INSpal — Privacy Policy
1. Introduction
Yallaa Technologies Private Limited, doing business as Yalla & Co. (“Company”, “we”, “us” or “our”), operates INSpal, a software service designed to help individual insurance agents, brokers and other individual users organise insurance-policy records and related follow-up activities.
This Privacy Policy explains how we collect, use, store, access, disclose, protect and delete personal information when you register for or use INSpal.
Please read this Policy together with the INSpal Terms & Conditions. By using the Service, you acknowledge that you have read this Policy. Where applicable law requires consent or another legal basis for processing, we will rely on the appropriate basis and obtain consent where required.
2. Whose Information May Be Processed
INSpal may process information relating to:
- Account users: people who register for and use INSpal.
- Policyholders and other individuals: people whose personal information appears in insurance-policy records or documents uploaded by an account user.
- Payment participants: individuals whose payment or transaction details are processed in connection with a subscription.
- People who contact us: individuals who communicate with our support or privacy
contact.
If you upload information about another person, you are responsible for ensuring that you have the necessary authority or lawful basis to provide that information to INSpal and use the Service for that purpose.
3. Information We Collect or Process
The information we process depends on how you use the Service.
A. Account information
This may include:
- Full name supplied during registration.
- Email address.
- Email OTP verification and related account-authentication information.
- Account status and subscription status.
- Information you send to our support team.
Your full name and email address are associated with your account. They cannot currently be edited directly through the account interface. You may contact support if a correction is needed.
Email OTP verification confirms access to the email address used for registration. It does not independently establish a person’s legal identity or professional credentials.
B. Insurance-policy information
Depending on what you enter or upload, this may include policy details, renewal dates, insurer information, policy identifiers, premium details, policyholder information and other information contained in policy records.
The precise information depends on the fields you choose to complete and the documents you upload.
C. Uploaded policy PDF files
You may upload policy PDF documents for storage and access through INSpal. These documents may contain personal information about policyholders or other individuals.
The special encryption protection for these files is described in Section 6.
D. Payment and subscription information
We may maintain records such as payment status, transaction references, subscription dates, amounts paid and related billing information.
Payments are processed through Razorpay or another payment provider made available by us.
The provider may independently collect and process payment information under its own terms and privacy policy. We do not claim that we store complete card details or other payment credentials ourselves.
E. Technical and support information
Information may be generated or provided when you use the Service or contact us, including information needed to investigate technical errors, troubleshoot account problems, protect the Platform or respond to a complaint.
The precise technical logs and diagnostic data collected may change as the Service develops.
We will handle personal information in accordance with applicable law.
4. How We Use Information
We may use information for the following purposes:
- Creating and administering accounts.
- Verifying access to registered email addresses.
- Providing policy-record management, document access, renewal tracking, dashboards and reporting features.
- Managing subscriptions, payments and payment-related support.
- Responding to user enquiries, correction requests, deletion requests and grievances.
- Maintaining, troubleshooting and improving the Service.
- Protecting the security and integrity of the Platform.
- Detecting or investigating suspected fraud, abuse or unauthorised activity.
- Complying with applicable legal obligations and responding to lawful requests.
- Establishing, exercising or defending legal claims where necessary.
We will not treat a user’s information as unrestricted material for unrelated purposes. Where applicable law requires consent or another legal basis, we will process information on the appropriate basis.
5. Access to Information by the Company
INSpal is designed to restrict server/backend staff from reading the contents of protected uploaded policy PDFs. However, not all information stored in an INSpal account is encrypted in the same way.
Authorised Company personnel may access non-encrypted account information and policy fields where reasonably necessary for:
- Providing support requested by a user.
- Operating and maintaining the Service.
- Troubleshooting technical problems.
- Investigating security incidents or suspected misuse.
- Meeting applicable legal obligations.
- Establishing, exercising or defending legal claims.
Access should be limited to the information reasonably needed for the relevant purpose.
We do not represent that all Company personnel have access to all account information, nor do we claim that every non-encrypted record is inaccessible to the Company.
