This Privacy Policy is prepared in accordance with the Digital Personal Data Protection Act, 2023 (India). ipowork is committed to processing personal data lawfully, transparently, and only to the extent necessary for legitimate business purposes.
ipowork (operating as ipowork.com) is a capital markets research and intelligence platform serving institutional professionals in India. We are the Data Fiduciary for personal data collected through our platform.
Registered address: [ipowork registered address]
Data Protection Contact: privacy@ipowork.com
This policy applies to personal data collected from users of ipowork.com and related portals. It does not apply to data about companies, which is sourced from public registries and is not personal data within the meaning of the DPDP Act.
ipowork collects minimal personal data — only what is necessary to provide our research services and maintain our platform. We collect data in two ways: data you provide to us, and data generated by your use of our platform.
| Category | Data Collected | How Collected | Purpose |
|---|---|---|---|
| Account Data | Name, professional email address, organisation name, designation | Registration form / onboarding | Account creation and access management |
| Usage Data | Pages visited, reports accessed, search queries, session duration, browser type, IP address | Automatically via server logs and cookies | Platform improvement, security monitoring, abuse prevention |
| Communication Data | Email content when you contact us, support requests | Direct communication | Responding to enquiries and providing support |
| Subscription Data | Subscription tier, billing name, payment reference (not card details — payments processed by third-party gateway) | Subscription and billing process | Service delivery and billing |
| Report Delivery Data | Client firm name, logo URL provided by institutional users for co-branded reports | Report admin portal | White-label and co-branded report delivery to end clients |
What we do not collect: ipowork does not collect sensitive personal data such as Aadhaar numbers, PAN, bank account details, biometric data, health information, or political opinions. We do not collect data from minors.
We use personal data only for the following purposes, each supported by a lawful basis under the DPDP Act 2023:
| Purpose | Lawful Basis |
|---|---|
| Providing access to the ipowork platform — account management, login, service delivery | Consent / Contract performance |
| Delivering research reports — generating and delivering AIRA reports to institutional subscribers | Contract performance |
| Platform security and fraud prevention — monitoring for abuse, unauthorised access, data breaches | Legitimate interests |
| Service improvement — analysing usage patterns to improve platform features and research quality | Legitimate interests |
| Communication — responding to support requests, sending service-related notifications | Contract performance / Consent |
| Legal compliance — complying with applicable Indian laws, regulatory requirements, court orders | Legal obligation |
| Marketing — sending product updates or research newsletters (only with explicit opt-in consent) | Consent (opt-in only) |
ipowork's primary research activity involves processing data about companies and corporate entities — not about individual consumers. This includes company financials, legal history, charge registers, GST compliance, and EPFO records sourced from MCA21, Probe42, and other public registries.
ipowork also processes publicly available information about company directors, KMPs, and promoters — including names, DIN numbers, designations, shareholding percentages, and appointment/cessation dates. This information is:
This processing is conducted under the legitimate interests ground of the DPDP Act 2023, as the information relates to individuals in their professional capacity as corporate fiduciaries and is sourced from public disclosures mandated by law.
ipowork does not sell personal data to any third party. We share personal data only in the following limited circumstances:
| Recipient | What is shared | Why |
|---|---|---|
| Supabase (database infrastructure) | Report data, user account data | Platform storage and database operations. Supabase is bound by data processing agreements. |
| Cloudflare (network infrastructure) | Traffic data, IP addresses | Content delivery, security, and DDoS protection. |
| Anthropic (AI processing) | Document content uploaded for analysis | AI-assisted document intelligence. Documents processed via Anthropic's API under their data processing terms. No personal consumer data is sent — only company documents. |
| Probe42 (data provider) | Company CIN / search queries | Structured company data retrieval. Query data is processed under Probe42's terms. |
| Regulatory authorities | As legally required | Compliance with applicable Indian laws, court orders, or regulatory requirements. |
ipowork retains personal data only as long as necessary for the purpose for which it was collected, or as required by applicable law.
| Data Type | Retention Period |
|---|---|
| Account data (name, email, organisation) | Duration of active subscription + 12 months after account closure |
| Research reports and AIRA data | 5 years (for audit and institutional record purposes) |
| Usage logs and access records | 12 months |
| Communication and support records | 3 years |
| Billing records | 7 years (as required by Indian accounting and tax laws) |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. You may request earlier deletion of your personal data — see Section 7 (Your Rights) below.
As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data:
To exercise any of these rights, write to privacy@ipowork.com. We will respond within 30 days. We may need to verify your identity before processing your request.
ipowork implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:
No security system is completely impenetrable. In the unlikely event of a data breach, ipowork will notify affected users promptly and take all reasonable steps to mitigate harm.
ipowork uses only essential cookies necessary for platform functionality — session management, authentication state, and security tokens. We do not use advertising cookies, third-party tracking cookies, or behavioural profiling cookies.
You may disable cookies in your browser settings, but this may affect your ability to use certain features of the platform.
ipowork does not display advertisements and does not allow any advertiser to track your behaviour through our platform.
ipowork may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. Material changes will be notified to registered users by email or by a prominent notice on the platform at least 15 days before the change takes effect.
The date at the top of this page indicates when the policy was last updated. Continued use of ipowork after a policy update constitutes acceptance of the revised policy.
For any questions about this Privacy Policy, to exercise your data rights, or to lodge a grievance, contact our Data Protection Officer. We respond to all requests within 30 days.
privacy@ipowork.com