Privacy Policy
Last updated:
1. Who we are
IndicStack Consultancy Services LLP ("IndicStack", "we", "us") is a limited liability partnership registered in India. LLPIN: ACZ-6365. Registered office: 11th Floor, 24X7.ai Building, Prestige Tech Platina 2, Kadubeesanahalli, Bengaluru 560087, Karnataka, India.
This policy tells you how we collect, use, share and protect personal data when you use indicstack.ai, its subdomains (including api.indicstack.ai), our API, agents and consulting services (together, the "Services").
2. Our role under the DPDP Act
We follow the Digital Personal Data Protection Act, 2023 ("DPDP Act") and its Rules, as applicable.
- Data Fiduciary. We decide how to use website data, form data, account data and billing data. For this data, we are the Data Fiduciary.
- Data Processor. When a customer sends data to our API or agents (prompts, files, completions), the customer is the Data Fiduciary. We process that data only on the customer's instructions, under our Data Processing Agreement ("DPA"). If your data reached us through a customer's product, please contact that customer first.
3. Data we collect
| Source | Data | Why we collect it |
|---|---|---|
| Website visits | IP address, browser, device type, pages visited, referral source, cookie IDs, interactions and session recordings | Run and secure the site. Measure use and advertising performance, subject to your cookie choices (see the Cookie Policy) |
| Early access form | Work email, name, company, role, other details you give | Review your request and reply to you |
| Contact form | Name, work email, mobile number, company (if provided), topic and message | Reply to your enquiry |
| Report downloads | Name, official email, company or institution, mobile number, referral source, email delivery and download events | Send the report, support delivery, prevent misuse |
| Account | Name, work email, company, role, API key IDs, login events | Create and manage your account |
| Billing | Company name, billing address, GSTIN, PAN, TDS details, invoice and payment records | Raise GST invoices, collect payment, meet tax law |
| API and agents | Prompts, files, completions ("Customer Content") | Return the response you request |
| API and agents | Request metadata: time, model, token count, API key ID, latency, status code, IP address | Billing, rate limits, security, abuse prevention, audit |
| Support and calls | Emails, messages, meeting notes | Answer your questions and give support |
We do not ask for sensitive data such as health, financial account or biometric data through our website. Customers may send such data in Customer Content. The customer must have a lawful basis and the needed consents for that data.
4. How we use your data
- To provide, run and secure the Services.
- To reply to requests and give customer support.
- To bill, collect payment and keep accounts.
- To detect and prevent fraud, abuse and breaches of our Terms.
- To measure and improve the website using Google Analytics and Microsoft Clarity, including interaction analysis and session recordings (unless you turn off analytics in Cookie settings).
- To measure advertising performance and support advertising audiences using LinkedIn Insight Tag and Meta Pixel (unless you turn off advertising in Cookie settings).
- To send service messages about your account, billing and changes.
- To send marketing emails only if you agree. Every marketing email has an unsubscribe link.
- To meet legal duties and answer lawful requests from authorities.
No training on your data. We do not use Customer Content to train, fine-tune or improve any AI model. This is a contractual commitment.
5. Legal basis
We process personal data with your consent, or for legitimate uses allowed by the DPDP Act. Examples are data you give us for a request, and data we must keep under tax and other laws. You can withdraw consent at any time (see section 9). Withdrawal does not affect processing done before it. If you withdraw consent that a service needs, we may not be able to give that service.
6. Where we store and process data
- Customer Content is processed on cloud infrastructure in India. We do not move it outside India.
- Website, form, account and billing data is stored on infrastructure in India.
- Some service providers process limited data outside India:
- Resend (United States) delivers report emails. It processes your email address and the download link.
- Google (Google Analytics through Google Tag Manager) and Microsoft Clarity process website use and interaction data unless you turn off analytics in Cookie settings.
- LinkedIn Insight Tag and Meta Pixel process website activity, browser identifiers and advertising interaction data unless you turn off advertising in Cookie settings. These providers may link this information with information they hold about you.
- Google Workspace processes our business email.
Any transfer outside India follows the DPDP Act and the countries allowed by the Government of India.
7. Who we share data with
We do not sell or rent personal data. We share data only with:
- Service providers that host, deliver email, give analytics or process payments for us. Our service providers act on our instructions under contracts with confidentiality and security terms. Analytics and advertising providers may also process data under their own privacy policies, as described in our Cookie Policy. A current list of sub-processors is available on request at dpdp@indicstack.ai.
- Our professional advisors (chartered accountants, company secretaries, lawyers) under duties of confidentiality.
- Government authorities, courts and regulators, when the law requires it.
- Others, when needed to protect the rights, safety or property of IndicStack, our customers or the public.
- A buyer or successor, if we merge, sell or restructure our business. The same protections continue to apply.
8. How long we keep data
| Data | Retention |
|---|---|
| Customer Content (prompts, files, completions) | Not stored. We delete it after we return the response |
| Request metadata | 12 months |
| Early access, contact and report requests | 24 months from the last contact, or until you ask us to delete it |
| Account data | While the account is active, then 90 days |
| Billing and tax records | 8 years, as tax and accounting laws require |
| Analytics data | 14 months |
When the retention period ends, we delete the data or make it anonymous.
9. Your rights
Under the DPDP Act, you can:
- Get a summary of your personal data and how we process it.
- Correct, complete or update your data.
- Ask us to delete your data. We delete it within 30 days, unless the law requires us to keep it.
- Withdraw consent, as easily as you gave it.
- Nominate another person to use your rights if you die or cannot act.
- Raise a grievance with us, and then with the Data Protection Board of India.
- Unsubscribe from marketing at any time.
To use a right, email dpdp@indicstack.ai from the email address we have on record. We may ask you to confirm your identity. We do not charge for requests.
10. Security
We use technical and organisational controls to protect data. These include encryption in transit (TLS), encryption at rest, access controls based on role, audit logs, API key controls and staff confidentiality duties.
11. Data breaches
If a personal data breach occurs, we act at once to contain it. We inform the Data Protection Board and the affected persons as the DPDP Act and its Rules require. For Customer Content, we inform the affected customer without undue delay, as set out in the DPA.
12. Children
Our Services are for businesses and adults. We do not knowingly collect data of persons under 18 years. If we find that we have such data without verifiable consent of a parent or lawful guardian, we delete it.
13. Cookies
We use cookies that the site needs to work. Analytics and advertising technologies also run when you visit, unless you turn off those categories using Reject all or Settings. You can change your choice at any time using Cookie settings in the footer. A change stops the relevant trackers on subsequent page loads; it does not undo data already collected. See our Cookie Policy.
14. Links to other sites
Our site can link to other websites and to model licences on other sites. Their own privacy policies apply. We are not responsible for their content or practices.
15. Changes to this policy
We may change this policy. We will show the new date at the top. For material changes, we will tell you by email or by a clear notice on our website before the change takes effect.
16. Grievances and contact
For questions, requests or grievances about personal data, contact us at:
Email: dpdp@indicstack.ai
IndicStack Consultancy Services LLP, 11th Floor, 24X7.ai Building, Prestige Tech Platina 2, Kadubeesanahalli, Bengaluru 560087, Karnataka, India.
We acknowledge each grievance within 2 working days and resolve it within 15 working days. If you are not satisfied with our reply, you can complain to the Data Protection Board of India.