Privacy policy

Who decides what happens to your data

BMexa is software that real estate builders and channel partner firms ("companies") use to run their sales and post-sales work. When a company uses BMexa, the data about its staff, its clients and its partners belongs to that company: the company decides why and how it is used, and BMexa processes it on the company's behalf. For questions about that data, contact the company you deal with.

For the companies that sign up with BMexa (their account and billing details), and for people who deal with BMexa itself (our website and sign-up form, call-back requests, sign-in security, BMexa's own WhatsApp messages, marketing and ads, and the referral program), BMexa decides, and this policy applies directly.

What we process

• Account details: name, email address, phone number, username and Company ID. Passwords are stored only as a one-way hash.
• What companies record about their clients and partners: names, phone numbers, email addresses, addresses, enquiries, site visits, bookings, payment schedules, receipts, documents and notes. For a booking, the buyers' identity details: PAN, Aadhaar or passport number, and date of birth. For channel partners and the people who work with them: PAN, GSTIN and RERA numbers, a sub-broker's Aadhaar number, and an associate's bank account for their payouts. A company can hide these details from staff who do not need them, and BMexa keeps a sub-broker's Aadhaar number encrypted, showing only its last four digits.
• What clients send through the client portal or app: payments they have made (amount, date, mode, reference, bank) with a photo of the proof, and their requests to the company.
• Photos taken in the app: a site-visit check-in photo or a payment proof, only when the person chooses to take one. At a builder's front desk the camera can also read the QR on a channel partner's card; that picture is read on the phone and never stored.
• Location, for staff only and only when their company switches it on: where an activity or site visit was logged and, if the company tracks working-hours location, the staff member's location at set times during their reporting hours. The app shows a notice before asking for it, never records outside the reporting hours, and never collects location from clients or partners. Location readings are deleted after 90 days.
• Device details: a push notification token and the phone's model name, to send notifications and to show a person the devices they are signed in on.
• WhatsApp notifications, only for a person who turns them on: the mobile number they turned them on for, when they did, and each message sent to them with its delivery status.
• Sign-in security, for staff: when a sign-in code is used, the code and a sign-in token stored only as one-way hashes (never the code itself), where the code was sent (masked), the device and browser, the IP address and the number of tries; for "Trust this device", a hashed device token with its name and dates; and recent failed sign-ins, to lock an account that is being guessed at.
• Call-back requests from our website: your name, mobile number, company, team size and city, which pricing page you came from, and, if you ticked it, your agreement to hear from BMexa on WhatsApp with the time and the words shown, so that we can call you back.
• Unfinished sign-ups: once you complete the Account step of our sign-up form, we save your name, email address, mobile number, company and industry, how far you got, the plan and billing period you picked, and what brought you (a campaign link, a Referral Partner's code, or the campaign tags described under "Cookies and similar technologies"), so that we can help you finish. Your password is not part of it.
• BMexa campaign links: when you open the personal link in a BMexa WhatsApp campaign, when you opened it, the pages of our website you viewed in that visit, and whether you then replied, stopped the messages, asked for a call-back or signed up.
• Ad events, only if you allowed advertising cookies: when your company signs up, starts its trial or pays, a record of that event with your email address and mobile number as one-way hashes, the ad identifiers from your visit, your IP address and, for a payment on one of our published plans, the amount (see "Measuring BMexa's ads").
• BMexa's own marketing contacts, only people who agreed to hear from BMexa: name, mobile number, email, company, the group they belong to (such as company admin or channel partner), and when and how they agreed, with the exact words they saw; and the messages they send to BMexa's marketing number, with our replies.
• Referral Partners, people who introduce companies to BMexa for a commission or resell it: name, mobile number, email, city, where they work, PAN, bank or UPI details, GST number if they have one, their referral code, the companies credited to them, their earnings, withdrawal requests, payouts and the tax deducted, for a reseller the name, address and email that BMexa's invoices are made out to, when they accepted the Referral Partner Agreement, whether and when they ticked "Send me updates on WhatsApp", when they last signed in, and our notes about them. For their sign-ins: the code and the sign-in token only as one-way hashes, where the code was sent (masked), the number of tries and sends, and the device, browser and IP address of each signed-in session.
• Applications to become a Referral Partner: name, mobile number, email, city, what they do and anything they tell us about themselves, whether and when they ticked "Send me updates on WhatsApp", and our decision, with who made it, when, and any note.
• People a Referral Partner introduces to us: the business name, the contact person's name and mobile number, city and type of business if given, the partner's note, which partner passed them on and when they confirmed that the person agreed to be contacted, and how far our conversation has got (contacted, demo, trial, paid or closed), with our note to the partner.

