1. Scope of this policy
This Privacy Policy explains how Gunnio Technologies Private Limited ("we", "us", "our"), the operator of Gunnio, collects, uses, discloses, stores and protects your information when you visit our website, create an account, purchase credits or run an analysis.
This policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023. It constitutes an electronic record and does not require a physical signature.
By using the platform you consent to the practices described here. If you do not agree with any part of this policy, please do not use the platform.
2. Information we collect
We collect only what we need to run the service. Specifically:
- Account information you give us: your name, username, email address, organisation name (if provided), profile picture, and a securely hashed version of your password. We never store your password in readable form.
- Listing information you submit: the short-term rental listing URLs you ask us to analyse, together with the publicly available listing data and photographs we fetch for those URLs.
- Analysis data we generate: the room-by-room scores, photo-level observations, written recommendations, market and neighbourhood information, revenue estimates, and the timestamped history of every analysis run on your account.
- Wallet and transaction data: your credit balance and a ledger of every credit and debit, including purchases, deductions for analyses, and any adjustments made by our support team.
- Feedback you give us: ratings, corrections and comments you submit on an analysis, which we use to improve scoring quality.
- Payment data: transaction identifiers, amount, currency, payment status and the last four digits of the instrument as reported to us by our payment gateway. We do not collect or store full card numbers, CVV, UPI PINs or net-banking credentials.
- Technical data: IP address, browser type and version, device and operating system, referring pages, and server logs of requests to our API, which we use for security, abuse prevention and debugging.
- Support correspondence: the content of emails and contact-form messages you send us, and our replies.
We do not knowingly collect data from anyone under the age of 18, and we do not collect sensitive personal data such as biometric information, health records, sexual orientation or caste, other than any financial information necessarily processed by our payment gateway.
3. Why we collect it and the lawful basis
We process your data for the following purposes:
- To create and administer your account, authenticate you, and keep your session secure — necessary to perform our contract with you.
- To run the analyses you request, which requires fetching listing data and sending listing photographs to our AI processing partners — necessary to perform our contract with you.
- To operate the credit wallet, charge credits per analysis, and maintain an auditable transaction ledger — necessary to perform our contract with you and to meet our record-keeping obligations.
- To process payments, issue GST invoices and comply with tax and accounting law — a legal obligation.
- To provide customer support and respond to your questions and grievances — necessary to perform our contract with you.
- To detect, investigate and prevent fraud, abuse, security incidents and violations of our Terms — our legitimate interest in protecting the platform and its users.
- To measure and improve the accuracy of our scoring, using your feedback and aggregated, de-identified usage data — our legitimate interest in improving the service.
- To send you service communications such as receipts, security alerts and important changes to our terms. Marketing emails, if any, are sent only with your consent and can be unsubscribed from at any time.
4. How we use your listing photographs
To score a listing we send its publicly available photographs to a third-party AI vision provider for analysis. The photographs are transmitted over encrypted connections and are processed to generate scores and written observations that are returned to your account.
We do not use your listing photographs or analysis results to train our own models, and we do not sell them. We use only aggregated and de-identified information — from which neither you nor your listing can be identified — to evaluate and improve scoring quality.
5. Third parties we share data with
We do not sell your personal data. We share it only with the service providers we need to run the platform, and only to the extent required for them to perform their function:
- Listing data provider (RapidAPI): receives the listing identifier so we can fetch publicly available property details and photographs.
- AI vision and language providers (Google Gemini, OpenAI): receive listing photographs and listing text to generate scores, recommendations and search embeddings.
- Location data provider (Google Places): receives the listing's location so we can return neighbourhood and nearby-places information.
- Market intelligence provider (Perplexity): receives listing and location attributes so we can return market comparison information.
- Payment gateway: collects and processes your payment instrument directly. Your payment credentials go to the gateway, not to us. The gateway's own privacy policy governs that processing.
- Cloud hosting and database providers: store the platform's data on our behalf under contractual confidentiality and security obligations.
- Professional advisers, auditors and law enforcement: only where disclosure is required by law, by a valid order of a court or authority, or to establish, exercise or defend a legal claim.
If we are ever involved in a merger, acquisition or sale of assets, your data may be transferred to the acquiring entity, and we will notify you before your data becomes subject to a different privacy policy.
6. Cross-border transfers
Some of our service providers process data on servers located outside India. Where your data is transferred outside India, we ensure the recipient is bound by contractual obligations to protect it to a standard comparable to this policy and to applicable Indian law. By using the platform, you consent to such transfers for the purposes described above.
7. Cookies and similar technologies
We use a small number of cookies, and we do not use third-party advertising or cross-site tracking cookies.
- auth_token — a strictly necessary cookie that stores your signed session token so you stay logged in as you move between pages. It expires automatically when your session expires, and is deleted when you log out.
- Local browser storage — used to remember basic profile details so the interface loads without re-fetching them on every page. It is cleared when you log out or clear your browser data.
Because these are strictly necessary for the platform to function, disabling them will prevent you from logging in or using the service. You can clear them at any time through your browser settings.
8. Data security
We follow reasonable security practices and procedures as required under the SPDI Rules, 2011. These include encryption of data in transit using TLS, password hashing using industry-standard one-way algorithms, signed and time-limited session tokens, role-based access controls that restrict staff access to a need-to-know basis, and logging of administrative actions on user wallets and accounts.
No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law.
You also play a part: use a strong, unique password, do not share your credentials, and tell us immediately at support@gunnio.com if you suspect unauthorised access.
9. How long we keep your data
We keep your account and analysis data for as long as your account is active, so your history and score trends remain available to you.
After you close your account we delete or anonymise your personal data within a reasonable period, except where we must keep records longer to comply with tax, accounting, audit or other legal obligations — for example, invoices and wallet transaction records, which are retained for the period prescribed under Indian tax law. Aggregated, de-identified data may be retained indefinitely.
10. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you and obtain a summary of how it is being processed
- Correct or update inaccurate or incomplete data — most of it you can edit yourself from your profile page
- Withdraw consent for processing that relies on your consent, understanding that this may prevent us from providing the service
- Request deletion of your account and associated personal data, subject to our legal retention obligations
- Request a copy of your data in a commonly used electronic format
- Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
- Raise a grievance with our Grievance Officer, and escalate it to the appropriate authority if you are not satisfied with our response
To exercise any of these rights, write to privacy@gunnio.com from the email address registered on your account. We will verify your identity and respond within the timelines prescribed by law. There is no charge for a reasonable request.
11. Grievance Officer
If you have a concern about how your data is handled, contact our Grievance Officer, appointed under Section 5(9) of the SPDI Rules, 2011 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:
- Name: Grievance Officer
- Designation: Grievance Officer
- Email: grievance@gunnio.com
- Address: 2nd Floor, No. 14, 100 Feet Road, Indiranagar, Bengaluru, Karnataka 560038, India
- Phone: +91 80 4718 2200 (Monday to Friday, 10:00 AM – 7:00 PM IST)
Complaints are acknowledged within 48 hours and resolved within 15 days.
12. Changes to this policy
We may revise this policy as the platform, our providers or the law change. The current version is always available on this page, and the "Last updated" date reflects the most recent revision. Where a change materially affects your rights, we will notify you by email or through the platform before it takes effect.