Legal · Privacy
This Privacy Policy constitutes the notice required under Section 5 of the Digital Personal Data Protection Act, 2023, read with Rule 3 of the Digital Personal Data Protection Rules, 2025, and sets out how Iotamine Cloud Private Limited processes your personal data.
Summary of this Policy
Summaries on this page are provided for convenience only. They do not form part of, and do not limit or modify, the clauses of this Privacy Policy.
1.1This Privacy Policy ("Policy") is issued by Iotamine Cloud Private Limited, a company incorporated under the Companies Act, 2013, bearing Corporate Identity Number U62099HR2025PTC131427 and having its registered office at C/O WeWork DLF Forum, Cybercity, Phase III, DLF QE, Gurgaon, Haryana, India, 122002 ("Iotamine", "we", "us" or "our"), and applies to the processing of personal data in connection with iotamine.com, the Iotamine control panel, our application programming interfaces and integrations, and the cloud services we provide (collectively, the "Services").
1.2In respect of the personal data described in this Policy, Iotamine is the Data Fiduciary within the meaning of Section 2(i) of the DPDP Act.
1.3This Policy does not govern Customer Content. Where Customer Content contains personal data of any individual, you are the Data Fiduciary in respect of such personal data and Iotamine acts as your Data Processor, processing it solely to provide the Services, on your documented instructions, or as required by law.
1.4This Policy should be read together with our Terms of Service and Acceptable Use Policy.
2.1In this Policy, unless the context otherwise requires, the following terms have the meanings given below. Terms not defined here have the meanings given to them in the DPDP Act.
Summary: we process only the personal data needed to provide the Services, comply with law, keep the Services secure, and improve our website and measure our advertising.
3.1We process the categories of personal data set out below, for the purposes and on the lawful basis indicated against each. "Consent" refers to consent given under Section 6 of the DPDP Act. "Legitimate use" refers to a use permitted under Section 7 of the DPDP Act, including personal data provided voluntarily for a specified purpose. "Required by law" refers to processing necessary to comply with a legal obligation.
3.2We shall not process personal data for any purpose other than those specified in this Policy without first notifying you and, where required by law, obtaining your consent.
3.3Card, UPI and bank account details are collected and processed directly by our payment partners and are not stored by Iotamine. Your full Aadhaar number is not stored by Iotamine.
Summary: where we rely on consent, you give it when you sign up or take the relevant action, and you can withdraw it at any time just as easily.
4.1Where processing is based on consent, such consent is obtained through a clear affirmative action, including your acceptance of this Policy and the Terms of Service at the time of registration, or when you complete a specific action such as identity verification.
4.2You may withdraw your consent at any time, with the same ease with which it was given, by writing to the Grievance Officer or, in the case of website analytics, by using the control provided in clause 13.3.
4.3Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal. Where the Services depend on the personal data concerned, withdrawal may result in our being unable to continue providing those Services, in which case your account may be closed in accordance with the Terms of Service.
4.4You may also give, manage, review or withdraw consent through a Consent Manager registered with the Data Protection Board of India, once such facility is available.
Summary: account data is stored in India; certain providers process data abroad, as permitted by the DPDP Act.
Stored in India
Account data is stored on systems located in India.
Processed abroad
Certain service providers process personal data in the United States and other countries.
6.1Transfers of personal data outside India are made in accordance with Section 16 of the DPDP Act. We shall not transfer personal data to any country or territory notified as restricted by the Central Government.
6.2Where you elect to deploy resources in a region outside India, Customer Content stored in such resources is held in that region.
Summary: we keep personal data only as long as needed or as required by law, then erase or anonymise it.
7.1In accordance with Section 8(7) of the DPDP Act, we retain personal data only for as long as necessary for the purposes for which it was collected, or for such longer period as is required by applicable law, as set out below. Upon expiry of the applicable period, personal data is erased or irreversibly anonymised.
Command output
Reviewing changes to your serversUp to 30 days
Ad click identifiers
Measuring marketingUp to 90 days
Security and access logs
DPDP Rules, 2025 and CERT-In Directions, 20221 year
Website usage data
Improving the websiteUp to 13 months
Support communications
Follow-ups and disputesAccount life + 3 years
KYC records
CERT-In Directions, 20225 years after closure
Invoices and tax records
Companies Act, 2013 and GST law8 years
Account details
Providing the ServicesWhile your account is open
Customer Content and backups
Provision of the ServicesUntil deleted by you
Summary: you can access, correct and erase your personal data, withdraw consent, raise a grievance and nominate a representative, free of charge.
8.1Subject to the DPDP Act and the DPDP Rules, you have the following rights in respect of your personal data:
To obtain a summary of the personal data being processed, the processing activities undertaken, and the identities of those with whom it has been shared.
