Privacy Policy
What we collect, why we collect it, who we share it with (almost no one), and how to export or delete every record we hold.
Your data is yours. We collect the minimum we need to deliver the service, never sell it, never share it with advertisers, and never use it to train AI models without your explicit written consent.
What we collect
Account data
Name, email, phone number, organisation name
GSTIN if you opt into GST-compliant invoicing
Billing address and the last 4 digits of the card used for payment (payment processors hold the full PAN, not us)
Lead & pipeline data
Leads, contacts, deals, messages, files and notes that you create or import into the workspace
This data is treated as your data — we are the data processor, you are the data controller
Usage data
Page views, click events, browser type and screen size — collected via privacy-respecting first-party analytics, never shared with third parties
Server logs (IP, request path, response code) retained for 30 days for debugging and abuse prevention
Why we collect it
We collect personal data only to deliver and improve the service: authenticating you, charging you, processing your leads, sending you product email, and answering your support tickets. We do not collect any data we don't need.
Who we share it with
We share data with a very short list of sub-processors required to deliver the service:
Razorpay / Cashfree — payment processing
AWS / Hetzner — hosting and backups (region: India, ap-south-1)
Meta (WhatsApp Business API) — only if you connect WhatsApp; only the messages you explicitly send
We never sell or rent personal data to anyone, ever.
How long we keep it
Account and lead data: retained while your subscription is active and for 30 days after cancellation (so reactivation works). After that, permanent deletion within 30 days, subject to legal retention for GST invoice records (8 years per Indian tax law).
Server logs: 30 days, then automated deletion.
Your rights under the DPDP Act 2023
You can, at any time, free of charge:
Export every record of yours in machine-readable format
Correct any inaccurate personal data we hold
Delete your account and have your data permanently erased
Object to specific processing activities (e.g. product email)
Most of these are self-service from inside the platform. For anything that isn't, email info@indicoders.com with subject "DPDP request" and we'll respond within 7 working days.
Security
TLS 1.2+ everywhere, AES-256 at rest, 2FA available for every account, IP allow-listing for super-admins, daily encrypted backups, regular third-party security audits.
Cookies
We use essential cookies (session, CSRF, language preference). Analytics cookies only fire if you click "Accept all" on the consent banner. See our cookie policy for the full list.
Children's data
The service is not intended for users under 18, and we don't knowingly collect data from children.
Changes to this policy
We'll email account holders 30 days before any material change. The "Last updated" date at the bottom of this page always reflects the most recent revision.
Contact
Data protection officer: info@indicoders.com · +91-9870864229
Last updated: 26 May 2026.
Last updated May 26, 2026