Data Protection Policy

Effective 8 October 2026 · Version 1.0

Our full privacy notice under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. It explains what personal data Indo Mail collects, why, where it is kept, who can see it, and how you can exercise your rights.

1. Who we are and what this policy covers

Indo Mail is an email and productivity service run by INDO CHATS PRIVATE LIMITED (CIN U62012WR2026PTC295588), whose registered office is at 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India. For the personal data described in this policy, INDO CHATS PRIVATE LIMITED is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the DPDP Act). In this policy, 'we', 'us' and 'Indo Mail' mean that company.

This policy is our notice to you under the DPDP Act and the Digital Personal Data Protection Rules, 2025 (the DPDP Rules). It covers everyone who creates or uses an Indo Mail account on indoemail.in, in the web app, the Android app or the installable web app, and across the 21 apps that sit on one Indo Mail account, including Mail, Drive, Photos, Contacts, Wallet, Business Profile and the advertising apps. It also covers people who write to us at our public addresses.

If you use a Business or Enterprise account that your employer or organisation set up on its own domain, your administrator controls many settings, and your organisation may be a Data Fiduciary for the mail it handles. Where that is so, we act as the organisation's processor for the content of the mailboxes. We remain the Data Fiduciary for account, security and billing data that we use for our own purposes.

2. The personal data we collect

We collect only what we need to run the service. The table below lists each group of data, how we get it, and whether you must give it.

End-to-end encrypted email: when you write to another Indo Mail account with end-to-end encryption on (the default), the text of your message is locked on your device before it is sent. We store the locked copy together with the subject, the sender and recipients, the time and any attachments, which are not end-to-end encrypted in this version. We cannot read the locked text. Your device's public key is stored so others can lock messages for you; the private key never leaves your device.

Security activity records: to protect accounts and stop abuse we keep records of sign-ins and failed sign-ins (time, IP address, country, device), how many recipients an account sends to, bounces, spam reports made by other Indo Mail users and how many chat messages are sent. Automated checks use these records to raise internal security alerts. They never read message content.

New apps (release 2.1.0): Indo Forms stores the forms you create and the answers people send to them; you are responsible for the answers you collect and must tell people why you collect them. Indo Passwords stores only entries encrypted on your device; we cannot read them. Gauci Site Audit data created in Indo Mail before release 2.2.2 (website addresses, verification codes and audit results) is kept until you delete it; Gauci is now a separate product at gauci.in with its own Gauci Privacy Policy. Agent Inbox stores a one-way fingerprint of each key you create, its name, permissions and when it was last used; what an agent does with your mail is done with your own permissions.

Data	When we collect it	Required?
Name, chosen Indo Mail address, account type (personal, business or enterprise)	At sign-up	Yes. Without them we cannot create an account.
Password, kept only as a bcrypt hash	At sign-up and when you change it	Yes. We never store or see your password in readable form.
Mobile number	At sign-up	Yes. It helps us protect accounts and contact you about security.
Recovery email address	At sign-up or later in Settings	No. Give it if you want help recovering your account.
Sign-up date, IP address and device or browser details	At sign-up	Collected automatically for security and legal compliance.
Sign-in time, IP address and device or browser details	Every time you sign in	Collected automatically. Kept for one year.
Mail content: messages, attachments, labels, drafts, contacts	As you use Mail and Contacts	You create it. We store it so you can use it.
Files, photos, albums and vault folders	As you use Drive and Photos	You create it. We store it so you can use it.
Business Profile details, ad campaigns, Merchant Center and Manufacturer Center data	When you choose to use those apps	Only if you use them.
Payment records: plan, invoice, GST details, payment reference	When online plan purchases launch	Only if you buy a paid plan. Card and UPI details are handled by the payment aggregator, not by us.
Messages you send to us, abuse reports and support requests	When you write to us	Only if you contact us.
Web Push subscription details	When you allow notifications in your browser	No. You can turn it off at any time.
Photos and contacts copied from your phone (Phone backup in the Indo Mail Android app)	Only after you turn on Phone backup in Settings → Add-ons and allow Android's Photos and Contacts permissions	No. It is off until you turn it on, and you choose photos, contacts or both. Turn it off on the phone or stop it for any phone from Settings → Add-ons; what was already backed up stays in your account until you delete it.
Automatic forwarding address	When you add one in Settings → Forwarding and POP/IMAP	No. Forwarding starts only after the code we send to that address is entered, and you can remove it at any time.
Chat messages and chat device keys	When you use Chat	Messages are end-to-end encrypted on your device; we store only the encrypted text, each device's public key, and who is in each conversation and when messages were sent, so we can deliver them. We cannot read the messages.
Meeting links and who is in a meeting	When you create or join a Meet video meeting	Only while you use Meet. Audio and video go directly between participants' devices and are never sent to or recorded by us; we keep the meeting code, its title and who created it.
Country and time zone	At sign-up (from the country you choose for your mobile number and your device's time zone) and when you change them in Settings	Yes for country, because it is part of your mobile number. Used to show dates, numbers and currencies in your local format and to pick your Wallet currency.
Wallet payment details: UPI ID, PayPal or Wise username, bank transfer details, payment link	Only when you add them in Wallet	No. They are shown only to people you send a payment request to. Indo Wallet never holds money and never sees card numbers, PINs or bank passwords.
Approximate country from your IP address	When you open Maps or Indo Cloud plans and your account has no country yet	Worked out on our own server from a database of IP address ranges (DB-IP Lite, db-ip.com, CC BY 4.0); the IP address is not sent anywhere. Used only to choose where the map starts and which currency prices are shown in.
Your device's location in Maps	Only when you allow location in your browser or the Indo Mail Android app	Used in your browser to centre the map and to rank nearby search results; we do not store it or keep a location history.