What we do not do

The BMexa phone app does not read your contacts, your call log or your microphone. It shows no ads and contains no advertising or analytics trackers, and neither do the pages of the BMexa app where companies keep their data. We do not sell personal data.

Enquiry forms that a company publishes through BMexa may load that company's own advertising measurement tags (for example Meta Pixel or Google Tag Manager), and a company may choose to send the progress of an enquiry to Meta in hashed form to measure its advertising. These are the company's choices; the form tells the visitor and asks for consent.

Cookies and similar technologies

Our website (www.bmexa.com) and our sign-up pages use cookies and your browser's own storage, as listed below. Nothing optional runs until you choose in the cookie banner, and you can change your choice at any time from "Cookie settings" at the foot of the website. The pages of the BMexa app where companies keep their data never run analytics or advertising tags.

• Strictly necessary, always on: what keeps you signed in, and a cookie (bmexa_consent) that remembers your cookie choice for a year.
• Campaign and referral memory, in your browser's own storage: the campaign tags and ad click identifiers on the link you arrived by (such as utm_source, gclid or fbclid) for 30 days, and a Referral Partner's code for 60 days. They reach us only if you sign up; a call-back request carries only the BMexa campaign link you came from.
• Analytics, only if you allow it: Google Analytics, which counts visits and the pages viewed, how visitors arrived (for example from a search or a campaign link), and their device, browser and approximate area, worked out from the IP address, which it does not store; and Microsoft Clarity, which records how our pages are used (the pages, clicks, scrolling and taps, and the device and browser) and turns this into heatmaps, with what you type into forms, phone numbers and email addresses hidden. We use both only to improve the website, and Clarity never runs on our sign-up form. They set their own cookies: _ga for up to 2 years (Google Analytics), and _clck for a year and _clsk for a day (Clarity). If you turn analytics off, both stop at once, and you can clear their cookies in your browser.
• Advertising, only if you allow it: the Meta Pixel, Google Ads and the LinkedIn Insight Tag, which let those companies show you BMexa ads on other sites and tell us which ads worked.

Measuring BMexa's ads

If you allowed advertising cookies and your company then signs up or pays BMexa, we tell Meta, through its Conversions API, that a sign-up, a trial or a payment happened, with your email address and mobile number in coded form (a one-way SHA-256 hash), Meta's ad identifiers from your visit, your IP address and, for a payment on one of our published plans, the amount. For Google Ads we upload the same events with the Google click identifier from your ad, without your email address or mobile number. Meta and Google use this to measure which BMexa ads worked.

A price agreed specially with a business is never shared: for such a business, Meta is not told about its payments, and Google is told only that a payment happened, without the amount.

If you did not allow advertising cookies, nothing is sent, and we keep only a record that the event happened, without your details. Where you did allow them, your details are removed from the record 90 days after the event.

Why we process it

To provide BMexa to the companies that use it: to sign people in, show each person only what they are allowed to see, send the notifications the company has set up (in the app, by email and, for people who turn it on, on WhatsApp), keep records secure, and support the companies.

For BMexa itself: to keep sign-ins secure, to call back people who ask us to, to send BMexa's news and offers to people who agreed to receive them, to follow up with people who start signing up or open our campaign links, to improve our website and measure our ads if you allow it, and to run the referral program: reviewing applications, letting partners sign in to see their earnings and introductions, contacting the people they introduce, sending partners their alerts, paying them or billing resellers, and meeting tax law.

Notifications on WhatsApp

BMexa can send notifications on WhatsApp from its own business number, through Meta's WhatsApp Business Platform. A person gets them only after turning them on for their own mobile number: staff for alerts about leads assigned to them, once BMexa and their company have switched lead alerts on; and company admins for messages about the company's BMexa account, such as a trial ending, a renewal, an invoice or a payment. Referral Partners get them only if they ticked "Send me updates on WhatsApp" (see "Referral Partners").

A lead alert carries the client's name and details of the enquiry, such as the project and where it came from. Because a WhatsApp message can be forwarded, the client's phone number and email are masked in it (for example ******3210); the full details stay inside BMexa.

Staff turn lead alerts off under Me in the app, admins turn billing messages off on Plan & billing, and Referral Partners untick WhatsApp updates on their own page; replying STOP to BMexa's number also stops them. If the person's mobile number changes, the messages stop until they turn them on again.

Sign-in codes: after the password, BMexa can ask staff for a 6-digit code, sent on WhatsApp from BMexa's own number to the mobile they have verified, or by email when WhatsApp is not available. BMexa's own administrators always need one, a company admin can require it for the whole company, and anyone else can turn it on for themselves. A code works once and only for 10 minutes. "Trust this device" skips the code on that device for 30 days, until the person changes their password or signs out everywhere. Replying STOP does not stop sign-in codes, because each one is sent only when the person asks for it; they turn codes off in their profile, unless their company or BMexa requires them.

