Privacy Policy

1. At a glance

This policy explains, in plain words, what information Indo Mail collects when you use our apps, why we need it, and the controls you have. It applies to Indo Mail and every Indo app you open with your Indo Account, on the web, on phones and in mail apps you connect.

• We never sell your data and we never give your mail, files, contacts or photos to advertisers.
• Ads never use what is in your mail. Ads on every plan are chosen from the page you are on, your language and your country only.
• Your data stays in India. Accounts are stored in our data centre in Mumbai.
• You are in control. You can see, download and delete your data, switch each Lily feature on or off, and close your account at any time.
• Questions or complaints: privacy@indoemail.in. Grievance Officer: Ejaz Ahmed, grievance@indoemail.in (complaints acknowledged within 24 hours and resolved within 7 days).

2. Information you give us and information we create when you use our apps

We keep only what we need to run the service, keep it safe and meet the law.

3. How you control your information

• Lily (AI) settings: in Settings → Lily (AI) you can switch each AI feature on or off. When a feature is off, nothing is sent to the AI for it. Company administrators can switch features off for everyone in their company.
• Ads: every plan shows a few contextual ads. On every plan you can turn off interest-based ads; they are off unless you choose interests yourself.
• Download your data: take your mail out with any mail app, download Drive files and folders, and export contacts and calendars as files.
• Delete: delete a message, file or event at any time; items in Trash are removed for good when you empty Trash. You can close your whole account from Indo Account.
• Security controls: 2-Step Verification, passkeys, backup codes, app passwords, sign-in history and a sign-out-everywhere button.
• Marketing email: offers and product news are sent only if you agree, and every such email has a one-click unsubscribe link.

4. Lily, our AI helper

Lily can write, summarise, translate, sort and search when you ask. Here is how she treats your data:

• Lily runs on AI models hosted in India. What you ask and what Lily answers is not kept after the answer, and your mail, files and chats are never used to train any AI model.
• Lily works only on what you ask her to look at, inside your own account. She cannot send, delete, pay or share anything unless you press the button to do it.
• End-to-end encrypted messages are never sent to Lily. Files in the Drive Vault are never sent to Lily.
• You can switch Lily features off at any time, one by one.

5. Information we share, and when

We do not sell personal data and we do not share it with anyone for their own use. Your information leaves Indo Mail only in these cases:

• When you ask us to: for example when you send mail to someone, share a file or invite people to a meeting.
• With service providers who work for us: our cloud data centre, mail delivery, payment gateway and SMS delivery companies handle data only on our instructions, under contract, and only as needed to provide the service. They may not use it for anything else.
• Inside your company: if your address belongs to a company that uses Indo Mail for business, that company's administrators can manage your account as described in the business admin console.
• For legal reasons: when Indian law requires it, for example a valid order from a court or an authorised agency. We check every request, share only what is required, and publish the number of requests in our transparency report. We cannot hand over end-to-end encrypted content because we do not hold the keys.
• To protect people: to prevent fraud, spam, abuse or a threat to someone's safety, following our Trust and Safety rules.

6. Keeping your information safe

• Connections to Indo Mail use encryption in transit (HTTPS and secure mail connections).
• Files and backup copies are encrypted in storage.
• Mail between Indo accounts is end-to-end encrypted by default — the message text and, unless you turn it off, the subject — when every recipient has opened Indo Mail on a device. The keys combine elliptic-curve and quantum-safe (ML-KEM-768) encryption. Mail to any other email service can be locked with a password you choose (Secure mail → Lock with a password); we store only the locked copy and never receive the password.
• Staff access is limited, logged and reviewed. We have not yet completed an independent security audit; our security page says exactly what is and is not protected today.
• If a breach affects your personal data, we tell you and the Data Protection Board of India as the law requires.

7. Children and families

You must be at least 18 to open an Indo Account on your own. A person under 18 can use Indo Mail only with the verifiable consent of a parent or lawful guardian, as the DPDP Act 2023 requires. We do not show interest-based ads to anyone under 18 and we do not track children's behaviour for ads.

8. Who we are and what this policy covers

Indo Mail is an email and productivity service run by INDO CHATS PRIVATE LIMITED (CIN U62012WR2026PTC295588), whose registered office is at 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India. For the personal data described in this policy, INDO CHATS PRIVATE LIMITED is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the DPDP Act). In this policy, 'we', 'us' and 'Indo Mail' mean that company.

This policy is our notice to you under the DPDP Act and the Digital Personal Data Protection Rules, 2025 (the DPDP Rules). It covers everyone who creates or uses an Indo Mail account on indoemail.in, in the web app, the Android app or the installable web app, and across the 21 apps that sit on one Indo Mail account, including Mail, Drive, Photos, Contacts, Wallet, Business Profile and the advertising apps. It also covers people who write to us at our public addresses.

