Privacy Policy & Data Notice
Last Updated: August 31, 2026 | Effective Date: August 31, 2026
1. Overview & Data Controller
SKY HEIGHTS CORP ("Company", "we", "us", or "our") provides ultra-luxury real estate advisory, bespoke property marketing, and private portfolio consultancy services across Bengaluru, India. We are committed to processing your personal data lawfully, transparently, and with strict confidentiality.
Entity Name: SKY HEIGHTS CORP
Corporate Jurisdiction: Bengaluru, Karnataka, India
Registered Address: [Pending Final Corporate Registration / Legal Counsel Disclosure]
Privacy Desk / Grievance Contact: skyheightsrizwan@gmail.com
2. Data We Collect & Information Matrix
We collect information strictly necessary to provide private wealth real estate advisory and fulfill customer enquiries:
| Category | Data Elements | Source | Primary Purpose |
|---|---|---|---|
| Client Enquiry Data | Full name, phone number, email address, property preferences, budget range | Website forms, schedule visit requests, concierge chat | Responding to property enquiries, scheduling site visits, KYC |
| Private Advisory & CRM | Interaction summaries, site visit notes, task schedules, portfolio shortlists | Assigned executive interaction records | Executive transaction management, confidential portfolio curation |
| Technical & Session Data | IP address, browser user-agent, session cookies, rate-limiting tokens | Server logs, automated security filters | Platform security, anti-abuse, authenticated session validation |
3. Purpose & Legal Grounds for Processing
We process your personal information on the following lawful bases:
- User Consent: When you voluntarily submit an enquiry form, schedule a property tour, or opt into curated portfolio briefings.
- Contractual & Pre-contractual Advisory: To provide verified property dossiers, arrange developer meetings, and facilitate real estate acquisition advisory.
- Legitimate Interests: To secure platform integrity, audit executive communications, prevent fraudulent enquiries, and ensure administrative accountability.
- Legal Obligations: Compliance with applicable Indian statutory, taxation, and regulatory reporting requirements where mandated by law.
4. Third-Party Service Providers & Data Processors
We do not sell, rent, or trade your personal data. We utilize authorized, enterprise-grade infrastructure providers under strict technical security agreements:
- Supabase (Cloud Infrastructure): Managed PostgreSQL database hosting with Row-Level Security (RLS) and encrypted storage.
- Google Workspace & Google Drive: Secure asset storage, verified architectural blueprints, and Google Maps API for spatial property previews.
- Google Gemini AI: Assistive administrative drafting engine used only on server-side requests. AI models operate in draft-only mode; they do not perform autonomous client communication.
- Nodemailer / SMTP: Transactional executive correspondence dispatch.
- Meta Platforms (WhatsApp Business): Official Business Cloud API (when active) for verified corporate communication. Employee personal WhatsApp operates strictly via manual
wa.meexternal handoffs.
5. Data Governance, Security & Confidentiality
We implement enterprise security controls to safeguard confidential wealth client information:
- Role-Based Access Control (RBAC): Strict separation between Advisors, Managers, and Super Administrators. Advisors access only their explicitly assigned client portfolios.
- Row-Level Security (RLS): Database-enforced isolation ensuring tenant and team data integrity.
- Server-Side Execution: All database queries, AI processing, and communication authorizations execute server-side; zero service credentials exist in client bundles.
- Zero Personal Credential Storage: The CRM never captures, stores, or automates employee personal WhatsApp login sessions or passwords.
6. Data Retention & User Rights
Client records are retained for the duration of the active advisory relationship and relevant statutory limitation periods. You have the right to request:
- Access & Rectification: Review or update your personal records on file.
- Consent Withdrawal: Opt out of promotional portfolio updates at any time.
- Erasure: Request deletion of your enquiry data, subject to legitimate compliance obligations.
To exercise your rights, email our Privacy Desk at skyheightsrizwan@gmail.com.
7. Applicable Indian Legal Framework
This policy is formulated in alignment with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (as applicable upon progressive enforcement).