Kaagazaat Privacy Policy

1. Who we are and what this policy covers

Kaagazaat is run by Sudeep Sachdeva, sole proprietor of M/s Sudeep Sachdeva & Associates ("Kaagazaat", "we", "us"), of Office No. A-415, 4th Floor, Tower-A, Bestech Business Towers, Sector 66, Mohali, Punjab 160062. This policy explains what personal information we collect through www.kaagazaat.com (the "site"), why we collect it, who we share it with, how long we keep it, and the rights you have.

The site offers drafts of property documents for Punjab and Chandigarh. Anyone can read a draft without an account. An account lets you print or download a document. We do not take payments at present.

This policy applies to the site in English, Hindi and Punjabi. It does not apply to other websites we link to, which have their own policies. Please read it together with our Terms of Use.

2. The short version

• You can read drafts without telling us who you are.
• What you type into a document form stays in your browser tab until you ask us for the document.
• An account needs an Indian mobile number. You sign in with a six-digit code that we send to it by text message; if you give an email address and confirm it, you can also sign in with a code sent there. We do not use passwords. We keep only a scrambled, one-way form of each code, and delete it within two days of it being sent.
• We use one cookie, only to keep you signed in. We use no advertising or analytics cookies and load no tracking tools from other companies.
• We do not sell personal information.
• You can ask to see, correct or delete your information by writing to sudeepsachdeva.associates@gmail.com.

3. What we collect, and when

3.1 When you visit the site

Your browser sends our servers some technical details with every request: your IP address, your browser and device type (the "user agent"), the page you asked for, and the languages your browser prefers. We use them to show you the page in your language and to run and protect the site. We do not use analytics tools to track which pages you read. Our hosting provider, Vercel Inc., keeps server logs that include IP addresses (see section 10).

3.2 When you fill in a document form

A document form asks for what the document needs: usually names, a father's or husband's name, addresses, property details, dates and amounts. Depending on the document, it may also ask for a PAN, an Aadhaar number, bank or loan account details, phone numbers or email addresses. A few documents ask for health information (for example, a doctor's certificate for a person making a will), the religion of a person who has died (because it decides which succession law applies), or details of a child.

While you type, your answers stay in your own browser, in the tab you are using. They are not sent to us. They are normally cleared when you close the tab, so on a shared computer, close the tab when you have finished.

3.3 When you print or download a document

You need an account to print or download a document. When you ask for one, your browser sends us the document type and your answers, and our server uses them to produce the document. We do not store your answers or the document. We then record which document you took, when, and a fingerprint of its text (a "hash", which does not contain the text itself). We use this record to count documents against your account's allowance and to avoid counting the same document twice.

3.4 When you create an account

We ask for:

• Mobile number (required). It must be an Indian mobile number, and it can belong to only one account. We send a code to it to check that it is yours, and you sign in with it (section 3.5). We keep it with your account.
• Email address (required). It can belong to only one account. We do not send a code to check it before your account is made; we keep it with your account as given, and use it to reach you. Once it is confirmed with a code (section 3.5), you can also sign in with it.
• Name (required). We use it on your account and to address you.
• The kind of user you are: Individual, Property owner, Advocate, Broker or Builder. This changes which documents we show you first and which questions we ask. It does not give you any special permission.
• Optional answers, depending on the kind of user:
  • Property owner: how many properties you own.
  • Advocate: your Bar Council enrolment number, and your chambers or firm name.
  • Broker: your RERA agent registration number, and your firm name.
  • Builder: your company name (required for builders), your RERA promoter registration number, and the name of your authorised signatory.

We record these answers as you type them. We do not check enrolment or registration numbers, and we mark them as unchecked. A chambers, firm or company name may be used to name the workspace in your account, and your answers may be offered as suggestions when you prepare documents.

We also keep basic records about your account: when it was created, whether it is active, its language setting, the kind of user you chose, when your mobile number was confirmed, whether your email address has been confirmed and when, and when you accepted our Terms of Use and this policy, and which versions.