If you use a Business or Enterprise account that your employer or organisation set up on its own domain, your administrator controls many settings, and your organisation may be a Data Fiduciary for the mail it handles. Where that is so, we act as the organisation's processor for the content of the mailboxes. We remain the Data Fiduciary for account, security and billing data that we use for our own purposes.

9. The personal data we collect

We collect only what we need to run the service. The table below lists each group of data, how we get it, and whether you must give it.

End-to-end encrypted email: when you write to another Indo Mail account with end-to-end encryption on (the default), the text of your message is locked on your device before it is sent. We store the locked copy together with the sender and recipients, the time and any attachments, which are not end-to-end encrypted in this version. Unless you turn it off in Settings, the subject is locked too and the readable subject we store is simply "Encrypted message". We cannot read the locked text or the locked subject. Each of your devices has two public keys stored with us — an elliptic-curve key (ECDH P-256) and a quantum-safe key (ML-KEM-768) — so others can lock messages for you; the private keys never leave your device.

Password-protected email: when you lock a message with a password in Secure mail, your browser encrypts the subject and message with a key made from that password (PBKDF2-SHA256 and AES-256-GCM) before it is sent. We store the locked copy, the recipients, an optional hint you write, when access ends and how often the link was opened. Recipients unlock it on the reading page with the password, which you give them another way; replies they write there are locked with the same password. We never receive the password, cannot unlock these messages and cannot recover them if the password is lost.

Private contact and event details: if you mark a contact or an event as private, its details (for a contact: phone, company, job title, address, birthday and notes; for an event: title, place and notes) are locked on your device with your Indo Passwords master password. We store only the locked copy, plus the contact's name and email address or the event's time, which are needed to send mail and reminders. Search, reminders and Lily cannot read private details.

Security activity records: to protect accounts and stop abuse we keep records of sign-ins and failed sign-ins (time, IP address, country, device), how many recipients an account sends to, bounces, spam reports made by other Indo Mail users and how many chat messages are sent. Automated checks use these records to raise internal security alerts. They never read message content.

Continue with Google (from release 2.22.0, only if you choose it): Google tells us your Google account number, your name and that your email address is verified. We store the account number and that email address to link your Google account to your Indo Mail account, and the dates it was linked and last used. We never ask Google for access to your Gmail, Drive, contacts or anything else, and we share nothing back with Google. You can unlink it at any time in Account → Security, and the link is deleted with your account.

Remember me: if you untick Remember me when you sign in, your browser keeps a small essential cookie (im_alive) until it is closed, so we can sign you out then. It holds no personal data; see the Cookie Policy.

New apps (release 2.1.0): Indo Forms stores the forms you create and the answers people send to them; you are responsible for the answers you collect and must tell people why you collect them. Indo Passwords stores only entries encrypted on your device; we cannot read them. Website check data created in Indo Mail before release 2.2.2 (website addresses, verification codes and audit results) is kept until you delete it; the website check is no longer part of Indo Mail. Agent Inbox stores a one-way fingerprint of each key you create, its name, permissions and when it was last used; what an agent does with your mail is done with your own permissions.

We do not collect your Aadhaar number, PAN, bank account details or UPI PIN for a personal account. We do not collect biometric data, and we do not collect location from your device. Business verification steps are explained in our KYC and Identity Verification policy.

10. Why we use your personal data

We use personal data only for the purposes below. We do not use it for any other purpose without asking you again.

• Providing the service. Creating your account, delivering and storing your mail and files, sending notifications you have asked for, and running search, labels and the other features you use.
• Security and abuse prevention. Checking incoming mail with SPF, DKIM and DMARC, limiting repeated sign-in attempts, detecting hacked accounts, blocking spam and malware, and enforcing our Acceptable Use rules.
• Legal compliance. Keeping sign-in logs for one year, as the CERT-In Directions of 28 April 2022 (180 days in India) and the DPDP Rules, 2025 (one year) require, keeping tax records, and responding to lawful orders.
• Billing. Issuing invoices, calculating 18% GST and keeping the records the law requires, once paid plans are purchased online.
• Contextual advertising on every plan. Showing ads chosen by page context only, as described in section 5.
• Support and improvement. Answering your questions and fixing faults, using the smallest amount of data that will do the job.
• Service messages. Telling you about security events, changes to our terms, billing and the state of your account. These are not marketing.

11. Consent and how to withdraw it

We process your personal data on the basis of your consent, given when you create an account after reading this notice, and on the 'legitimate uses' that section 7 of the DPDP Act allows, such as complying with the law and responding to a medical emergency or a threat to life.

Your consent is free, specific, informed and unambiguous. It is given by a clear action: you tick the box and create your account. You are never made to agree to more than the service needs. Optional matters, such as push notifications, are asked about separately and are off until you turn them on.

