Privacy Policy
Effective 23 September 2026 · XDQ Labs Private Limited
This notice explains what personal data Xflot collects, why, and what you can do about it. It is written under the Digital Personal Data Protection Act, 2023.
If you only read the site
Nothing personal is collected. You do not need an account to read any page here, and we do not require you to identify yourself to see any data.
If you subscribe to alerts
| What | Required? | Why |
|---|---|---|
| Email address | Yes | To send the alerts you asked for. Without it there is no way to deliver them. |
| Name | Optional | To address the alert to you. |
| City | Optional | To highlight IPOs from companies based near you. |
| Mobile number | Optional | Reserved for SMS or WhatsApp alerts if we add them. Currently unused. |
| IP address, browser | Automatic | Recorded once at signup as proof of consent, and to block automated abuse. |
| Your alert settings | Automatic | Frequency, topics and detail level, so you get what you chose. |
If you sign in
| What | When | Why |
|---|---|---|
| Sign-in codes | Each time you sign in | A six-digit code we email you. Stored only as a one-way fingerprint, never as the code itself. |
| IP address when you ask for a code | Each time you ask | To stop anyone flooding one address with codes, or trying many addresses from one place. |
| Sign-in sessions | While you're signed in | So you stay signed in. Stored only as a one-way fingerprint, and ended when you sign out. |
| Watchlist, predictions, set-up answers | If you add them | So your dashboard shows what you chose. |
| Refund requests | If you ask for one | Which payment, your reason if you give one, and our decision. Kept with payment records. |
| Payments | If you buy a plan | Razorpay handles your card or UPI details — we never see them. We keep the payment reference, amount, plan and date. |
| Questions you ask Ask Xflot | If you use it | The question and the reply, so we can check the replies are accurate and fair, and to apply the daily limit. A pasted list of holdings is never stored. Deleted after 90 days. |
| Holdings you paste into Portfolio | If you use it | Analysed in memory to answer that one request, then discarded. Never written to our database or our logs. |
Consent, and how it is recorded
We use double opt-in: after you enter your address we send one confirmation email, and nothing else is sent until you click the link in it. We record the moment you confirmed and what you agreed to. If you never click, no alerts are sent and the pending record is removed.
What we do with it
We use your data to send the alerts you asked for, to run your account and any plan you buy, and for nothing else. We do not sell personal data. We do not rent, share or trade mailing lists. We do not send third-party advertising to subscribers.
Who else touches it
Brevo delivers our email and processes your address to do so. Razorpay processes payments. Our hosting provider stores the database. These are processors acting on our instructions, not independent recipients. Data is stored in India or with providers offering equivalent protection.
How long it is kept
Your account is kept until you delete it. When you delete it, the record is deleted, not merely flagged — your address, any name, city or number you gave us, your settings, watchlist, predictions and sign-in sessions are all removed. Stopping email does not delete anything; it only stops email.
Payment records are the exception, and we would rather say so than have it surprise you: if you ever paid for a plan, the payment reference, amount, plan and date are kept for as long as tax and accounting law require, even after you delete your account. They are needed to answer a refund or a dispute, and the law does not let us discard them.
Sign-in codes are deleted after 24 hours. Sign-in sessions are deleted 30 days after they end. Failed payment attempts are deleted after 1 year, and records of renewal reminders after 2 years.
Signups that are never confirmed are deleted automatically after 72 hours. If you never click the confirmation link, nothing is kept.
Records of which alerts were sent to which subscriber are kept for 30 days, so the same alert is not sent twice, then deleted.
One exception, and we would rather state it than have it be a surprise: if your mail provider repeatedly rejects our messages, or a message is reported as spam, we keep a record of that address specifically so that we do not send to it again. Without it, the next signup would re-add the address and repeat the problem.
Your rights
Under the DPDP Act you may ask for access to your data, correction of it, erasure, and withdrawal of consent. In practice:
- Stop email: the unsubscribe link at the foot of every email opens a page with a Stop all emails button. Your mail app's own unsubscribe button does the same. Nothing is deleted.
- Erase everything: sign in and use Delete account. If you have no active paid plan, the same page as the email link also offers it. Everything except payment records is removed immediately.
- Change what you receive: the preferences link, or your account settings.
- Access or correction: write to the grievance contact below.
- Nominate someone to exercise these rights on your behalf in the event of death or incapacity: write to us.
Security
The site is served over HTTPS. Access to the database is restricted. The link at the foot of each email can change or stop your email and nothing else — it does not sign anyone in, so forwarding an email does not hand over your account. Signing in needs a one-time code sent to your address. Codes and sessions are stored only as one-way fingerprints, and pages carrying email links are not cached.
No system is perfectly secure. If a breach affects your data we will notify you and the Data Protection Board as the Act requires.
Children
This site is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has subscribed, tell us and we will remove the record.
Changes
If this notice changes materially we will say so on this page and, where the change affects how we use your data, by email.
Grievance contact
Questions or complaints about how your data is handled:
XDQ Labs Private Limited
Spaze iTech Park, Sector 49, Gurugram, Haryana, India
enquiry@xdqlabs.com
If you are not satisfied with our response you may complain to the Data Protection Board of India.