Privacy Policy

This Privacy Policy (the "Policy") governs the collection, use, storage, sharing, and protection of personal data when you use the IronTrex mobile application, website, APIs, and related services (collectively, the "Services").

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules framed thereunder, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (collectively, the "IT Rules"), and applicable directions of the Indian Computer Emergency Response Team ("CERT-In"), together with other applicable laws in India.

By creating an account, installing, accessing, or using the Services, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, please do not use the Services.

IronTrex CyberTechnology Private Limited is a company incorporated under the Companies Act, 2013, with its registered office in Hyderabad, Telangana, India. For the purposes of the DPDP Act, IronTrex is the Data Fiduciary responsible for the personal data processed through the Services.

We collect only such personal data as is reasonably necessary to provide and secure the Services:

• Identity data — name, mobile number, email address, and details provided during account creation.
• Device and technical data — device model, operating system and version, unique device identifiers, application version, IP address, network information, installed security settings, and diagnostic or crash data.
• Usage data — features accessed, interactions with scam alerts, preferences, subscription status, and in-app activity.
• Content you submit — URLs, links, messages, or screenshots submitted to, or opened within, the IronTrex protected browser or scam-reporting flows.
• Ask IronTrex interactions — the queries you send to the Ask IronTrex assistant and the responses generated.
• Location data — approximate location derived from network signals, collected only with your permission and used to contextualise scam risk.
• Payment and subscription data — plan, billing status, and payment-provider reference. We do not store full card numbers on our servers.
• Cyber Warranty claim data — incident details, supporting documents, and bank or police complaint references, where a claim is made.
• Security and audit logs — maintained for fraud prevention, abuse detection, debugging, and compliance.

We process personal data only for specified, lawful purposes, each consistent with the notice and consent provided to you or otherwise permitted by law:

• Detecting and classifying scam, phishing, malware, and other cyber-risk signals.
• Operating the protected browser, link-scanning, and threat-intelligence features.
• Providing Ask IronTrex educational and safety guidance.
• Improving the accuracy and reliability of our threat-detection systems on an aggregated basis and, where you opt in to Community Threat Intelligence (Section 4.1), using anonymised security signals.
• Securing the Services, preventing abuse, and investigating incidents.
• Administering your subscription, billing, and Cyber Warranty eligibility and claims.
• Providing customer support and addressing grievances.
• Meeting legal, regulatory, tax, accounting, and law-enforcement obligations.
• Communicating service updates and security alerts, and, with your consent, promotional information.
• Producing aggregate, non-identifying insights and statistics.

We process personal data on the basis of your consent, the performance of our contract with you, our legitimate interest in operating a secure service, and compliance with applicable law, together with any other lawful basis available under the DPDP Act and IT Rules.

At sign-up, consent is obtained through clear, separate, and specific choices: agreement to our Terms of Service and this Policy; consent to the scanning necessary to deliver the core protection Services; and optional consent to Community Threat Intelligence. Optional choices are presented separately and are not pre-selected. We maintain records of the consent provided, including its date and the version of this Policy then in force. You may withdraw consent at any time, with effect on future processing and without affecting processing already lawfully carried out.

We do not sell personal data. We disclose personal data only where necessary, and only to recipients bound to protect it:

• Cloud hosting and infrastructure providers.
• Analytics, crash-reporting, and performance-monitoring providers.
• Payment gateways, app stores, and billing processors.
• Artificial-intelligence and machine-learning providers that process inputs on our behalf under contractual confidentiality obligations.
• Customer-support and communication providers.
• Cyber Warranty verification partners, including investigators and document-verification providers.
• Independent security auditors and assessors, under confidentiality.
• Courts, regulators, CERT-In, and law-enforcement agencies, where required by law.
• An acquirer or successor in interest in the event of a merger, restructuring, or business transfer, subject to equivalent protections.

Personal data is stored primarily on servers located in India. Where service providers process data outside India — for hosting, analytics, or artificial-intelligence processing — we do so only where permitted under the DPDP Act and IT Rules, and subject to appropriate contractual and technical safeguards, limited to what the relevant service requires. Security and audit logs are retained within Indian jurisdiction in a manner consistent with CERT-In directions, including a rolling retention period of not less than 180 days where applicable.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to meet legal obligations, to resolve disputes, and to support Cyber Warranty claims. The principal retention periods are set out below; further detail is provided in our Data Retention and Deletion Policy.

• Security scan records — the scanned link, the result displayed, and the timestamp — are retained for up to forty-five (45) days, after which they are deleted or irreversibly anonymised.
• Account data — upon deletion of your account, associated personal data is deleted within thirty (30) days, except where retention is required for legal, security, or Cyber Warranty purposes.
• Cyber Warranty claims — records relevant to a claim are retained until the claim is resolved; thereafter, records relating to approved claims are retained for one hundred and eighty (180) days, and records relating to declined claims for up to two (2) years, after which they are deleted, save where a longer period is required by law.

We maintain reasonable administrative, technical, and organisational safeguards consistent with the IT Act, IT Rules, and DPDP Act, including encryption in transit (and at rest where applicable), role-based and least-privilege access controls, monitoring and audit logging, periodic vulnerability assessment and penetration testing, secure development practices, and a defined incident-response process.

No method of transmission or storage is entirely secure, and IronTrex cannot guarantee absolute security. We will, however, apply these safeguards diligently and, in the event of a security incident affecting your data, act and notify you and the relevant authorities as required by law.

Subject to applicable law, you have the right to:

• Access a summary of the personal data we process and the processing undertaken.
• Correct inaccurate or incomplete personal data.
• Erase your personal data, subject to legal and operational retention requirements.
• Withdraw consent at any time, with effect on future processing.
• Nominate an individual to exercise your rights in the event of your death or incapacity.
• Seek redressal of any grievance through the channels in Section 14.

To exercise any right, contact dpo@irontrex.com. We may require reasonable verification of identity before acting on a request.

We use cookies and similar technologies to maintain sign-in and session continuity, remember your preferences, support security, and analyse usage. Subject to your settings and any consent required by law, certain technologies may also support analytics and limited advertising or re-engagement. Third parties whose technologies we permit act under their own privacy policies. Where the law requires, we will seek your consent before using non-essential cookies. You may manage cookies through your browser or device settings.

We maintain processes to identify, contain, and investigate security incidents affecting the Services. Where required under CERT-In directions, the DPDP Act, the IT Rules, or other applicable law, we will report incidents to the relevant authority within the prescribed timelines and notify affected users in the manner required.

We may update this Policy to reflect changes in law, technology, or our Services. Material changes will be communicated through the Services or by other reasonable means. Where a change materially alters the purposes of processing or otherwise requires fresh notice or consent under applicable law, we will provide updated notice and obtain such consent as required before the change takes effect. Continued use of the Services after the effective date of an updated Policy constitutes acceptance of it.

For any question, request, or grievance relating to this Policy or the processing of your personal data, please contact:

• Data Protection Officer / Grievance Officer: dpo@irontrex.com
• Support: support@irontrex.com
• Legal: legal@irontrex.com
• Registered Office: IronTrex CyberTechnology Private Limited, GMR Aero Towers, Aero City, Hyderabad, Telangana, India.

We will acknowledge and respond within the timelines prescribed under applicable law. If you remain dissatisfied, you may lodge a complaint with the Data Protection Board of India. This Policy is governed by the laws of India, and the courts of Hyderabad shall have exclusive jurisdiction.