You can withdraw consent at any time. It must be as easy to withdraw as to give. You can turn off push notifications in your browser or in Settings, remove your recovery email, or close your account from Settings. You can also write to privacy@indoemail.in. When you withdraw consent for data that the service needs, we will stop processing it and delete it within the timelines in our Data Retention Policy, unless the law requires us to keep it. Withdrawing consent may mean we can no longer provide the account. It does not affect anything we did lawfully before you withdrew.

Phone backup is a separate, optional consent. The Indo Mail Android app copies your phone's photos to Indo Photos and your phone's contacts to Indo Contacts only after you turn on Phone backup and allow Android's Photos and Contacts permissions. The app uses a limited key that can only add photos and contacts to your account; it cannot read your mail. Photos are matched by a fingerprint of their content (SHA-256) so the same photo is never uploaded twice; the fingerprint is not used for anything else. Photos and contacts are not used for advertising, profiling or training AI. You can withdraw this consent at any time by turning off Phone backup in the app, stopping it for a phone in Settings → Add-ons, removing the permission in Android settings, or signing out of the app.

12. Zero Data Sharing

Indo Mail follows a simple rule that we call Zero Data Sharing.

• We never sell your personal data to anyone.
• We do not use third-party trackers, analytics scripts, advertising SDKs, fonts or widgets in Indo Mail. The pages load only our own code.
• We never read your mail to decide which ads to show you, and we never use your mail or files to build an advertising profile.
• We never use your mail, files or photos to train artificial intelligence models.
• Ads on every plan are chosen by placement, country, language and the words on the page being viewed. They use no personal data.

We share personal data only in the limited cases in sections 6 and 14: with our processors so that they can run the service for us, when you ask us to, and when a valid legal order requires it.

13. Processors who handle data for us

We use a small number of service providers, called processors or sub-processors, who handle personal data only on our instructions and under a written contract. We remain responsible for them.

If we add or change a processor in a way that matters to you, we will update this policy before the change takes effect.

14. Where your data is stored

Data of Indian accounts is stored in India, in our Mumbai data centre. This includes the database, your mail, your Drive files, and our daily backups and automatic snapshots. Our server runs on an our servers instance, and files are held in our encrypted storage in Mumbai.

Some cases involve a short transit outside India or a recipient outside India. These are described in section 13.

15. How long we keep data

A table of every kind of data we keep, why, and for how long, with our backup and deletion timelines, is on the Privacy details page at indoemail.in/privacy-details.

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires. The full schedule is in our Data Retention Policy. In summary:

• Mail and files stay until you delete them. Deleted mail stays in Trash for 30 days and Spam for 30 days, then is removed.
• A closed account is deleted after 30 days, and the data then ages out of backups within 35 days of deletion.
• Sign-in logs are kept for one year.
• Billing and GST records are kept for 8 years because tax law requires it.
• Abuse reports are kept for 3 years.

16. How we protect your data

We take reasonable security safeguards, as section 8 of the DPDP Act requires. They include:

Monitoring for abuse: automated checks look for password guessing, fake-account farms, sending spikes, many bounces, spam reports and chat flooding. Alerts are reviewed by our security team. When an account sends many bounced messages or is reported as spam by several people, sending to other providers can be paused for up to 24 hours while we review it; we tell the account owner, and a person can lift the pause. A sign-in from a country the account has not used before triggers an email to the owner.

• HTTPS only, using TLS 1.2 and 1.3 with HTTP/2 and HSTS preload; mail between servers uses STARTTLS where the other server supports it.
• Passwords stored only as bcrypt hashes, with login rate limiting to slow guessing attacks.
• 2-Step Verification using codes from an authenticator app. We strongly recommend that you switch it on in Settings.
• A sign-in history screen (Settings → Sign-in history) so you can see where your account was used.
• A strict Content Security Policy, sanitised HTML in mail, and remote images blocked until you allow them.
• Short-lived tickets for the live mail stream, and signed, short-lived download links for files.
• Encryption of stored files with AES-256, daily backups, and access to servers limited to authorised staff.
• Warnings on suspected scam and phishing messages, with a 'Report scam' button.
• Chat is end-to-end encrypted by default. Each device creates its own key pair (ECDH P-256); the private key is created so that it cannot be exported and stays on the device. Every message is encrypted with a new AES-256-GCM key that is sealed separately for each device in the conversation. Our servers hold only encrypted messages and public keys. Notifications for chat say who wrote, never what they wrote.
• Meet audio and video are encrypted in transit (WebRTC with DTLS-SRTP) and flow directly between participants. Our servers only pass the connection messages needed to set up the call and never receive or record the meeting.

