the right to opt out of the sale or sharing of Your Personal Information, where applicable. To the extent required by California law, You may also have rights relating to automated decision-making technology.
3. If You are located in any other part of the United States other than California, the applicable federal, state or territorial privacy and data protection laws shall apply to Our processing of Your Personal Data.

7. Singapore.

1. If You are located in Singapore, the collection, use, disclosure and other processing of Your Personal Data by Us may be subject to the Personal Data Protection Act, 2012 (“PDPA”) of Singapore, and applicable regulations and guidelines issued thereunder, as amended from time to time.
2. Where We transfer your Personal Data outside Singapore, We will comply with and take reasonable steps to ensure that We provide a standard of protection for Your Personal Data that is comparable to the protection required under the PDPA, as applicable.
3. In some cases, and as permitted under the PDPA, We may rely on ‘deemed consent’ as a legal basis for processing Your Personal Data. For example, We do so when You voluntarily provide Your personal data to Us.