Privacy policy

01Who we are

GullyDirectory is operated by Gully System Private Limited, a company registered in India with its office at #257, 3rd floor, Sri Nanjundeshwara Complex, Service road, Nagarbhavi 8th Block, Outer Ring Rd, 2nd Stage, Bengaluru 560072. In this policy “we” and “us” mean that company, and “the site” means gullydirectory.com.

For questions about anything here, write to hello@gullydirectory.com. A person reads it.

02What we collect from visitors

You can search the whole directory, read any listing and ring any number on it without giving us anything at all. There is no account needed to use the site as a visitor, and we do not ask for one.

We collect something only when you choose to send it:

• An enquiry to a business — your name, phone number, email address if you give one, and your message.
• The contact form — your name, email address and your message, so we can reply.
• An account, if you create one — your name, email address, a password, and optionally a phone number.

We do not store your IP address, and we do not build a profile of what you looked at. There is no advertising network on this site and nothing here is sold to one.

03What happens to an enquiry

An enquiry you send to a business is meant for that business, so that is where it goes and that is the only place it goes.

It is emailed to the business, and a copy is kept in their GullyDirectory inbox so a lead is not lost to a spam folder. That stored copy is encrypted with AES-256-GCM under a key held in the server environment and never written into our database, so a copy of the database — a backup, an export, a stolen replica — contains nothing readable.

Inside GullyDirectory, an enquiry is shown only to the account that owned the listing when you sent it, and to people that owner has invited to help run it. No staff screen shows the contents of an enquiry, and if a listing later changes hands, the new owner does not see enquiries sent before.

To be precise about the limits: the key is held by our servers, not by the business, so this protection is enforced by our software rather than guaranteed by mathematics. Someone with full control of our servers could in principle decrypt stored enquiries. We restrict that access tightly and do not use it to read enquiries.

We also keep a one-way salted fingerprint of the sender so we can spot a flood of enquiries coming from one source. It cannot be reversed into your phone number or email address.

We do not sell enquiries, we do not pass them to other businesses, and we do not use them to market anything to you.

04What we count

For each listing we count how many times its page was viewed, how many times somebody tapped the phone number, how many tapped WhatsApp, and how many sent an enquiry. These are daily totals per listing and nothing else — there is no row anywhere recording that a particular person did any of it. Requests that look like search-engine crawlers are excluded, since 32,747 indexed pages would otherwise make the numbers mostly Googlebot.

The owner of a listing sees these totals for their own listing. Nobody sees them for anybody else's.

We also use Google Analytics 4 to understand which pages people arrive on and roughly where they come from. That is a Google product and it sets its own cookies; the cookies page explains which, and how to refuse them.

05Business information in the directory

Most of the businesses listed here were added by us from public and commercial sources rather than by their owners. What we publish is the sort of thing a business puts on its own signboard: its name, what it does, where it trades, and how to contact it.

If a listing is yours you can claim it and then decide what it says, including which contact details are public — a phone number stays hidden until you choose to show it. You can also ask us to take the listing down. The listing policy explains both, and neither requires you to pay us anything.

06Who else sees your data

We use a small number of services to run the site, and they see only what they need to do their job:

• Zoho, to send email — enquiry relays, verification codes and password resets. It handles the message and the address it goes to.
• DigitalOcean, which hosts the application and the managed database, in a data centre in India.
• Google Analytics, for the traffic measurement described above.

We do not sell personal data to anybody, and we do not share it with advertisers or data brokers. We will disclose information if a law or a valid order from a court or authority requires it, and no further than that requires.

07How long we keep it

An enquiry stays available to the business owner until they or you ask us to remove it — an owner who lost the email needs to be able to come back to it, which is the whole reason it is stored at all.

An account and its sign-in sessions last while you use them; a session expires after 30 days. Daily view counts for a listing are totals with nothing personal in them and are kept for as long as the listing exists.

Ask us to delete something and we will, unless we are required to keep it.

08Keeping it safe

Passwords are stored as Argon2id hashes and never in a form we could read. A sign-in session is stored as a SHA-256 hash of the token, so the raw token exists only in your browser and a leaked database cannot be replayed as a login. Enquiries are encrypted as described above. The site is served over HTTPS throughout.

No system is beyond compromise. If something happens that puts your information at risk, we will say so plainly and quickly rather than quietly.

09Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask us what we hold about you, ask us to correct it, and ask us to delete it. You can withdraw consent you have given, and you can complain to the Data Protection Board of India if we handle a request badly.

Write to hello@gullydirectory.com and say what you want done. We do not charge for any of it, and we will not make you create an account to ask.

10Children

This is a directory of businesses and it is not aimed at children. We do not knowingly collect information from anyone under 18. If you believe a child has sent us something, tell us and we will delete it.

11Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change materially affects what we do with information we already hold, we will say so on the site rather than leaving you to notice the date.