Accounts made before sign-in codes. Accounts made on this site before we introduced sign-in codes were made with an email address and a password. They keep their email address, and you sign in to them with a code sent to that address. A password can no longer be used to sign in. We deleted the hashes of those passwords once the rollback window after we introduced sign-in codes had closed.

3.5 When you sign in, and while you are signed in

Sign-in codes. When you make an account, we send a six-digit code (a one-time password, or OTP) to your mobile number by text message, and you type it back; we do not send one to your email address to make the account. When you sign in, we send one code to your mobile number or, if you ask and your email address is confirmed, to it instead. Text messages come from the sender name KAGZAT and are sent through Connect Express. Emails come from customersupport.kaagazaat@gmail.com and are sent through Google (Gmail). A code works for 10 minutes. Five wrong tries end it, and you can ask for a new one after 60 seconds.

Code records. So that we can check the code you type, we keep a record of each code we send. It holds only one-way hashes, made with a secret key, of the code and of the number or address it was sent to, never the code, the number or the address itself. It also notes what the code was for, whether it went by text or email, how many tries were made, and when it was sent, runs out and is used up; for a code that confirms an email address, it also notes which account asked for it. We delete the record automatically within two days of the code being sent.

Sign-in records. When you sign in or create an account, we create a sign-in record (a "session"). It holds a hash of a random token, the times the session started, was last used and will end, your IP address, and your browser's user agent. We use it to keep you signed in and to help detect misuse of your account. A session ends after 12 hours at most, after 1 hour without activity, or when you sign out.

Attempt counters. To slow down code guessing and other misuse, we count requests for codes and attempts to use them, to sign in, to create accounts and to download documents. A counter is linked to an IP address, a mobile number or email address, or an account, but we store only a one-way hash of it, not the number, address or account itself. Counters are deleted automatically soon after their counting period ends.

3.6 When you contact us

If you write to us, we keep your message, your contact details and our reply, so that we can deal with your request and keep a record of it.

3.7 When you request stamp paper

If you ask us to arrange stamp paper for a document, we ask for: your name and mobile number (required), and your email address and city (both optional); the names of the parties the stamp is to be in; the stamp duty amount in rupees; what the stamp paper is for; and, if you came to us from a document page, which document it is for. Our Admin Manager calls you on the mobile number you give, to confirm these details and choose the correct stamp article, before anything is arranged. You pay by bank transfer after that call, arranged directly with our Admin Manager — we do not collect payment details, UTRs or bank account information through the request itself, and we do not ask for your Aadhaar or PAN number for it. We keep the request, and notes taken on the call, to fulfil it and to help you if something about it needs sorting out, and we email a copy of the request to our Admin Manager so they can act on it.

3.8 What we do not collect

We do not take payments at present, so we do not collect card or other payment details. We do not use advertising, analytics or social-media tracking tools. We do not buy personal information about you from anyone. The site sends text messages and emails only to deliver the codes you ask for (section 3.5). It sends no advertising or other messages; if we add any, we will update this policy first.

4. Information about other people

Most documents name other people: the other party, co-owners, heirs, witnesses and sometimes children. Enter someone else's details only if you are entitled to use them for the document you are preparing, and, where it is reasonable, let them know.

We use other people's details only to prepare your document. We do not contact them, use their details for anything else, or show your documents to them.

If you are an advocate, broker or builder preparing documents for clients, you are responsible for having a proper basis to give us your clients' information.

5. Sensitive information

Indian law gives extra protection to some kinds of information, including passwords, financial information such as bank account details, and information about health and medical records.

We no longer ask for passwords, and we have deleted the hashes of passwords chosen before sign-in codes (section 3.4).

• Some documents ask for bank or loan account details or health information. Enter only what the document needs. We use them only to prepare the document you ask for, as you agreed when you created your account.
• For an Aadhaar number, give only what the document or the authority needs. Where a document asks for an Aadhaar number, enter only the last four digits unless the document or the office you will present it to needs the full number.

