Privacy Policy
Effective September 2026 · XDQ Labs Private Limited
This notice explains what personal data Xflot collects, why, and what you can do about it. It is written under the Digital Personal Data Protection Act, 2023.
If you only read the site
Nothing personal is collected. You do not need an account to read any page here, and we do not require you to identify yourself to see any data.
If you subscribe to alerts
| What | Required? | Why |
|---|---|---|
| Email address | Yes | To send the alerts you asked for. Without it there is no way to deliver them. |
| Name | Optional | To address the alert to you. |
| City | Optional | To highlight IPOs from companies based near you. |
| Mobile number | Optional | Reserved for SMS or WhatsApp alerts if we add them. Currently unused. |
| IP address, browser | Automatic | Recorded once at signup as proof of consent, and to block automated abuse. |
| Your alert settings | Automatic | Frequency, topics and detail level, so you get what you chose. |
Consent, and how it is recorded
We use double opt-in: after you enter your address we send one confirmation email, and nothing else is sent until you click the link in it. We record the moment you confirmed and what you agreed to. If you never click, no alerts are sent and the pending record is removed.
What we do with it
We use your data to send the alerts you subscribed to, and for nothing else. We do not sell personal data. We do not rent, share or trade mailing lists. We do not send third-party advertising to subscribers.
Who else touches it
The email provider that delivers our messages processes your address in order to send them, and our hosting provider stores the database. These are processors acting on our instructions, not independent recipients. Data is stored in India or with providers offering equivalent protection.
How long it is kept
For as long as you stay subscribed. When you unsubscribe the record is deleted, not merely flagged — the address, and any name, city or number you gave us, are removed, along with the log of which alerts you were sent.
Signups that are never confirmed are deleted automatically after 72 hours. If you never click the confirmation link, nothing is kept.
Records of which alerts were sent to which subscriber are kept for 30 days, so the same alert is not sent twice, then deleted.
One exception, and we would rather state it than have it be a surprise: if your mail provider repeatedly rejects our messages, or a message is reported as spam, we keep a record of that address specifically so that we do not send to it again. Without it, the next signup would re-add the address and repeat the problem.
Your rights
Under the DPDP Act you may ask for access to your data, correction of it, erasure, and withdrawal of consent. In practice:
- Withdraw consent / erase: the unsubscribe link at the foot of every alert. One click, no login, and the record is deleted immediately — not queued or flagged.
- Change what you receive: the preferences link beside it.
- Access or correction: write to the grievance contact below.
- Nominate someone to exercise these rights on your behalf in the event of death or incapacity: write to us.
Security
The site is served over HTTPS. Access to the subscriber database is restricted. Alert links use single-purpose tokens rather than exposing your address in a URL, and pages carrying those tokens are not cached.
No system is perfectly secure. If a breach affects your data we will notify you and the Data Protection Board as the Act requires.
Children
This site is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has subscribed, tell us and we will remove the record.
Changes
If this notice changes materially we will say so on this page and, where the change affects how we use your data, by email.
Grievance contact
Questions or complaints about how your data is handled:
XDQ Labs Private Limited
Spaze iTech Park, Sector 49, Gurugram, Haryana, India
enquiry@xdqlabs.com
If you are not satisfied with our response you may complain to the Data Protection Board of India.