1. The short version
- Who we are: ConOS is run by SHOOLIN PROJECTS, a sole proprietorship (proprietor Sahil Shivayn). We decide how your data is used.
- What our website collects: your role, your name, your locality, your mobile number (checked by OTP) and your consent choices. That's all.
- What we never ask for on the website: Aadhaar, PAN, GST number, documents, photos, email or address.
- Messages: we send you news or offers by email only if you tick that box. You can stop them at any time: use the unsubscribe link in any ConOS email, or email privacy@conos.in.
- We don't sell your data, and we don't use cookies, ads or tracking tools on our website.
- Questions or complaints: write to privacy@conos.in or call +91 9315200336. We will acknowledge and resolve complaints within the time required by law.
2. Which law applies
Today the Information Technology Act, 2000, its Reasonable Security Practices (SPDI) Rules, 2011, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the CERT-In Directions, 2022 apply to us.
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (notified 13 November 2025) come into force in stages. Most duties start on 13 May 2027. We already follow them now.
3. What we collect when you register on conos.in
Before the ConOS app opens, you can register on our website. The form asks for:
| What | Why we need it | Do you have to give it? |
|---|
| Your role (one of: Homeowner, Developer, Construction Company, Specialist Contractor, Engineer, Architect/Designer, Consultant, Testing Lab, Supplier/Manufacturer, Equipment on Hire) | To set up the right kind of account | Yes |
| Your full name | To set up your account | Yes |
| Your locality (picked from our list) | To start ConOS in your area and match you to nearby work later | Yes |
| Your mobile number (+91) and the OTP result | To confirm the number is yours. It becomes your sign-in when the app opens | Yes |
| Your language choice | To show ConOS in English, Hindi or Hinglish | Automatic |
| Your consent choices, with the wording version, time and language | To prove what you agreed to | Yes |
| Invitation code (only if you were invited) | To check your invitation | Only if you have one |
| IP address, time and security events | To keep the site secure and stop misuse | Automatic |
Your two boxes.
- Required: "I'm registering myself, with my own mobile number." Without it we can't register you.
- Optional: "Send me news and offers from ConOS." It starts unticked. If you leave it empty, you can still register.
If you say no to the optional box, nothing changes: your registration works the same way.
4. What we never collect on the website
Aadhaar, PAN, GST number, bank or card details, documents, photos, email, home or site address, your phone contacts or your location.
If ConOS later asks for anything more (for example in the app, for verification or for reward credits), we will update this Notice and ask you first.
5. If we invited you before you joined
If you run a construction business and we sent you an invitation:
- We used only a business number you published yourself (for example on your website, Google Business Profile, shop board or visiting card).
- We send one invitation and at most one reminder. We create no profile of you.
- If you don't join, we delete your details within 30 days of our last message.
- If you say no or reply STOP, we never contact you again. We keep only a coded "do not contact" record so that we remember.
6. Who we share data with
We share data only with service providers who work for us under contract, and only what they need:
| Service | Provider | What they get | Where |
|---|
| Website hosting | Hostinger and its content delivery network | Website requests (IP address, time) | Servers that may be located in or outside India |
| Registration service | Render Services, Inc. (USA), behind Cloudflare's network | Registration data, consent records, logs | Servers that may be located outside India |
| Database | Neon (USA) | Registration data | Servers that may be located outside India |
| SMS / OTP | apitxt.com (OTP SMS delivery) | Mobile number, message, delivery status | India |
| Outreach do-not-contact list | Cloudflare, Inc. (USA) | Invited businesses' details, do-not-contact list | Asia-Pacific region (may be outside India) |
WhatsApp: if you tick the box for work requests, replies and account updates, we may also send those messages on WhatsApp, through our WhatsApp Business provider. We use WhatsApp only with that consent, and you can turn it off at any time.
We also share data with authorities when the law requires it, for example a court order or a lawful government request. We never sell your data or share it for advertising.
7. Where your data is stored
Some of our providers may store or process your data outside India (for example in the USA or the Asia-Pacific region). Indian law allows this unless the Government restricts a country, and we will follow any such restriction. When the ConOS app opens, we plan to keep app data in India.
8. How long we keep your data
| Data | How long |
|---|
| Website registration, if you never sign in to the app | Deleted 12 months after you register, or sooner if ConOS doesn't open in your area by then |
| Consent records (what you agreed to, and when) | While your registration or account exists, plus 1 year |
| Security logs and IP addresses | 1 year |
| Invited businesses that don't join | 30 days after our last message |
| Do-not-contact record | Kept so we never contact you again (coded, not readable as your number) |
| Complaints and our replies | 1 year after the complaint is closed |
When you ask us to delete your account, we check it's you (within 15 days of your request) and delete your data from active use within 30 days of that check, and tell our providers to delete it too. The law requires us to keep some records for a limited time:
- Registration information: the information you gave to register (role, name, locality, mobile number, invitation code if any, and the relevant dates) is kept for 180 days after your registration is cancelled or withdrawn, as the Information Technology Rules, 2021 require.
- Removed content: content removed or blocked under a court or government order, a complaint, or for breaking our Terms, and its related records, is kept for 180 days.
- Other records: consent records (for as long as you are registered, plus 1 year), security logs (1 year) and a coded "do not contact" record, so that we never contact you again if you asked us not to.
These records are access-restricted and used or disclosed only where the law requires, for lawful requests, security, or a live complaint or dispute. We delete them when the period ends, unless a court or an authorised government agency lawfully requires us to keep them longer.
9. How we protect your data
- Encryption when your data travels (HTTPS).
- No trackers or outside scripts on our website.
- We use reasonable security practices and will report and notify breaches as required by law.
10. Your rights
You can:
- see what data we hold about you and whom we shared it with;
- correct or update it;
- delete it;
- withdraw consent at any time, as easily as you gave it;
- nominate someone to act for you if you die or can't act;
- complain to us, and then to the authorities (section 13).
How: until the app opens, email privacy@conos.in from, or quoting, your registered mobile number. For marketing emails, use the unsubscribe link in any ConOS email. We check it's you with an OTP.
How fast: we acknowledge your request within the time required by law, stop marketing emails when you opt out, correct within 15 days and delete within 30 days.
Withdrawing consent doesn't undo anything we did before you withdrew. If you withdraw the required consent, we delete your registration.
11. Cookies
Our website sets no cookies and uses no analytics, advertising or tracking tools. It saves only your language choice in your browser ("conos.lang"), and you can clear it any time. If this ever changes, we'll update this Notice first.
12. Children
ConOS is only for people aged 18 or over. We do not knowingly register anyone under 18. If we find out that a registration belongs to someone under 18, we delete it. We will not process a child's data, or track or advertise to a child, without the verifiable consent of a parent or lawful guardian, as the DPDP Act requires.
14. Changes to this Policy
Every version has a number and an effective date. If we make an important change, we'll tell you before it applies and ask for fresh consent where needed.