We do not collect your Aadhaar number, PAN, bank account details or UPI PIN for a personal account. We do not collect biometric data, and we do not collect location from your device. Business verification steps are explained in our KYC and Identity Verification policy.

3. Why we use your personal data

We use personal data only for the purposes below. We do not use it for any other purpose without asking you again.

Providing the service. Creating your account, delivering and storing your mail and files, sending notifications you have asked for, and running search, labels and the other features you use.
Security and abuse prevention. Checking incoming mail with SPF, DKIM and DMARC, limiting repeated sign-in attempts, detecting hacked accounts, blocking spam and malware, and enforcing our Acceptable Use rules.
Legal compliance. Keeping sign-in logs for one year, as the CERT-In Directions of 28 April 2022 (180 days in India) and the DPDP Rules, 2025 (one year) require, keeping tax records, and responding to lawful orders.
Billing. Issuing invoices, calculating 18% GST and keeping the records the law requires, once paid plans are purchased online.
Contextual advertising on the Free plan. Showing ads chosen by page context only, as described in section 5.
Support and improvement. Answering your questions and fixing faults, using the smallest amount of data that will do the job.
Service messages. Telling you about security events, changes to our terms, billing and the state of your account. These are not marketing.

4. Consent and how to withdraw it

We process your personal data on the basis of your consent, given when you create an account after reading this notice, and on the 'legitimate uses' that section 7 of the DPDP Act allows, such as complying with the law and responding to a medical emergency or a threat to life.

Your consent is free, specific, informed and unambiguous. It is given by a clear action: you tick the box and create your account. You are never made to agree to more than the service needs. Optional matters, such as push notifications, are asked about separately and are off until you turn them on.

You can withdraw consent at any time. It must be as easy to withdraw as to give. You can turn off push notifications in your browser or in Settings, remove your recovery email, or close your account from Settings. You can also write to privacy@indoemail.in. When you withdraw consent for data that the service needs, we will stop processing it and delete it within the timelines in our Data Retention Policy, unless the law requires us to keep it. Withdrawing consent may mean we can no longer provide the account. It does not affect anything we did lawfully before you withdrew.

Phone backup is a separate, optional consent. The Indo Mail Android app copies your phone's photos to Indo Photos and your phone's contacts to Indo Contacts only after you turn on Phone backup and allow Android's Photos and Contacts permissions. The app uses a limited key that can only add photos and contacts to your account; it cannot read your mail. Photos are matched by a fingerprint of their content (SHA-256) so the same photo is never uploaded twice; the fingerprint is not used for anything else. Photos and contacts are not used for advertising, profiling or training AI. You can withdraw this consent at any time by turning off Phone backup in the app, stopping it for a phone in Settings → Add-ons, removing the permission in Android settings, or signing out of the app.

5. Zero Data Sharing

Indo Mail follows a simple rule that we call Zero Data Sharing.

We never sell your personal data to anyone.
We do not use third-party trackers, analytics scripts, advertising SDKs, fonts or widgets in Indo Mail. The pages load only our own code.
We never read your mail to decide which ads to show you, and we never use your mail or files to build an advertising profile.
We never use your mail, files or photos to train artificial intelligence models.
Ads on the Free plan are chosen by placement, country, language and the words on the page being viewed. They use no personal data. Pro, Business and Enterprise plans show no ads.