6. Encryption of Uploaded Policy PDFs
Uploaded policy PDF files are protected using an encryption arrangement under which the decryption key is not transmitted to or stored in a form accessible to the Company’s server/backend staff.
Under the current design, server/backend staff cannot decrypt or read the contents of these protected PDF files through the server/backend systems.
This protection applies specifically to the uploaded policy PDF files. It does not automatically extend to:
- Account registration details.
- Email addresses and account status.
- Policy fields entered separately into the application.
- Subscription and transaction records.
- Support communications or other information processed outside the protected PDF files.
Users should keep their account access secure and retain independent copies of important documents. If a protected file is lost, corrupted or becomes inaccessible, we may not be able to recover its contents.
7. Hosting, Storage and Location
INSpal currently uses a rented cloud/VPS server located in Mumbai, India, for its database and uses HTTPS for connections to the Service.
Information is retained for as long as reasonably necessary to provide the Service, maintain accounts, handle subscriptions, meet legal obligations, resolve disputes, protect against fraud or abuse, and fulfil other legitimate purposes consistent with applicable law.
The Service’s infrastructure and operational practices may change as the product develops. If a material change affects how personal information is processed, we will update this Policy and provide notice or obtain consent where required by law.
8. Security Measures and Current Limitations
We use HTTPS for connections to the Service and apply encryption protection to uploaded policy PDF files as described in Section 6.
No online service can guarantee absolute security. Users should protect their devices, email accounts and login credentials and should notify us if they suspect unauthorised access.
Current backup limitation: INSpal does not presently maintain a separate database backup system. As a result, data may be lost or become unrecoverable because of server failure, corruption, accidental deletion, a security incident or another unexpected event.
We do not promise a particular backup frequency, recovery time or recovery point. Security, infrastructure and backup practices may evolve as the Service scales.
You should not rely on INSpal as your only copy of important insurance records or policy documents.
9. Sharing and Disclosure
We do not sell users’ personal information as a product.
We may disclose or make information available in the following circumstances, where appropriate and lawful:
A. Service providers
We may use providers for hosting, infrastructure, payment processing, communications, technical support or other services needed to operate INSpal. These providers may process information to perform their services, subject to applicable arrangements and law.
B. Legal obligations and protection
We may disclose information where reasonably necessary to comply with applicable law, a valid legal process or lawful governmental request, or to establish, exercise or defend legal claims, investigate suspected fraud, or protect the rights, safety and security of users, the Company or others.
C. Business changes
If the Company undergoes a merger, restructuring, acquisition, sale of assets or similar transaction, information may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.
D. With your direction or consent
We may share information when you direct us to do so or when you have provided valid consent, where required.
We aim to limit disclosures to information reasonably necessary for the relevant purpose.
10. Payment Processing
Subscription payments are currently made manually through the integrated Razorpay payment gateway.
Razorpay may process payment and transaction information under its own terms, privacy policy and security practices. We may receive information needed to confirm a payment, associate it with an account, update subscription status and respond to payment issues.
Under the current arrangement, INSpal does not automatically renew or automatically charge the monthly subscription. Users must manually renew their subscription.
For payment-specific data-handling questions, users may also need to consult the payment provider’s privacy documentation.
11. Retention of Information
We retain personal information for as long as reasonably necessary for the purposes described in this Policy, subject to applicable law.
Retention periods may depend on the type of information and why it is held. For example:
- Account and policy information may be retained while the account remains active and the Service is being provided.
- Subscription and transaction information may need to be retained for accounting, legal, dispute-resolution or fraud-prevention purposes.
- Support and grievance information may be retained as needed to respond to requests, document their resolution or meet legal obligations.
- Information may be retained for longer where required or permitted by law.
We have not established a single fixed retention period that applies to every category of information. We will retain information only for as long as reasonably necessary for the applicable purpose and lawful retention basis, and delete it when no longer needed, subject to lawful exceptions.
12. Subscription Suspension and Inactive Accounts
If a subscription payment becomes overdue, access to paid subscription features may be suspended until payment is received and the subscription is reactivated.