No system is perfectly secure. End-to-end encrypted email and chat, password-protected email to any address, passkeys, 2-Step Verification and a list of signed-in devices (Indo Shield) are available today; an independent security audit has not yet been completed. Please use a strong, unique password or a passkey and keep your recovery details up to date.

17. Your rights as a Data Principal

The DPDP Act gives you, the Data Principal, the following rights. We honour them for every account holder.

You can change your name and recovery details yourself in Settings, and you can delete mail and files yourself. A one-click data export button is planned but is not available yet. Until it is, ask us for a copy of your data using the steps in section 11 and we will provide it in a common electronic format.

18. How to exercise your rights

• Write from your Indo Mail address (or your recovery email) to privacy@indoemail.in. This is also the address of our Data Protection Officer contact for your rights.
• Say which right you want to use and give enough detail for us to act on it. For example, say whether you want a summary of your data or a deletion.
• We confirm your identity before acting. We may ask a question only you could answer, or ask you to reply from the account concerned. We will not ask for more personal data than we need to do this.
• We acknowledge your request within 3 working days and aim to complete it within 30 days. If a request is complex, we will tell you why and when to expect an answer.
• There is no fee for using your rights.
• If we cannot do what you ask, for example because the law requires us to keep a record, we will tell you which part we cannot do and why.

For nomination, tell us in writing the name and email address of your nominee. We will keep it on your account and use it only if we receive proof of your death or incapacity.

19. Complaints and the Data Protection Board

If you are unhappy with how we handled your data or your request, first contact our Grievance Officer: Ejaz Ahmed, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India. We acknowledge a complaint within 24 hours and resolve it within 7 days.

Under the DPDP Act you should use our grievance process before you approach the Data Protection Board of India. If you are not satisfied with our response, or you have received none within the time the DPDP Rules allow, you may make a complaint to the Data Protection Board of India. You may also use any other remedy that the law gives you.

20. Age limit and cross-border matters

Age 18 and over only. You must be at least 18 years old to hold an Indo Mail account. Under the DPDP Act, a person under 18 is a child, and processing a child's data needs verifiable consent from a parent or lawful guardian. We do not yet have a verifiable parental-consent process, so we do not knowingly create accounts for anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you believe a child has an account, write to privacy@indoemail.in.

Cross-border matters. We store the data of Indian accounts in India. Email is a global system, so when you send a message to someone whose mail provider is outside India, the message is delivered to that provider. Likewise, messages you receive from abroad pass through the sender's systems. Outgoing mail to other providers is relayed through our email sending service. If you share a Drive link, the person who opens it may be anywhere. We transfer personal data outside India only to the extent needed for these functions or when the law requires, and never to a country that the Central Government has restricted by notification under section 16 of the DPDP Act.

Indo Mail is open to people in every country. Every account, wherever its owner lives, is stored on our servers in India (our Mumbai data centre). If you sign up from outside India, your personal data is transferred to and processed in India under this policy and Indian law, with the same protections described here: encryption, Zero Data Sharing, no sale of data and no training of AI on your mail. You keep the rights given to you by the law of your own country, such as the GDPR in the European Union and the United Kingdom, and you can exercise them by writing to privacy@indoemail.in.

21. Disclosure to authorities

We disclose personal data to a court, police or government agency only when Indian law requires it and a valid order or request has been received, and only as far as the order requires. Our Law Enforcement Guidelines explain the process. We do not give authorities direct or bulk access to our systems, and we do not build backdoors.

22. Cookies and similar technologies

Indo Mail uses essential cookies only. These keep you signed in and keep the service secure, for example the session cookie and protection against forged requests. We store your theme and similar settings in your browser. We use no advertising cookies, no analytics cookies and no third-party trackers. Our Tag Manager counts conversions without cookies. Because every cookie we use is essential, there is no cookie banner to accept. You can clear cookies in your browser, but you will then be signed out.

In the current version, indoemail.in sets no cookie at all: your sign-in is kept in your browser's local storage instead. The full list of what we store on your device is in our Cookie Policy.

23. Personal data breaches

If a personal data breach affects you, we will tell you without delay. The notice will say, in plain language, what happened, what data was involved, what we are doing, what you can do to protect yourself, and who to contact. We will also report the breach to the Data Protection Board of India as the DPDP Rules require, and report cyber incidents to CERT-In within 6 hours of noticing them, as the CERT-In Directions of 28 April 2022 require. Our security team can be reached at security@indoemail.in.

24. Changes to this policy

We may update this policy when the service, the law or our processors change. If a change is significant, we will tell you by email before it takes effect. If the change needs fresh consent, we will ask for it and will not treat silence as agreement. The latest version is always on indoemail.in.

This document is governed by the laws of India.

25. Contact

Privacy questions and requests to use your rights: privacy@indoemail.in. Complaints: Ejaz Ahmed, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India. Security reports: security@indoemail.in.