We share personal data only in the limited cases in sections 6 and 14: with our processors so that they can run the service for us, when you ask us to, and when a valid legal order requires it.

6. Processors who handle data for us

We use a small number of service providers, called processors or sub-processors, who handle personal data only on our instructions and under a written contract. We remain responsible for them.

Processor	What it does for us	Data involved
Amazon Web Services (Mumbai region, ap-south-1)	Hosting our server, storing files in Amazon S3 (encrypted with AES-256), DNS, outgoing mail relay through Amazon SES, Amazon Translate for the Translate app, and Amazon Location Service for Maps	Account data, mail, files and the text you ask to translate or the places you search for
Let's Encrypt	Issues the TLS certificates that secure our connections	None. No personal data is sent.
Browser push services run by Google, Mozilla, Apple and Microsoft	Deliver a notification to your browser when you have allowed push notifications	Only an encrypted notification payload and your browser's push address
An RBI-authorised payment aggregator, when online checkout launches	Collects payment for paid plans and carries out payment KYC	Payment details, which stay with the aggregator; we receive confirmation and a reference
Amazon Bedrock (AWS Mumbai region, ap-south-1)	Runs the Indo AI writing assistant when you press an Indo AI button: writing and rewriting email, reply drafts, written summaries and Ask Indo AI	Only the text that one request needs; not stored after the answer and not used to train models

If we add or change a processor in a way that matters to you, we will update this policy before the change takes effect.

7. Where your data is stored

Data of Indian accounts is stored in India, in the Amazon Web Services Mumbai region. This includes the database, your mail, your Drive files, and our daily backups and automatic snapshots. Our server runs on an AWS Lightsail instance, and files are held in Amazon S3 in Mumbai.

Some cases involve a short transit outside India or a recipient outside India. These are described in section 13.

8. How long we keep data

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires. The full schedule is in our Data Retention Policy. In summary:

Mail and files stay until you delete them. Deleted mail stays in Trash for 30 days and Spam for 30 days, then is removed.
A closed account is deleted after 30 days, and the data then ages out of backups within 35 days of deletion.
Sign-in logs are kept for one year.
Billing and GST records are kept for 8 years because tax law requires it.
Abuse reports are kept for 3 years.

9. How we protect your data

We take reasonable security safeguards, as section 8 of the DPDP Act requires. They include:

Monitoring for abuse: automated checks look for password guessing, fake-account farms, sending spikes, many bounces, spam reports and chat flooding. Alerts are reviewed by our security team. When an account sends many bounced messages or is reported as spam by several people, sending to other providers can be paused for up to 24 hours while we review it; we tell the account owner, and a person can lift the pause. A sign-in from a country the account has not used before triggers an email to the owner.

HTTPS only, using TLS 1.2 and 1.3 with HTTP/2 and HSTS preload; mail between servers uses STARTTLS where the other server supports it.
Passwords stored only as bcrypt hashes, with login rate limiting to slow guessing attacks.
2-Step Verification using codes from an authenticator app. We strongly recommend that you switch it on in Settings.
A sign-in history screen (Settings → Sign-in history) so you can see where your account was used.
A strict Content Security Policy, sanitised HTML in mail, and remote images blocked until you allow them.
Short-lived tickets for the live mail stream, and signed, short-lived download links for files.
Encryption of stored files with AES-256, daily backups, and access to servers limited to authorised staff.
Warnings on suspected scam and phishing messages, with a 'Report scam' button.
Chat is end-to-end encrypted by default. Each device creates its own key pair (ECDH P-256); the private key is created so that it cannot be exported and stays on the device. Every message is encrypted with a new AES-256-GCM key that is sealed separately for each device in the conversation. Our servers hold only encrypted messages and public keys. Notifications for chat say who wrote, never what they wrote.
Meet audio and video are encrypted in transit (WebRTC with DTLS-SRTP) and flow directly between participants. Our servers only pass the connection messages needed to set up the call and never receive or record the meeting.

No system is perfectly secure. End-to-end encryption, passkeys and an active sessions screen are planned but are not available yet. Please use a strong, unique password and keep your recovery details up to date.

10. Your rights as a Data Principal

The DPDP Act gives you, the Data Principal, the following rights. We honour them for every account holder.

Right	What it means
Access	To receive a summary of the personal data we process about you, the processing we carry out, and the names of the other Data Fiduciaries and processors we have shared it with.
Correction and completion	To have inaccurate or misleading data corrected, incomplete data completed, and out-of-date data updated.
Erasure	To ask us to delete your personal data, unless we need to keep it for the purpose it was given for or because the law requires.
Grievance redressal	To have a complaint about our handling of your data or your rights heard and answered by our Grievance Officer.
Nomination	To nominate another person who can exercise your rights if you die or become unable to act because of incapacity.
Withdrawal of consent	To withdraw consent at any time, as set out in section 4.

