Privacy policy

Last updated 29 September 2026

This policy explains what personal data IndexOI collects through IndexOI, why, and what you can ask us to do with it. It follows the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023.

What we collect

• Account details: your name, email address and mobile number.
• Login details: your password, stored only as a one-way hash that nobody can read back; and, for the one-login rule, the time, IP address and browser of your current session.
• Payment details: the plan, amount, date and the payment reference. Card, UPI and bank details are entered on Razorpay's secure checkout and never reach us.
• Enquiries: what you send through the enquiry form or to our email or phone.

Why we use it

• To create your account, let you sign in and give you access for your plan.
• To confirm payments, send receipts, renewal reminders and service messages by email, SMS or WhatsApp.
• To answer your questions and grievances, and to prevent sharing of logins and misuse.
• To meet legal, tax and accounting duties.

We do not sell or rent your personal data, and we do not use it for third-party advertising.

Who we share it with

• Razorpay, to process payments.
• The services that carry our messages (email and WhatsApp providers), only to deliver them.
• Our hosting provider, which stores the data on our behalf.
• Government or law-enforcement bodies when the law requires it.

Cookies

We use one essential cookie to keep you signed in. We use no advertising or tracking cookies. The home page shows videos from YouTube, which may set its own cookies when you play one.

How long we keep it

For as long as your account is open, and afterwards only as long as tax and legal duties require (payment records usually 8 years).

Security

Data is kept on secured servers, passwords are hashed, and the site is served over HTTPS. No system is completely secure, but we take reasonable care to protect your data.

Your rights

You may ask to see, correct or delete your personal data, or withdraw consent for messages, by writing to [email protected]. Deleting the account ends access to the service.

Grievance officer

[email protected]. We acknowledge a grievance within 48 hours and resolve it within 30 days.

Children

The service is for adults (18 and over). We do not knowingly collect data from children.

Changes

We may update this policy; the date below shows the latest version.