Law Enforcement Guidelines

1. Our principles

Indo Mail is run by INDO CHATS PRIVATE LIMITED in India. We want to help the authorities protect people from crime. We also owe our users a duty to protect their private communications. These Guidelines explain how we balance the two. They are written for investigators, prosecutors, courts and government agencies. They are published so that users can also see how requests are handled.

Our rules are simple:

• We act only on valid legal process from an authority that has the power to make the request.
• We give only what the law requires and what we actually hold.
• We review every request. We push back on requests that are too broad, unclear or unlawful.
• We do not give any authority direct, bulk or standing access to our systems, and we do not build backdoors or weaken our security.
• We tell users about requests unless the law or a court forbids it, or telling them would risk harm to a person.
• We report numbers publicly in our Transparency Reports.

2. Timelines for takedown orders

Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended on 20 February 2026, Indo Mail acts on a takedown order from an authorised government agency or a court within 3 hours of receiving it, and keeps a record of the order and the action taken. Orders must name the specific content or account (for example a Drive share link, a Business Profile or an ad) and the legal provision relied on.

3. Requests from Indian authorities

The legal routes we accept from Indian authorities are:

A request must be in writing, on official letterhead or sent from an official government email address, and must be signed by an officer who has the authority to make it. It must identify the legal power relied on, the case or crime number where there is one, the account or address concerned, the data sought, and the period it covers. Informal requests, phone calls, messages in chat apps, and requests that come from private email accounts are not accepted.

4. Emergency disclosure

In a genuine emergency that involves an immediate danger of death or serious physical injury, for example a kidnapping, a credible threat to life or a person at risk of suicide, we may disclose limited information without the formal process described above, if we believe in good faith that delay would risk a life.

To use this route, mark the subject of your email 'EMERGENCY' and write to legal@indoemail.in from your official government address. State who is in danger and why, what the danger is, how the account is connected to it, and what information you need. Give a direct phone number and the name and rank of the requesting officer. We will review the request as a priority, at any hour. We usually limit emergency disclosures to subscriber information and recent sign-in details. We will ask the agency to follow up with formal legal process soon afterwards. We keep a record of every emergency disclosure.

5. Requests from foreign authorities

Indo Mail data about Indian accounts is held in India. A court order or warrant issued outside India does not by itself bind us or oblige us to disclose it. Foreign authorities should send requests for user data through the Mutual Legal Assistance Treaty (MLAT) or letters rogatory procedure, through the Ministry of Home Affairs and the Indian courts. When an Indian court or competent authority sends us an order that results from such a request, we handle it as an Indian request under section 2.

We may, at our discretion, respond to a direct foreign request in two limited cases: an emergency as in section 3, and a request to preserve data while the formal route is followed (section 8). We will not disclose content to a foreign authority except under an Indian order. A foreign authority that wishes to report abuse, such as a phishing campaign, can write to abuse@indoemail.in.

6. What data we may have

We cannot provide what we do not have. We do not hold your Aadhaar number, and we do not hold the plain text of your password. End-to-end encryption is planned but is not yet available, so we can read stored content when a valid order requires us to produce it. We do not read mail to look for offences in the ordinary course. A request may not ask us to monitor an account on an ongoing basis, except through a direction under section 69 of the Information Technology Act, 2000.

7. How we review a request

• Receipt. Requests are received by our legal contact and logged, with the date and time, the requesting authority, the legal power relied on and the account concerned.
• Check of authority. We check that the request is genuine, that the officer has power to make it and that the legal basis is right for the data sought.
• Check of scope. We check that the account is clearly identified, that the request is narrow, and that it asks only for data we hold. We ask for clarification where needed.
• Challenge. If a request is unlawful, too broad or unclear, we ask for it to be corrected or narrowed. If it is not corrected, we may decline all or part of it, or may challenge it in court.
• Production. We provide the data in a secure electronic format, with a short covering note stating what is included, and keep a copy of what we sent.
• Time. We aim to reply to a valid request within 15 working days. Emergency requests are handled at once.

8. Notice to users

Our policy is to tell the account holder before we disclose their data, so that they can seek legal advice or object. We will not give notice where:

• a court order, or the law, forbids it, as is usual for directions under section 69 of the Information Technology Act, 2000;
• the authority shows that notice would endanger a person, risk the destruction of evidence or compromise an urgent investigation;
• the case is an emergency, in which case we may notify the user after the emergency has passed;
• the request concerns child sexual abuse material, where notifying the user could cause harm.

When a gag no longer applies, for example because the order expires, we will tell the user where the law allows. We tell the account holder what was requested, who asked, and what we provided. For organisation accounts, we may tell the organisation's administrator.

9. Preservation requests

An authority may ask us to preserve data about an account while it obtains formal process. We will preserve the data we hold for that account, such as subscriber information, sign-in logs and, where stated, a snapshot of stored content, for 90 days, which may be extended once for a further 90 days if the authority confirms in writing that formal process is in progress. Preservation does not mean disclosure. We do not release preserved data until valid process arrives. Because sign-in logs are normally deleted after one year, please send preservation requests promptly. If no process arrives by the end of the preservation period, the data goes back to the normal schedule in our Data Retention Policy.

10. How to submit a request

• Send the request as a signed PDF or scan, from an official government email address, to legal@indoemail.in. Put 'Law enforcement request' in the subject line, or 'EMERGENCY' for an emergency.
• State the account (the full @indoemail.in address), the legal power, the case or FIR number, the data requested, the period and the name, rank, office, phone number and official email of the officer.
• Tell us how you want the reply sent. We reply to the official address from which the request came.
• Do not send requests to support@ or to individual staff. They will not be treated as valid.
• We cannot accept service of legal process by chat, social media or phone. If you need to serve a court order on the company in person, our registered office is 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India.

We may need to confirm that a request really comes from the authority by contacting its office through publicly listed details. This is a safeguard against fake requests, which are used to harass or to steal data.

11. Costs

We do not charge for responding to valid requests under Indian law. If a request needs unusual effort, for example because it is very large, we may discuss reasonable cost recovery with the authority where the law allows.

12. Transparency and no backdoors

We publish a Transparency Report twice a year, showing the number of requests we received, the types of request, how many we complied with, and how many accounts they covered. Where the law forbids us from disclosing the existence of a request, we publish only what the law allows, in ranges where needed.

Indo Mail will not install monitoring software at the request of any authority, give anyone a master key to accounts, weaken encryption such as TLS, or provide continuous direct access to our servers. If a law ever required us to do any of these things, we would first challenge it and tell our users, to the extent we are allowed.

13. Requests that are not from the authorities

Private parties, such as lawyers acting for a litigant or a person in a dispute, cannot demand user data from us by letter. They must obtain an order from a court. People who are harmed by an Indo Mail user should report it to abuse@indoemail.in, to the police, or to the Grievance Officer, Salena, at grievance@indoemail.in. Copyright and trade mark complaints go to legal@indoemail.in with the subject 'Copyright notice' or 'Trademark notice'.

14. Changes

We will update these Guidelines when the law changes or when our practice changes. The current version is always on indoemail.in.

This document is governed by the laws of India.

15. Contact

Law-enforcement and legal process: legal@indoemail.in. Privacy rights of users: privacy@indoemail.in. Complaints: Salena, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India.