You can change your name and recovery details yourself in Settings, and you can delete mail and files yourself. A one-click data export button is planned but is not available yet. Until it is, ask us for a copy of your data using the steps in section 11 and we will provide it in a common electronic format.

11. How to exercise your rights

Write from your Indo Mail address (or your recovery email) to privacy@indoemail.in. This is also the address of our Data Protection Officer contact for your rights.
Say which right you want to use and give enough detail for us to act on it. For example, say whether you want a summary of your data or a deletion.
We confirm your identity before acting. We may ask a question only you could answer, or ask you to reply from the account concerned. We will not ask for more personal data than we need to do this.
We acknowledge your request within 3 working days and aim to complete it within 30 days. If a request is complex, we will tell you why and when to expect an answer.
There is no fee for using your rights.
If we cannot do what you ask, for example because the law requires us to keep a record, we will tell you which part we cannot do and why.

For nomination, tell us in writing the name and email address of your nominee. We will keep it on your account and use it only if we receive proof of your death or incapacity.

12. Complaints and the Data Protection Board

If you are unhappy with how we handled your data or your request, first contact our Grievance Officer: Salena, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India. We acknowledge a complaint within 24 hours and resolve it within 7 days.

Under the DPDP Act you should use our grievance process before you approach the Data Protection Board of India. If you are not satisfied with our response, or you have received none within the time the DPDP Rules allow, you may make a complaint to the Data Protection Board of India. You may also use any other remedy that the law gives you.

13. Age limit and cross-border matters

Age 18 and over only. You must be at least 18 years old to hold an Indo Mail account. Under the DPDP Act, a person under 18 is a child, and processing a child's data needs verifiable consent from a parent or lawful guardian. We do not yet have a verifiable parental-consent process, so we do not knowingly create accounts for anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you believe a child has an account, write to privacy@indoemail.in.

Cross-border matters. We store the data of Indian accounts in India. Email is a global system, so when you send a message to someone whose mail provider is outside India, the message is delivered to that provider. Likewise, messages you receive from abroad pass through the sender's systems. Outgoing mail to other providers is relayed through Amazon SES. If you share a Drive link, the person who opens it may be anywhere. We transfer personal data outside India only to the extent needed for these functions or when the law requires, and never to a country that the Central Government has restricted by notification under section 16 of the DPDP Act.

Indo Mail is open to people in every country. Every account, wherever its owner lives, is stored on our servers in India (AWS Mumbai region). If you sign up from outside India, your personal data is transferred to and processed in India under this policy and Indian law, with the same protections described here: encryption, Zero Data Sharing, no sale of data and no training of AI on your mail. You keep the rights given to you by the law of your own country, such as the GDPR in the European Union and the United Kingdom, and you can exercise them by writing to privacy@indoemail.in.

14. Disclosure to authorities

We disclose personal data to a court, police or government agency only when Indian law requires it and a valid order or request has been received, and only as far as the order requires. Our Law Enforcement Guidelines explain the process. We do not give authorities direct or bulk access to our systems, and we do not build backdoors.

15. Cookies and similar technologies

Indo Mail uses essential cookies only. These keep you signed in and keep the service secure, for example the session cookie and protection against forged requests. We store your theme and similar settings in your browser. We use no advertising cookies, no analytics cookies and no third-party trackers. Our Tag Manager counts conversions without cookies. Because every cookie we use is essential, there is no cookie banner to accept. You can clear cookies in your browser, but you will then be signed out.

16. Personal data breaches

If a personal data breach affects you, we will tell you without delay. The notice will say, in plain language, what happened, what data was involved, what we are doing, what you can do to protect yourself, and who to contact. We will also report the breach to the Data Protection Board of India as the DPDP Rules require, and report cyber incidents to CERT-In within 6 hours of noticing them, as the CERT-In Directions of 28 April 2022 require. Our security team can be reached at security@indoemail.in.

17. Changes to this policy

We may update this policy when the service, the law or our processors change. If a change is significant, we will tell you by email before it takes effect. If the change needs fresh consent, we will ask for it and will not treat silence as agreement. The latest version is always on indoemail.in.

This document is governed by the laws of India.

18. Contact

Privacy questions and requests to use your rights: privacy@indoemail.in. Complaints: Salena, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India. Security reports: security@indoemail.in.