Privacy policy.

This Privacy Policy describes how HIPOD. collects, uses, shares, and protects information about you when you visit hipod.homes, submit a lead form on Meta platforms (Facebook, Instagram), interact with us on WhatsApp, email, or phone, or otherwise engage with our services.

HIPOD. is a brand operated by ITOA Lifestyle Solutions Pvt. Ltd., an Indian company providing interior design orchestration and execution services for residential and commercial clients. We work with you to plan, design, and deliver your home in collaboration with established brand partners.

We take your privacy seriously. This policy is designed to comply with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. Information we collect

We collect information you provide directly to us and information collected automatically when you interact with our services.

1.1 Information you provide

• Contact information — your full name, phone number, email address, and city, when you submit a lead form on Meta (Facebook or Instagram), our website, WhatsApp, or by email.
• Project information — details about your home or property, including apartment size, possession or move-in timeline, design preferences, brand preferences, and budget range.
• Communication content — the content of conversations you have with us via WhatsApp, email, phone, video calls, or in-person at our studio.
• Visual material — photographs, videos, floor plans, or layouts you share with us so we can prepare your design brief or proposal.

1.2 Information collected automatically

• Usage data — when you visit hipod.homes, we may collect your IP address, browser type, device type, pages viewed, and time spent on the site, through standard web analytics tools.
• Marketing data — if you arrived from a Meta advertisement, we receive standard campaign attribution data from Meta (such as the campaign and ad you interacted with), but never your Meta password or other Meta account credentials.
• Cookies and similar technologies — our website may use cookies for site functionality, analytics, and advertising. You can disable cookies through your browser settings.

1.3 Information from third parties

When you submit a Meta Lead Form, Meta provides us with the form responses you submitted, along with limited profile information you authorised Meta to share (typically your name, phone number, and email). We do not receive any information about your other Meta activity, friends, or content.

2. How we use your information

We use your information for the following purposes, each grounded in a lawful basis under the DPDP Act:

• To respond to your enquiry, prepare your free home brief, and have an initial discovery conversation with you (lawful basis: performance of a service you requested).
• To prepare a design proposal and orchestrate with our brand partners (SLEEK by Asian Paints, IKEA, Godrej Interio, Hettich, White Teak, and others) on your behalf, only if you ask us to (lawful basis: performance of a service you requested).
• To send you transactional updates about your project, such as appointment confirmations, brief delivery, proposal updates, and execution timelines (lawful basis: performance of a service you requested).
• To improve our services, including measuring how effectively our marketing reaches the right audience and how our website and content perform (lawful basis: legitimate interest).
• To send you periodic content, such as a newsletter or WhatsApp updates about new projects, design ideas, or HIPOD. news, only if you have opted in. You can withdraw consent at any time (lawful basis: consent).
• To comply with applicable Indian law, including tax, accounting, and consumer-protection requirements (lawful basis: legal obligation).

3. How we share your information

We do not sell your personal information. We share information only in the limited circumstances described below.

3.1 With brand partners (only with your consent)

If you ask us to obtain a quote, sample, site measurement, or installation from one of our brand partners, we will share the minimum information required for that purpose — typically your name, phone number, address, and project specifications. We will inform you which brand partner is involved before sharing. Our current partner ecosystem includes SLEEK by Asian Paints, IKEA India, Godrej Interio, Hettich, White Teak, and Philips, among others.

3.2 With service providers we rely on

We use trusted third-party tools to operate our business. These providers process limited information on our behalf under data-processing terms:

• Meta Platforms — to deliver advertisements and receive your Lead Form submissions.
• Google Workspace — to manage email, calendar, and file storage.
• WhatsApp Business — to communicate with you on WhatsApp.
• Workflow automation tools (such as Zapier) — to route lead notifications to our team.
• Cloud hosting providers — to host hipod.homes and our internal systems.
• Payment processors and accounting software — to process payments and maintain financial records, only if you become a paying client.

3.3 For legal reasons

We may disclose your information if required by Indian law, valid legal process, or in good-faith belief that disclosure is necessary to comply with a legal obligation, protect our rights, or protect the safety of any person.

3.4 In the event of a business transfer

If HIPOD. or ITOA Lifestyle Solutions Pvt. Ltd. is involved in a merger, acquisition, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will notify you and provide a meaningful choice before your information becomes subject to a different privacy policy.

4. Your rights as a data principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights regarding your personal information:

• Right to access — you can request a summary of the personal information we hold about you and how we are using it.
• Right to correction — you can ask us to correct inaccurate or incomplete information.
• Right to erasure — you can ask us to delete your information, except where we are legally required to retain it.
• Right to grievance redressal — you can raise a complaint with our grievance officer (details below).
• Right to nominate — you can nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent — if we are processing your data based on consent, you can withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at the email address listed in Section 9. We will respond within thirty days, as required by law.

5. Data retention

We retain your personal information only as long as necessary for the purposes described in this policy:

• Lead enquiries that do not convert — retained for up to 24 months from the date of last contact, then deleted.
• Active client information — retained for the duration of our engagement and for up to 7 years thereafter, as required by Indian tax and contract law.
• Marketing consent records — retained for as long as you remain subscribed, plus 12 months after unsubscribing for compliance verification.
• Aggregated, anonymised data — may be retained indefinitely, as it does not identify you personally.

6. How we protect your information

We implement reasonable security practices and procedures consistent with the Information Technology Act, 2000 and IS/ISO/IEC 27001 standards. These include:

• Encryption of data in transit using HTTPS for all web interactions.
• Access controls limiting who within HIPOD. can view your information — typically only the founder, your project lead, and finance team for billing-related data.
• Confidentiality obligations on all team members and contractors who may access your information.
• Regular review of our third-party processors’ security practices.

No method of electronic transmission or storage is fully secure. While we work to protect your information, we cannot guarantee absolute security.

7. International transfers

Some of our service providers are located outside India — for example, Meta and Google have servers in multiple countries. When we transfer your information internationally, we rely on the data-protection standards required by the DPDP Act and the contractual commitments of our providers.

8. Children’s information

Our services are intended for adults aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child, please contact us and we will delete it promptly.

9. Contact and grievance officer

If you have questions about this policy or want to exercise your rights, please contact us:

We will acknowledge your communication within 72 hours and provide a substantive response within 30 days, in line with the DPDP Act.

10. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in applicable law. When we make material changes, we will update the “Last updated” date at the top of this policy and, where appropriate, notify you by email or WhatsApp. We encourage you to review this policy periodically.