To have inaccurate or misleading personal data corrected, and incomplete personal data completed or updated.
To have personal data erased once it is no longer necessary for the purpose for which it was processed, unless retention is required by law.
To withdraw consent at any time, with the same ease with which it was given.
To have grievances addressed by our Grievance Officer in accordance with clause 10.
To nominate another individual to exercise your rights in the event of your death or incapacity.
8.2Procedure. Requests to exercise these rights shall be made to the Grievance Officer at [email protected] from the email address registered to your account.
Submit request
Write to the Grievance Officer from your registered email, stating the right you wish to exercise.
Verification
We may verify your identity to protect your personal data from unauthorised requests.
Action
We act on your request in accordance with the DPDP Act and the DPDP Rules.
Response
You receive our response within ninety (90) days of receipt of your request.
8.3Time period. We shall respond to your request within ninety (90) days of its receipt, in accordance with the DPDP Rules. We may verify your identity before acting on a request.
8.4Limitations. The right to erasure does not extend to personal data that we are required to retain under applicable law, including the records specified in clause 7.
9.1In accordance with Section 15 of the DPDP Act, while exercising your rights you shall:
Summary: raise any concern with our Grievance Officer first; if it is not resolved, you may approach the Data Protection Board of India.
Grievances may be addressed to [email protected]. We shall acknowledge and resolve your grievance within ninety (90) days.
If your grievance is not resolved, you may file a complaint with the Board. Information is available on the Ministry of Electronics and IT website.
10.1In accordance with Section 13(3) of the DPDP Act, you are required to exhaust the grievance redressal mechanism provided by Iotamine before approaching the Data Protection Board of India.
11.1The Services are intended only for persons who have attained the age of eighteen (18) years. In accordance with Section 9 of the DPDP Act, we do not knowingly process the personal data of a child, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
11.2If we become aware that an account belongs to a child, we shall close the account and erase the associated personal data, save as required to be retained by law.
Summary: we protect personal data with reasonable safeguards and will promptly inform you and the authorities if a breach occurs.
12.1In accordance with Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules, we maintain reasonable security safeguards to prevent personal data breach, including:
Encryption in transit
Personal data transmitted between you and the Services is encrypted in transit.
Protection of identifiers
Credentials and sensitive identifiers are stored in hashed or masked form.
Access control
Access to personal data is limited to authorised personnel on a need-to-know basis and is logged.
Logging and monitoring
Logging and monitoring are maintained to detect and investigate misuse.
12.2In the event of a personal data breach, we shall notify affected Data Principals and the relevant authorities as set out below, in accordance with Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules:
Breach notification
Affected Data Principals
The nature, extent and timing of the breach, its likely consequences, mitigation measures, and steps you may take.
Data Protection Board of India
Intimation without delay, followed by a detailed report within seventy-two (72) hours.
CERT-In
Reporting within the period prescribed under its directions.
12.3You are responsible for maintaining the confidentiality of your account credentials and API keys. We recommend that you enable two-factor authentication.
14.1We may amend this Policy from time to time. The effective date and version number shown on this page will be updated upon each amendment.
14.2Where an amendment materially affects the manner in which we process your personal data, we shall notify you by email before it takes effect and, where required by law, seek your consent afresh.
14.3Each version of this Policy remains available below in PDF form, so that you can refer to the terms in force on any given date.
Current version
Effective from 14 October 2026
Superseded
In force 30 April 2025 to 13 October 2026
15.1This Policy shall be governed by and construed in accordance with the laws of India. Subject to the jurisdiction of the Data Protection Board of India under the DPDP Act, all disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts in India.
15.2This Policy is available in English and, on request, in any language specified in the Eighth Schedule to the Constitution of India. In the event of any inconsistency between versions, the English version shall prevail to the extent permitted by law.
15.3Headings and summaries are for convenience only and shall not affect the interpretation of this Policy.
16.1In accordance with Section 8(9) of the DPDP Act and Rule 9 of the DPDP Rules, questions about the processing of your personal data, requests to exercise your rights, and grievances may be addressed to:
Grievance Officer
Piyush Ladhar
Director, Founder & CEO · DIN 10247380
Iotamine Cloud Private Limited
Registered office: C/O WeWork DLF Forum, Cybercity, Phase III, DLF QE,
Gurgaon, Haryana, India, 122002
CIN U62099HR2025PTC131427
Iotamine Cloud Private Limited · CIN U62099HR2025PTC131427 · Privacy Policy · Version 2.0 · Effective 14 October 2026 · Supersedes the Privacy Policy dated 30 April 2025.