A company that connects its own WhatsApp Business number to BMexa sends messages to its clients and its team from that number, on its own instructions; those messages come from the company, not from BMexa. When you tap WhatsApp, call or email in the app, your phone's own app opens; BMexa does not send that message.

Marketing from BMexa

BMexa sends its own news and offers on WhatsApp from a separate BMexa marketing number, and only to people who agreed to receive them: company admins and visitors who tick "Send me BMexa news and offers on WhatsApp" when they sign up, on Plan & billing or on our call-back form; people who message that number first to ask for updates; and channel partners and prospects we add only with a record of how and when they agreed. We keep that record, with the words they saw.

We never use the data that companies keep in BMexa, such as their clients or their channel partners, for BMexa's marketing.

Marketing messages go out Monday to Saturday between 10 am and 7 pm India time, and at most two a week. To stop them, reply STOP or tap "Stop promotions" in WhatsApp; admins can also turn the switch off on Plan & billing, and a changed mobile number stops them too. Stopping marketing does not stop the sign-in codes, alerts or billing messages a person has turned on.

When you write to BMexa's marketing number, we keep the conversation so that our team can answer, and send a copy to our support inbox with your number masked. If you reply STOP, we stop replying. A "Chat with us" button may move the chat to a BMexa sales WhatsApp number, where it continues outside the BMexa app.

Each BMexa campaign message carries a link that is personal to you (www.bmexa.com/r/...). When you open it, we record that you did, the pages of our website you view in that visit, and whether you then reply, stop the messages, ask for a call-back or sign up, so that we know which messages are useful. The pages viewed are deleted after 90 days.

If you start signing up and stop, or open a campaign link without replying, our team may contact you. To decide whom to call first, BMexa's team sees a simple score built from these steps and from call-back requests, and our support inbox gets an email about each new one, with the mobile number masked. Nothing is decided about you automatically.

Referral Partners

BMexa Referral Partners introduce companies to BMexa and earn a commission on what those companies pay. They are independent: they are not BMexa staff, they cannot make promises for BMexa, and they never take payments for it.

Anyone can apply on our website to become a Referral Partner. We review each application and keep it with our decision; an approved application becomes the partner's record. The "Send me updates on WhatsApp" box is never ticked for you.

Referral Partners sign in to their own page with their mobile number and a 6-digit code, sent on WhatsApp from BMexa's number, or by email when WhatsApp is not available. A code works once, only for 10 minutes and for 5 tries, and no more than 5 codes are sent in an hour. On their page a partner sees their own details (with their PAN partly hidden), their rates, earnings, withdrawal requests and payouts, and the people they introduced; a change of PAN goes through BMexa.

We email a partner when they are approved, when a company they brought pays, once a month while withdrawals are open and they have money ready to withdraw, when they ask to withdraw, if we cancel a withdrawal (with the reason), and when we send a payout. Partners who ticked "Send me updates on WhatsApp" also get the approval, payment and payout messages on WhatsApp from BMexa's number; they untick it on their page, or reply STOP, to end them.

A Referral Partner may pass us the details only of people who agreed to be contacted by BMexa, and confirms that for each person; we record when they did. We use those details only to talk to them about BMexa, and send them BMexa's marketing only if they agree to it themselves. The partner sees how far each introduction has got, with our note. A mobile number can be introduced by only one partner in 90 days; another partner who tries is told only that it was already introduced, never by whom.

A Referral Partner's link opens our website with their code (for example www.bmexa.com/?ref=RAHUL20). Your browser then keeps that code and the time in its own storage on your device for 60 days, so that our sign-up form can fill it in; it is not a cookie, and opening another partner's link replaces it. Because our website and the BMexa app keep separate storage, the sign-up links on our website carry the code in their address too. You can delete the code on the form, or clear it with your browser's site data. Checking a code on the form shows only whether it is valid, never whose it is, and we record a code against a company only when the company signs up with it.

When a company signs up with a code, we record which Referral Partner brought it, how (the partner's link, the typed code, or BMexa staff assigning it, with the reason and who did it) and when. A partner who signs up their own company is not credited.

When a company came to BMexa through a Referral Partner, the partner sees the company's name, plan, the status of its subscription, its number of users, the amounts it paid before GST and what they earned on them, so that they can check their commission. A Referral Partner never sees the company's clients, leads, bookings, users or anything else it keeps in BMexa.

Some Referral Partners are resellers. A reseller pays BMexa a wholesale price for the companies it brings and bills those companies itself. For such a company, BMexa's invoices name the company and are made out and sent to the reseller, and the company's admins do not get BMexa's billing emails or WhatsApp messages.