Suspension alone does not automatically delete your account or stored data. Information may remain stored during suspension, subject to the retention practices and legal obligations described in this Policy.
If you no longer need your account, you may request permanent account closure and deletion as described below.
13. Account Closure and Deletion Requests
You may request permanent account closure or deletion by emailing support@yallatechs.in from your registered email address where possible.
We may ask for reasonable information to verify the request and protect against unauthorised deletion.
Once a request is verified, we will delete the encrypted policy PDF files and the associated live database records and file references relating to the account, subject to applicable law.
Some information may be retained where there is a lawful and legitimate reason, including:
- Compliance with legal or regulatory obligations.
- Accounting and transaction records.
- Resolving disputes or handling claims.
- Detecting or preventing fraud and abuse.
- Establishing, exercising or defending legal claims.
Any retained information will be limited to what is reasonably necessary for the relevant purpose and handled in accordance with applicable law. It will be deleted when the retention purpose no longer applies, unless another lawful basis for retention exists.
Deletion from live systems may not mean immediate erasure of every technical log or residual copy, where such records exist. Any such information will be handled according to applicable retention and security practices and applicable law.
Because INSpal does not currently maintain a separate database backup system, and because the decryption key for protected PDFs is not accessible to server/backend staff, recovery after deletion, loss or corruption may not be possible.
Please retain any information you need before requesting permanent deletion.
14. Correction and Other Privacy Requests
If you believe your account information is inaccurate, you may request correction by contacting support@yallatechs.in.
As the account interface currently does not allow users to edit their registered full name or email address, correction requests must be handled through support.
You may also contact us with questions or requests concerning your personal information. We will review and respond in accordance with applicable law, the nature of the request and any applicable response timelines.
Where a request cannot be fully fulfilled, we will explain the reason to the extent required or permitted by law.
15. Information About Other Individuals
If you are an INSpal user who enters or uploads policyholder information, you must ensure that you have the appropriate authority or lawful basis to do so.
You are responsible for complying with the legal obligations that apply to your collection and use of that information, including any duties to inform individuals or obtain consent where required.
If you are a policyholder whose information has been entered or uploaded by an INSpal user and have a privacy concern, you may contact us at support@yallatechs.in. We may need to verify your request and assess the role of the account user before taking action, subject to applicable law.
16. Children’s Information
INSpal is intended for individual insurance professionals and other users who are legally able to register for and use the Service. It is not designed as a service for children.
If you believe that a child’s personal information has been provided to INSpal in circumstances that violate applicable law, contact support@yallatechs.in so we can review the matter and take appropriate action.
17. International Access
INSpal’s database is currently hosted on a server located in Mumbai, India. If the Service is accessed from outside India, information may be provided to the Service from that location.
Any transfer or processing of personal information across borders will be handled in accordance with applicable law. We do not promise that every third-party provider used by the Service will necessarily process all information exclusively within India.
18. Privacy Questions and Grievance Redressal
Users and other individuals may contact Yalla & Co. regarding privacy concerns, requests for correction or deletion, or complaints relating to the handling of personal information.
Privacy and grievance contact Yallaa Technologies Private Limited
Doing business as Yalla & Co.
Email: support@yallatechs.in We will review and respond to complaints and requests in accordance with applicable law and any applicable response timelines.
Where applicable law requires a designated Grievance Officer or other responsible person, the Company will designate that person and publish the required details before the relevant obligation applies.
19. Changes to This Privacy Policy
We may update this Policy to reflect changes to INSpal, our data-handling practices, our service providers or applicable law.
The revised Policy will be published with an updated effective date. Where required by law, we will provide notice of material changes or obtain consent before applying the changes.
We encourage users to review this Policy periodically.
20. Contact Us
For questions about this Privacy Policy, personal information, correction requests, account deletion or privacy grievances, contact: Yallaa Technologies Private Limited
Doing business as Yalla & Co.
Email: support@yallatechs.in
Service: INSpal
Website: https://inspal.yallatechs.in/login