POLICIES / VERSION 2026-11-01.2
Privacy notice
What IRIS X AI uses, why it is needed, who receives it and how to control it. Reviewed 26 October 2026.
Your privacy choices
Manage download consent in your account. For access, correction, erasure, nomination or a grievance, contact Harsh using your account email or receipt reference. A privacy request does not require sending your password, OTP or payment secrets.
Who handles your data
IRIS X AI is an unregistered trading name operating from India. Harsh is the privacy and grievance contact: contact@irisxai.in, irisaidevop@gmail.com and +91 7017298145. Send privacy requests to contact@irisxai.in using your account email where possible. The contact details identify our support channel; they do not describe IRIS X AI as an incorporated or registered company.
Indian privacy framework and this notice
This notice is prepared with reference to the Digital Personal Data Protection Act, 2023, the notified 2025 Rules, their corrigendum and the October 2026 Removal of Difficulties Order. Commencement is phased: the core notice, consent and individual-rights provisions are scheduled for the eighteen-month phase in May 2027. Existing applicable Indian privacy, security and consumer requirements also matter. We provide the choices described here now; this notice is not a certification that every DPDP provision is already in force or that all operational compliance work is complete.
Account data: sign-in and account support
Name, email, Google sign-in identifier where used, account verification status, account creation time and session credentials identify the account you choose to use. They let us sign you in, display your account and respond to your requests. Where password sign-in is used, stored passwords are hashed. Keep passwords, access tokens and AI-provider keys private; do not include them in a support request.
Licence and device data: paid access and security
Desktop/mobile product entitlement, device capacity, registered hardware/device identifiers, device labels, binding dates, recent activity, IP addresses and coarse network-derived locations support device binding, account security and the product’s access limits. They help identify an authorised computer or phone and investigate misuse. Coarse network location can be inaccurate. Product access is checked separately for desktop and mobile; these security checks are not permission for unrelated advertising profiles.
Purchase data: payments, renewals and your location choice
We keep product, seat quantity, order/payment/subscription references, verified amounts, fees, discounts, applicable affiliate attribution, payment status, refunds and paid-period dates to fulfil purchases, reconcile billing and manage cancellation. Razorpay, banks and payment providers handle payment credentials; our application does not store a full card number, CVV or UPI PIN. The country/state you provide is used for the purchase record and aggregate sales reports, with international purchases grouped as Outside India and unknown locations left unknown. If you explicitly provide browser coordinates, the associated purchase record may contain latitude/longitude. A state choice is not proof of residence. We retain the actual monthly payment used for any eligible lifetime-upgrade credit.
WhatsApp purchase confirmations: optional messaging
Checkout collects a country-code mobile number for purchase contact. An independent, initially unchecked choice permits one purchase confirmation on WhatsApp. If selected, we record the notice version and server timestamp and share your saved name, account email, number, purchased plan, quantity and verified payment/order references and amount with our Flowmatic WhatsApp service. Payment credentials and login tokens are not shared. A durable queue retries temporary failures using the same event ID to prevent duplicate messages. A queued/accepted result does not prove delivery. Refusing this optional message does not prevent purchase or app access, and is not marketing permission. Contact support to stop a pending confirmation or request correction/erasure, subject to required record retention. Existing records without this permission are not retrospectively messaged.
Download data: a separate choice before the installer
Before authorising an installer, we check the signed-in account’s verification, selected product and active licence. You must separately accept the download terms and consent to the limited verification/delivery processing described in the download data notice. The receipt records account and actor IDs, product, policy version, archived-notice hash, the stated purpose and server timestamps. A short-lived token links that receipt to the requested installer. These choices do not grant sales-call or marketing permission. They are separate from purchase, cancellation and app acknowledgements.
Sales, support and partnership requests
A sales enquiry contains the name, international phone number, products, buying priority, stated country/state and any bulk quantity you submit. We use it to respond to that enquiry and organise requested sales/setup assistance. A browser/device identifier and a protected network/phone recognition value enforce the rolling 24-hour enquiry limit. Sending a sales enquiry is not blanket permission for unrelated campaigns. Support messages contain the information you choose to send; minimise private documents and screenshots. Partnership applications and coupon/sales/payout records support approval, attribution and partner accounting; buyer contact details are not a general marketing list for partners.
