Indo MailPolicies & help › Compliance
Compliance (GDPR, CCPA and Other Applicable Frameworks)
How Indo Mail meets Indian law first, and how it also respects the main privacy and anti-spam laws of other countries, with a table that maps each law to the obligation and to the control we use. It also states plainly which certifications we do not hold.
1. Our approach
Indo Mail is run by INDO CHATS PRIVATE LIMITED, an Indian company, from India, for people mainly in India. Our first duty is to Indian law. But email crosses borders, and people and businesses in other countries write to Indo Mail users and sometimes hold Indo Mail accounts. So we have built a single set of protections that meets the common core of the main privacy and anti-spam laws around the world. We apply the same high standard to every user, wherever they live.
This document explains which laws we follow, what each requires in practice, and the control Indo Mail uses to meet it. It is a statement of our practice. It is not legal advice to you, and it does not mean that every foreign law applies to us. Where a law gives you rights that we have not listed here, you can still ask us for them at privacy@indoemail.in.
2. Indian law comes first
The following Indian laws govern Indo Mail, and our other policies describe how we apply them.
- Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. We are a Data Fiduciary. We give notice, ask for consent, honour the rights of access, correction, erasure, grievance and nomination, protect data, report breaches, and do not knowingly create accounts for anyone under 18. See the Data Protection Policy.
- Information Technology Act, 2000, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended). We act as an intermediary with a Grievance Officer, published rules, and a process for takedown on lawful notice. Under the amendment of 20 February 2026 we act on government or court takedown orders within 3 hours, resolve user grievances within 7 days, and label synthetically generated (AI) content. See the Terms of Service and the Community Guidelines.
- CERT-In Directions of 28 April 2022. We report cyber incidents within 6 hours and keep ICT logs for 180 days in India.
- Copyright Act, 1957 and Trade Marks Act, 1999. We run a notice-and-takedown process for copyright under section 52(1)(c) and act on trade mark complaints.
- Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020. We state prices clearly in INR, with GST, and keep a fair refund policy.
- Central Goods and Services Tax Act, 2017 and Companies Act, 2013. We issue GST invoices and keep accounts.
- Bharatiya Nyaya Sanhita, 2023; Bharatiya Nagarik Suraksha Sanhita, 2023; Bharatiya Sakshya Adhiniyam, 2023; POCSO Act, 2012. We follow lawful process for requests (see the Law Enforcement Guidelines) and report child sexual abuse material.
- Prevention of Money-laundering Act, 2002. We do not hold or move money and are not a reporting entity. See the AML Compliance policy.
3. Foreign laws we respect
We have looked at the laws below and designed Indo Mail to meet their main requirements. How a law applies depends on who the user is, where they are, and how they use the service. The laws are:
- GDPR (the General Data Protection Regulation of the European Union) and the UK GDPR;
- CCPA / CPRA (the California Consumer Privacy Act as amended by the California Privacy Rights Act);
- CAN-SPAM (the United States law on commercial email);
- CASL (Canada's Anti-Spam Legislation);
- LGPD (Brazil's Lei Geral de Proteção de Dados);
- UAE PDPL (the Personal Data Protection Law of the United Arab Emirates);
- PDPA (the Personal Data Protection Act of Singapore).
