KYC & Identity Verification

1. Our approach in one paragraph

Indo Mail believes that an email service should know no more about you than it needs. We ask for the least identity information that keeps the service safe, and we ask for more only when you choose a feature that carries more risk or more trust, such as a verified business badge or advertising. This document explains each check, when it applies, what data it uses and how long we keep it.

It applies to every Indo Mail account and is published by INDO CHATS PRIVATE LIMITED, the company that runs Indo Mail. It should be read with our Data Protection Policy, which explains your rights over the data described here, and with our Data Retention Policy.

2. Summary of checks

Online plan checkout is not live yet, so no payment KYC is happening today. Planned items are marked as planned in this document so that you know what to expect and what to ignore.

3. Personal accounts

A personal account is for one person. To open one, you give your name, the address you want, a password and your mobile number. You may also give a recovery email. We do not ask you for a government ID, a selfie or a document to open a personal account.

What the mobile number is for. It lets us contact you about security, helps us spot people who create many accounts to send spam, and helps you get back into your account if something goes wrong. It is not used for marketing, is not shared with advertisers and is not sold.

Verification is planned. Today we require a mobile number but do not yet confirm that it belongs to you. We plan to send a one-time password by text message to confirm the number. Until it is live, we do not claim that any account's mobile number has been verified. When OTP verification is introduced, we will tell account holders, explain how it works and give a reasonable period to complete it.

We do not collect Aadhaar. We do not ask for, read or store your Aadhaar number, your Aadhaar card or any Aadhaar-based authentication for a personal account. We also do not ask for your PAN, passport, driving licence or voter ID to open a personal account. If someone writes to you claiming to be Indo Mail and asks for these, it is a scam. Forward it to abuse@indoemail.in.

4. Business and Enterprise accounts: domain ownership check

A business can use Indo Mail on its own domain, for example you@yourcompany.com. Before any mail is set up on a domain, we make sure the person asking controls the domain. This stops someone from setting up mail for a domain that is not theirs and sending messages that look like they come from another business.

This check is live today. In outline:

• The administrator adds the domain in the admin console.
• We show the administrator a record to place in the domain's DNS settings. Only someone who controls the domain can add it.
• We look for that record. When we find it, the domain is marked as verified and the administrator can create mailboxes.
• The administrator then adds the SPF, DKIM and DMARC records we provide, so that receivers can confirm that mail from the domain is genuine. Each business domain has its own DKIM key.

We keep the domain name, the verification record we asked for, the date and time it was verified, and the administrator account that did it. If the record is later removed, we may pause sending for the domain until it is restored. The domain check does not prove that a company legally exists. It proves only that the administrator controls the domain.

5. Verified business badge

The verified business badge tells customers that a business on Indo Mail has been checked. It costs ₹1,499 per year, excluding GST. It is a paid add-on, and it is optional.

The document check for the badge is planned and is not live yet. When it starts, it will work like this:

• The business supplies its legal name, registered address, and a document that shows it exists, for example a certificate of incorporation, a GST registration certificate or a Udyam registration, depending on its type. A sole proprietor may supply an equivalent registration or licence.
• The business supplies the name and role of the person applying, and shows that the person is allowed to act for the business.
• We check that the documents are real, match each other and match the domain and Business Profile. We may call or write to the business using details from an independent source.
• We decide within 7 working days. If we refuse, we say why and the business can send better evidence. If we refuse, the badge fee is refunded.
• We may re-check from time to time. We remove the badge if the details become untrue, if the business breaks our rules, or if it does not renew.

We will use only the documents needed for the check. We do not ask for Aadhaar copies. If a document carries an Aadhaar number, the applicant should mask it before sending, and we will not record it. Until the document check is live, no business should be described as 'verified' by Indo Mail.

6. Advertiser verification

Advertisers can run ads in Ads, Ad Manager and the other advertising apps. Because ads reach many people, every ad is reviewed before it runs, and every advertiser is subject to checks. These checks are part of how we keep ads honest and limit fraud.

• Identity of the advertiser. We ask for the name of the person or business and a way to contact it. For businesses, we may check that the website domain and the Business Profile belong to the advertiser.
• Destination check. We check that the page an ad links to works, matches what the ad promises, states prices in INR, and is not harmful.
• Category checks. Some ads, such as those for financial services, health claims, education or other regulated goods and services, need extra evidence like a licence or registration. Political ads are not accepted.
• Prepaid limits. New advertisers start with prepaid budgets and daily caps. Pay-per-click starts from ₹1, and the minimum daily budget is ₹100. We raise limits as an advertiser builds a clean record.
• Repeat or suspicious activity. We may ask for more evidence if we see signs of fraud, such as many accounts using the same details, or ads that change after approval.

If an advertiser does not pass a check, the ad is not shown. We tell the advertiser what is missing. Advertiser data is used only for ad review, billing and fraud prevention. It is never used to look at anyone's mail. See our Advertising Policies and AML Compliance policy.

7. Payment KYC is done by the payment aggregator

When online checkout launches, plan purchases will be handled by a payment aggregator authorised by the Reserve Bank of India. The aggregator, not Indo Mail, takes the payment and carries out any know-your-customer or payer checks that the law requires. Card, bank and UPI details go to the aggregator. Indo Mail does not receive or store full card numbers, bank credentials or UPI PINs.

What we receive from the aggregator is limited to a confirmation that payment succeeded or failed, a payment reference, the amount and the date. We use that to activate your plan and to issue a GST invoice. If the aggregator needs more information from you, it will ask you directly, under its own notice and terms.

The Wallet app does not hold money or carry out payment KYC. It only creates UPI payment-request links and QR codes. Indo Mail is not a bank, wallet issuer or payment aggregator.

8. How verification data is stored and protected

• Verification documents and records are stored in India, in Amazon Web Services' Mumbai region, in encrypted storage (AES-256) with access limited to named staff who need it.
• We do not share verification data with advertisers, data brokers or other third parties. We disclose it only to our processors who run the service for us, and to authorities when a valid legal order requires it.
• We use verification data only for the check it was given for, for fraud prevention and for legal compliance. We do not use it for marketing or to profile you.
• Documents are viewed by authorised reviewers only. Access is logged.

9. How long we keep it

If a legal hold or lawful request applies, we keep the data for as long as the hold needs. The full schedule is in our Data Retention Policy.

10. Your rights

You have the rights set out in the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. These include the right to know what verification data we hold, to have it corrected, to ask for its erasure, to withdraw consent and to complain. Write to privacy@indoemail.in to use them. If you withdraw consent for a verification document, we will delete it, and any badge or advertiser status that depends on it may end. If you are unhappy with our answer, you can write to the Grievance Officer, Salena, at grievance@indoemail.in.

11. Fraud and impersonation

Using someone else's identity, forging a document, or pretending to be a business you do not run breaks our Terms of Service and may be a crime. We will refuse or remove the account, badge or ad, may report the matter to the authorities, and may keep records as the law allows. If you think someone is pretending to be you or your business on Indo Mail, write to abuse@indoemail.in with evidence. Mark urgent cases 'URGENT'.

12. Changes to this document

When a planned check, such as OTP verification or the badge document check, goes live, we will update this document and tell affected account holders. We will not ask you for more identity information than this document says without telling you first and, where the law requires, asking for your consent.

This document is governed by the laws of India.

13. Contact

Questions about verification and your data: privacy@indoemail.in. Business badge and domain questions: support@indoemail.in. Advertiser questions: ads@indoemail.in. Complaints: Salena, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India.