Essential storage and optional choices
The website uses browser storage for sign-in, returning to the requested page, referral attribution where selected and abuse controls; device/account sessions support secure access. Network requests can carry IP addresses and browser information. Optional location access and app microphone, camera, files, contacts or other operating-system permissions have their own prompts and controls. Refusing an optional permission may limit the related feature. A security purpose is not a reason to collect unrelated information or bundle optional marketing into a required download choice.
Who receives information and overseas processing
Authorised account/support staff use the records needed for their work. Google handles Google sign-in; Razorpay and payment participants handle payment/mandate requests; hosting and email providers support the service; GitHub and its delivery network serve installers and receive ordinary download request metadata. If lifetime access is voluntarily ended, the account’s contact details, product and cancellation time are sent to the business owner at pandeygautam039@gmail.com for administration. Providers may process information outside India. Applicable transfer restrictions and provider terms must be followed; selecting an Indian purchase state does not mean every server is in India. Disclosure may also be required by a valid legal request.
How long data is kept
Account, device and licence records support ongoing access and security. Payment, refund, commission and policy receipts are retained while needed for financial records, licence administration, fraud prevention or a legal dispute; the two-minute download-token expiry is not the receipt’s retention period. Sales-enquiry records older than 90 days are removed by the enquiry store’s retention routine; abuse-limit receipts expire with their cooldown window. Erasure requests are reviewed against continuing legal/contractual needs, and we explain material reasons for keeping required records. Operational databases, private transaction files and any backups all need a retention review; we do not promise that closing a browser erases them. When the relevant DPDP retention provisions commence, applicable minimum legal retention must also be observed.
Withdraw consent and manage your choices
Use Privacy controls in your account to withdraw download data consent for desktop or mobile. Outstanding website download grants for that product then stop working. This action does not cancel the plan, end an installed app licence or issue a refund; renewal and lifetime cancellation have separate controls. A later download requires fresh consent. Contact Harsh to withdraw other consent-based processing or optional communications. We explain if a requested service needs the relevant information and what processing must continue for another lawful purpose. Withdrawing a choice does not erase a valid earlier transaction or waive consumer rights.
Access, correction, erasure, nomination and grievances
Email contact@irisxai.in with the subject Privacy request, your account email or receipt reference and the request: access/summary, correction, erasure, withdrawal, nomination or grievance. We verify identity proportionately and ask only for what is needed; never send an OTP, password, card secret or Aadhaar copy by default. We handle rights that apply under the law in force and explain any limit. Our target is acknowledgement within 48 hours and a substantive grievance response within one month. You may escalate through the applicable statutory route, including the Data Protection Board when the relevant provisions and complaint mechanism apply. The account contact or dashboard link is a support route, not a waiver of that right.
Children, guardians and accessible explanations
Self-service account purchases and licence acceptance are intended for adults aged 18 or over. A parent should contact support before submitting a child’s personal data; we have not implemented a self-service verifiable-parental-consent workflow. Where a person has a lawful guardian under applicable law, contact support for the appropriate process before submission. A disability alone does not establish a need for a guardian. Ask Harsh for an accessible explanation or help understanding the notice in an Indian language before making a choice.
Security and incident contact
We use authenticated access checks, limited admin permissions, device/session controls and signed short-lived download authorisations to reduce unauthorised access. Operational transaction files are kept in private backend storage. Report a suspected account compromise or data incident to contact@irisxai.in or irisaidevop@gmail.com promptly. We investigate, take containment steps and provide affected people and authorities the notifications required by the law that applies; payment, security and privacy incidents may have different reporting duties.
App and third-party services
The apps may use AI providers, local tools and operating-system permissions selected during setup. Read the notices in the version you install and the providers you configure; this website notice is not a verified inventory of every native-app integration. App permissions and your instructions determine access to files, contacts, messages, microphones or cameras. Review sensitive outputs and actions. A website checkbox is not permission to use another person’s data without authority.
Changes to the notice
The displayed policy version identifies the text you review. A new download or purchase uses the current version and creates its own dated receipt; earlier receipts retain their archived notice reference. A notice update does not silently convert an existing lifetime purchase into a subscription or constitute consent for a new optional purpose.
Business & grievance contact
IRIS X AI · India · unregistered trading name
Privacy & grievance contact: Harsh
contact@irisxai.in
irisaidevop@gmail.com
+91 7017298145
Indian privacy references · reviewed 2026-10-26
The Act and Rules have phased commencement. These references explain the framework; the notice describes the choices provided by IRIS X AI.