6. Why we use information

We use personal information to:

1. show you the site and documents in your chosen language;
2. create and run your account, send you the codes you ask for, and keep you signed in;
3. prepare the documents you ask for and count documents against your allowance;
4. protect the site and accounts, for example by limiting repeated sign-in attempts, investigating misuse and keeping records of administrative actions;
5. answer your questions and requests; and
6. comply with the law and with lawful requests from courts and government agencies.

We do not sell personal information, use it for advertising, or build marketing profiles.

We use your information on the basis of the consent you give when you create an account, or where the law allows us to use it without consent, for example information you give us for a specific purpose, or information we must keep to comply with the law.

7. Cookies and browser storage

We use one cookie.

This cookie is strictly necessary: without it you cannot stay signed in. It is sent only over secure connections, and scripts on the page cannot read it.

Browser storage. The document form keeps your answers in your browser's session storage, under names beginning kz-fill: (section 3.2). This is not a cookie and is not sent to us. It is normally cleared when you close the tab.

Language. We do not use a cookie to remember your language. It comes from the link you followed (for example, ?lang=pa-IN) or from your browser's language setting.

Nothing else. We use no analytics, advertising or social-media cookies. Our pages load scripts, fonts and images only from our own site.

You can block or delete cookies in your browser. If you block the session cookie, you can still read drafts, but you cannot sign in. Because our only cookie is strictly necessary, we do not show a cookie banner.

8. Who we share information with

We do not sell or rent personal information. We share it only as follows.

Service providers. These companies run parts of the site for us, under contracts that allow them to use the information only on our instructions and require them to protect it. Our email is the exception: Google provides Gmail, which we use for correspondence and to send sign-in codes by email, under its own standard terms.

Our own people. A small number of authorised people (the proprietor, and anyone we engage to maintain the site, under a written duty of confidentiality) can access personal information when they need to run the site, answer your requests or investigate misuse.

When the law requires it. We disclose information to courts, the police or other government agencies when the law requires us to.

If the business changes hands. If Kaagazaat is sold, merged or restructured, personal information may pass to the new owner, who must keep to this policy or tell you before changing it.

Once you print or download a document, you decide who sees it.

9. Where information is stored

Your account details and records are kept in India, in Mumbai, by Supabase Inc., and the site's servers run in Mumbai. Our hosting provider, Vercel Inc., is a United States company, and some technical information, such as server logs, may be processed outside India. Emails you send us, our replies, and the emails that carry sign-in codes are handled by Google (Gmail) and may be held outside India. Text messages that carry sign-in codes are sent through Connect Express (Textnation Digital Solutions Pvt. Ltd.), and its records may be held outside India. Where information leaves India, we will transfer personal information abroad only as Indian law allows: to providers that protect it to the standard Indian law requires, where the transfer is needed to provide the site to you or you have agreed to it, and never to a country to which the Government of India has restricted transfers.

10. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy, unless the law requires us to keep it longer.

Where the law sets a minimum period for keeping a record, we keep it for at least that period. When a period ends, we delete the information or make it anonymous. Copies in backups are deleted as the backups are replaced, within 7 days.

The earlier version of www.kaagazaat.com also used a mobile number to sign in, but accounts made there do not carry over to this site: to use this site, make a new account here, with the same number if you like. That site's data, including mobile numbers and documents, and its backups will be deleted by 31 October 2026.

11. How we protect information

We take reasonable steps to protect personal information. They include:

• storing sign-in codes only as one-way hashes made with a secret key, deleted within two days of being sent, and session tokens only as hashes;
• codes that work for 10 minutes and end after five wrong tries, with a wait of 60 seconds before a new one can be sent;
• using secure (HTTPS) connections for the whole site, and telling browsers to insist on them;
• a strict content security policy, so that our pages run only our own code;
• checking that requests to change information come from our own site;
• limits on how often codes can be asked for and tried, and on repeated sign-in, sign-up and download attempts;
• setting up our logs to remove passwords, session tokens, cookies and identity numbers such as Aadhaar and PAN, and never writing sign-in codes to them;
• ending sessions after 12 hours, or after 1 hour without activity; and
• limiting access to stored information to authorised people.

