Draft for legal review. This page describes how Inkwis works today; it will be finalized by counsel before paid plans open.
This policy explains what personal data Inkwis collects when you use inkwis.com and app.inkwis.com (the “Service”), why we collect it, and the choices and rights you have. Inkwis is operated by Brouz Hyperlocal Services Private Limited (“we”, “us”), 6/31, 2nd Main Road, Murugan Nagar, Chennai 600099, Tamil Nadu, India.
1. Who is responsible for your data
For individual accounts, we are the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act): we decide why and how your data is processed.
When a school, institute or organization uses Inkwis under a data processing agreement, that organization is the data fiduciary for the data of its teachers and students, and we process it on its instructions as a data processor. Questions about that data are best sent to the organization first; we will help it answer.
2. What we collect
Account holders (presenters and board members)
- Account data: name, email address, password (stored only as a salted hash), and, if you choose, your Google or GitHub sign-in identifier and a two-factor secret.
- Settings: time zone, notification choices and tool preferences.
- Content you create: boards, pages, drawings, text, sticky notes, images and PDFs you upload, private notes, templates, board chat.
- Session and recording data: when you run a live session or record, the changes made to the board, your audio, the transcript produced from it, session chat, polls, questions, suggestions and reactions.
- AI requests: the questions you ask and the answers produced.
- Billing data: your plan, payment status and, if you provide it, your GSTIN. Card and UPI details are entered with Razorpay and never reach us.
- Security and usage data: sign-in events, the devices signed in to your account, IP address (for rate limiting and abuse prevention), and usage counters such as AI requests per day.
Guests in a live session (for example, students)
Guests join with a code or link and a display name of their choice. We do not ask guests for an email address or create an account for them. A guest’s display name is shown to others in the session and stays attached to their chat messages, poll answers and questions in the replay. Only the presenter’s microphone is used in a session; participants’ voices are not recorded.
Website visitors
The marketing site sets no cookies and runs no advertising or tracking scripts. Our hosting provider records standard request logs (IP address, page, time) for security, and we count visits with cookieless, aggregate analytics. If you use the contact form, we keep what you send (topic, name, email, organisation and message) to reply to you.
3. Why we use it
- To provide the Service: store and sync your boards, run live sessions, record and replay them, transcribe audio and answer AI requests you make.
- To keep accounts and the Service secure: verify email addresses, detect abuse, rate-limit, and notify you of security changes to your account.
- To bill you for paid plans and meet tax and accounting obligations.
- To send service emails: verification, password resets, security notices, sharing invitations and notices that a recording is about to expire. You can turn off non-essential notices in your account settings.
- To understand, in aggregate, whether the product is working (for example, how many sessions ran this week). We do not build individual behavioural profiles.
We process personal data on the basis of your consent given when you create an account or join a session, and for legitimate uses permitted by the DPDP Act, such as complying with law. You can withdraw consent at any time by deleting your account; this does not affect processing already carried out.
We do not sell personal data, use it for advertising, or allow our AI provider to train models on your content.
4. Children and students
Inkwis accounts are for adults (18 or over) and organizations. Students under 18 take part only as guests in sessions run by their teacher or institution, without an account. Where a school uses Inkwis, the school is responsible for obtaining any consent required from parents or guardians under the DPDP Act; we process students’ data only to deliver the session and its replay, never for tracking, profiling or targeted advertising.
5. Where your data is stored
Our database is located in India (Mumbai). Board files, uploads and recordings are kept in Cloudflare’s object storage in the Asia-Pacific region. Some service providers process data outside India to deliver specific features, as listed on our subprocessors page (for example, audio transcription and AI answers). Transfers follow the DPDP Act and any restrictions notified by the Government of India.
6. Who we share it with
- People you share with: board members, session participants and anyone you give a share link see the content you share with them. Private Layer content is never shared with anyone but the board owner.
- Service providers who process data on our behalf under contract, listed on our subprocessors page.
- Authorities, when the law requires it and only to the extent required.
7. How long we keep it
| Data | Kept for |
|---|---|
| Boards, uploads, board chat, AI material on the board | As long as the board exists. Deleted boards stay in the trash for 30 days, then are purged. |
| Replay (canvas, transcript, session chat, polls) | 45 days on Free, 6 months on Plus, 3 years on Pro, unless you delete it sooner. |
| Replay audio | 30 days on Free, 90 days on Plus, 1 year on Pro. We email you a week before it is removed. |
| AI questions and answers (request logs) | 30 days. Not kept for school workspaces. |
| Usage counters | 13 months. |
| Contact form messages | 12 months. |
| Security audit log | 1 year. |
| Operational logs | 30 days, without personal content. |
| Your account | Until you delete it; then a 30-day grace period in which you can change your mind, then purged. |
| Backups | Deletions reach our backups within 14 days. |
| Billing records | As long as tax law requires. |
8. Your rights
Under the DPDP Act you have the right to:
- obtain a summary of the personal data we hold about you and how we process it;
- have inaccurate data corrected and incomplete data completed;
- have your data erased (you can delete your account yourself in account settings);
- nominate another person to exercise your rights in case of death or incapacity;
- have your grievances addressed, and, if you are not satisfied, complain to the Data Protection Board of India.
Most of this you can do yourself in the app. Otherwise write to privacy@inkwis.com; we reply within 30 days. Grievances go to our Grievance Officer.
9. Security
We protect data with encryption in transit and at rest, permission checks on every request backed by database row-level security, strict separation of private content, and regular security testing. If a personal data breach affects you, we will notify you and the Data Protection Board as the DPDP Act requires. More on our security page.
10. Cookies
The app uses only the cookies needed to keep you signed in. See our cookie notice.
11. Changes
If we change this policy in a way that matters, we will tell account holders by email or in the app before the change takes effect. The date at the top shows the latest revision.
12. Contact
Privacy questions: privacy@inkwis.com. Grievance Officer: Ashik Basheer, grievance@inkwis.com.