4. Law-to-control mapping
| Law | What it asks of an email service | How Indo Mail meets it |
|---|---|---|
| DPDP Act, 2023 and DPDP Rules, 2025 (India) | Notice, consent, purpose limits, rights, security, breach reporting, grievance redressal, care with children's data | Data Protection Policy; consent at sign-up and easy withdrawal; privacy@ and grievance@ addresses; security safeguards; age limit of 18 and over |
| IT Act, 2000 and IT Rules, 2021 (India) | Intermediary due diligence, published rules, Grievance Officer, takedown on lawful notice, log retention | Terms of Service, Community Guidelines, Grievance Officer with 24-hour acknowledgement and 15-day resolution, Law Enforcement Guidelines |
| GDPR and UK GDPR | A lawful basis, transparency, data minimisation, rights of access, rectification, erasure, restriction, portability and objection, security, breach notice within 72 hours, safeguards for transfers abroad | Consent and legitimate-use bases set out in our policy; only the data needed is collected; rights honoured on request to privacy@; breach notice without delay; data of Indian accounts stored in India; contracts with processors; standard contractual clauses or another lawful transfer tool where required |
| CCPA / CPRA (California) | Notice at collection; rights to know, delete, correct; right to opt out of sale or sharing; no discrimination for exercising rights; limits on sensitive data use | We never sell or share personal data for advertising across sites, so there is nothing to opt out of; rights requests accepted at privacy@; no worse service for exercising a right; no use of mail content for ads |
| CAN-SPAM (United States) | No false headers or misleading subject lines; identification of ads; postal address; working opt-out honoured within 10 business days | Community Guidelines bar forged headers and misleading subjects; bulk senders must include an unsubscribe link and honour it within 10 days; SPF, DKIM and DMARC are required on business domains |
| CASL (Canada) | Consent before sending commercial electronic messages; clear sender identity; unsubscribe within 10 business days | Bulk senders must hold and record consent; sender identity and unsubscribe rules in the Community Guidelines; abuse@ handles reports |
| LGPD (Brazil) | A legal basis for processing; data subject rights; a named contact for data subjects; security; incident notice | Same consent and rights model; privacy@ is the named contact; security safeguards; incident notice |
| UAE PDPL | Consent and transparency; purpose limits; rights; security; limits on transfers abroad; breach notice | Same consent and rights model; data stored in India with contracts for processors; breach notice without delay |
| Singapore PDPA | Consent, purpose and notification obligations; access and correction; protection; retention limits; transfer limitation; breach notification; Do Not Call rules for marketing messages | Consent and notice at sign-up; access and correction at privacy@; Data Retention Policy; no unsolicited marketing to mobile numbers; breach notice |
| US DMCA (17 U.S.C. §512) | A designated agent and notice-and-takedown for copyright claims | Copyright notices sent to legal@ with the subject 'Copyright notice' are handled under our Copyright Policy, alongside section 52(1)(c) of the Copyright Act, 1957 |
5. Principles that apply to everyone
Instead of building different products for different countries, we apply these principles to every account:
- Zero Data Sharing. We never sell personal data. We use no third-party trackers or advertising SDKs. We never read mail to target ads, and we never train AI on user mail.
- Data minimisation. We collect only what is needed: name, address, password hash, mobile number, optional recovery email, and sign-up and sign-in details.
- Essential cookies only. We use no advertising or analytics cookies.
- Security by default. HTTPS only, encryption of stored files, bcrypt password hashing, 2-Step Verification, a strict Content Security Policy, and warnings for scam and phishing messages.
- Rights for all. Anyone can ask to see, correct or delete their data by writing to privacy@indoemail.in. We do not ask for proof of foreign residence before we honour a request.
- Retention limits. We keep data only as long as the Data Retention Policy allows.
- Breach notice. We tell people and the proper authorities without delay when a breach affects them.
6. Transfers of data across borders
Data of Indian accounts is stored in Amazon Web Services' Mumbai region. Mail that you send to an address with a provider abroad has to be delivered to that provider; this is how email works, and it is not a transfer by us for a separate purpose. Where we hold data about a person in the EU, UK or another place with transfer rules, and that data would be moved out of that place, we rely on the transfer tool the law provides, such as contract clauses approved by the regulator, or on your informed consent. We will not make a transfer that the Central Government of India has restricted under the DPDP Act.
7. People in the EU, UK and other regions
If you live in a country covered by a law in section 3 and you want to use a right that the law gives you, write to privacy@indoemail.in. Tell us your country and the right you want to use. We will treat your request under the law that gives you the most protection, and we will reply within the time that law allows, or within 30 days, whichever is shorter. You may also complain to your local data protection authority. We would like the chance to fix the problem first, so please write to us or to grievance@indoemail.in before you do.
8. Certifications we do not hold
We want to be accurate about what we have and have not done. Indo Mail does not currently hold ISO 27001, ISO 27701, SOC 2 or any other external security or privacy certification. Those certifications are planned for the future, but we do not claim them and we will not describe our practices as certified until an independent auditor has issued a certificate. We also do not hold a regulatory 'approval' or 'seal' for any of the laws in this document. Our compliance is our own statement of practice, backed by the controls described here.
Our hosting provider, Amazon Web Services, maintains its own certifications for its data centres. Those certifications belong to Amazon Web Services and do not cover Indo Mail's own software or operations.
9. Review and updates
We review this document every year, and when a law changes or Indo Mail begins a new activity, such as online payments, a developer platform, or new storage locations. If you think we have missed a law that applies to you, please tell us at legal@indoemail.in.
This document is governed by the laws of India.
10. Contact
Privacy rights and data questions: privacy@indoemail.in. Legal questions about this document: legal@indoemail.in. Complaints: Salena, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India.