No website or storage system is completely secure. Please keep your phone and your email account secure, never tell anyone a code we send you, and sign out when you use a shared computer.

If a personal data breach affects your information, we will tell you and the authorities as the law requires.

12. Your rights and choices

You can ask us to:

• See your information: a summary of the personal information we hold about you, how we use it, and who we have shared it with.
• Correct it: fix information that is wrong, incomplete or out of date.
• Delete it: delete information we no longer need, or close your account and delete what it holds. We may keep some information where the law requires, or for the periods set out in section 10; if so, we will tell you what and why.
• Withdraw your consent: stop using information we use because you consented. To withdraw, write to us as set out under "How to ask" below. If you withdraw, we may not be able to keep your account open. Withdrawal does not affect anything we did before it.
• Nominate someone: name a person who can use these rights for you if you die or become unable to act. To do so, email the Grievance Officer from the email address on your account with your nominee's name, their relationship to you, and their email address or phone number. We will confirm once we have recorded your nominee.
• Complain: raise a grievance with our Grievance Officer (section 14).

You can also choose not to give us information. You can read drafts without an account and skip the optional sign-up questions. Without an Indian mobile number that can receive our text message, we cannot give you an account; an email address is required too, but — unlike the mobile number — we do not check that it can receive mail before your account is made.

How to ask. Write to sudeepsachdeva.associates@gmail.com from the email address on your account and tell us what you want. We act only on requests sent from your account's own email address, or from your nominee or someone else who shows us that they may act for you. We may need to confirm your identity before we act. We will acknowledge your request within 24 hours and reply within 7 days.

If you are not satisfied. Once the Data Protection Board of India begins accepting complaints under the Digital Personal Data Protection Act, 2023, you can complain to it. We will add the Board's official complaint details here when they are available. The Act expects you to use our grievance process first.

Some of these rights come from the Digital Personal Data Protection Act, 2023, parts of which are not yet in force (section 15). We already honour all of them in full.

Your duties. Please give us accurate information, do not pretend to be someone else, and do not make false or frivolous complaints. The Digital Personal Data Protection Act, 2023 places these duties on you as well.

13. Children

The site is for adults. You must be 18 or older to create an account. Under the Digital Personal Data Protection Act, 2023, anyone under 18 is a child. If we learn that a child has created an account without the verifiable consent of a parent or lawful guardian, we will delete it.

Some documents concern a child, such as a gift deed to a minor or an application for guardianship. Enter a child's details only if you are the child's parent or lawful guardian, or are acting with their permission, and only for that document. We do not track children, monitor their behaviour or show them targeted advertising.

14. Grievance Officer and contact details

If you have a question or complaint about your personal information, contact our Grievance Officer:

Sudeep Sachdeva
Grievance Officer, M/s Sudeep Sachdeva & Associates
Office No. A-415, 4th Floor, Tower-A, Bestech Business Towers, Sector 66, Mohali, Punjab 160062
Email: sudeepsachdeva.associates@gmail.com
Phone: +91 70871 19160 (Monday to Friday, 10 am to 6 pm IST, except public holidays)

Email marked "URGENT" in the subject line is watched outside those hours. We will acknowledge your message within 24 hours and give you a final reply within 7 days, as our Grievance & Contact page explains. The Grievance Officer is also the person who can answer questions about how we handle personal information.

15. The law this policy follows

We handle personal information under Indian law, in particular:

• the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which apply now; and
• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. These began to come into force in stages in November 2025. Most of the duties they place on businesses, and most of the rights they give you, are due to take effect in May 2027. Until then, the 2011 Rules continue to apply.

This policy is written to meet both.

16. Changes to this policy

We will post any change on this page with a new "Last updated" date. If a change affects how we use information you have already given us, we will tell you on the site before it takes effect and, where the law requires, ask for your consent again. Before we switch on any AI, speech-to-text, or document upload and reading feature, we will update this policy, naming any new provider.