Who else handles it

Service providers that run BMexa for us, under contract: Amazon Web Services and Supabase for hosting and the database, with data stored in India (Mumbai); Resend for email delivery; Google Workspace for BMexa's own email, including the support inbox that receives data requests and replies to BMexa's messages; Expo, Google Firebase Cloud Messaging and Apple Push Notification service for phone notifications; Google Maps Platform, to turn a staff location reading into an address; Razorpay, for payments to BMexa made online, which gets the amount and BMexa's invoice reference from us, and the payer's name and email address filled in for them; the payer gives Razorpay their mobile number and their card, UPI or bank details on Razorpay's own payment window, which BMexa never sees or stores, and we keep only Razorpay's payment reference, the amount and whether it went through; and Meta, through its WhatsApp Business Platform, for WhatsApp messages (notifications, sign-in codes and BMexa's marketing). Google and Meta may process data outside India.

On our website and sign-up pages, and only with your cookie consent: Google (Google Tag Manager, which loads the others, Google Analytics and Google Ads), Microsoft (Clarity), Meta (the Meta Pixel and its Conversions API) and LinkedIn (the Insight Tag). They may process data outside India, and also use it under their own terms and privacy policies.

Integrations that a company switches on itself, such as its own WhatsApp Business number or Meta lead ads, exchange data with those services on the company's instructions. Each company's data is kept separate from every other company's.

How long we keep it

For as long as the company uses BMexa and as the law requires (for example accounting and tax records). When a company leaves BMexa, we keep a copy of its data and documents, stored in India, for up to 90 days, so that the account can be restored if the company comes back, and then delete it. Only BMexa's Super Admin can open that copy, and only to restore the account at the company's request, or for a lawful request from an authority or a legal claim; each opening needs a written reason and is recorded. If such a request or claim reaches us before the copy is deleted, we keep the data it concerns until the matter ends.

After that, we keep only BMexa's own records about the company, for 8 years, as tax law requires: the invoices and payments between the company and BMexa, with the business details on them and the seat records behind them, and a note of when the account was deleted, by whom and why. Then they are destroyed too.

BMexa's own marketing contacts are kept, with the record of how and when they agreed, while they want to hear from us. When someone stops the messages, we keep that record and a note that they stopped, so that we never message them again; we delete them if they ask us to. Call-back requests and sign-in security records are kept only as long as they are needed to handle the request and to protect accounts.

Referral Partners' details, earnings and payouts are kept for as long as tax law requires after their last payout. People a Referral Partner introduced are kept only as long as we need to follow up with them, unless they become customers or agree to hear from us. Applications we turn down are deleted 90 days after our decision; an approved application stays with the partner's record. A Referral Partner's sign-in codes are deleted a day after they expire.

Your cookie choice stays in your browser for a year, campaign tags for 30 days and a Referral Partner's code for 60 days. The pages viewed after opening a campaign link are deleted after 90 days. An unfinished sign-up is deleted 90 days after it last moved; once you finish, it stays with your company's account as the record of how it signed up. The details on a record of an ad event (hashes, ad identifiers and IP address) are removed 90 days after the event, and only the event itself is kept. Google Analytics keeps the details of each visit for 14 months and then only totals; Clarity deletes recordings after 30 days, and its heatmaps after 13 months.

Your rights

You can ask to see, correct or delete your personal data, and withdraw consent where we rely on it. You can also name someone to use these rights for you if you die or become unable to. If your data was added by a company (your employer, your builder or your channel partner), ask that company first; we will help them answer.

You can also write to us at support@bmexa.com, or ask for your data to be deleted on our data deletion page. We answer within 30 days. If you are not satisfied with how we handled your request or complaint, you can then complain to the Data Protection Board of India. You can stop BMexa's marketing at any time, as described under "Marketing from BMexa".

This policy is in English. Ask us at support@bmexa.com and we will send it to you in Hindi or any other language listed in the Eighth Schedule to the Constitution of India.

Delete my data

Security

All traffic is encrypted. Passwords are stored only as hashes. Each company's data is isolated from every other company's at the database level. The phone app can be unlocked with the phone's own fingerprint or face check, and a phone's sign-in ends after 30 days or when the person signs out.

Staff sign-ins can also need a one-time code. After 10 wrong passwords or codes within 15 minutes, the account is locked for 15 minutes, and the person and their company's admins are told by email.

Children

BMexa is for businesses and their customers. It is not meant for anyone under 18.

Changes to this policy

We post any change here with a new date, and tell companies about important changes.

Contact and grievances

BMexa, a sole proprietorship of Prince. Address: Ground Floor, C/O Sukentla, Preet Vihar, Near Dahiya Hospital, Rathdhana, Sonipat, Haryana 131001. Email: support@bmexa.com. Phone: +91 78348 18630.

Grievance officer: Mukesh Saroha, COO. Email: support@bmexa.com.