This Privacy Policy explains how ISHQKALA PRIVATE LIMITED collects, uses, discloses and protects personal information through ishqkala.si, our sales and event activity, and the account administration side of the Ishqkala platform. It also explains why claim data that our customers load into the platform follows a different set of rules: the customer's instructions and contract.
Who we are
ISHQKALA PRIVATE LIMITED (CIN U47711DL2026PTC471065) is a private limited company registered in India with its registered office at 10/135 Geeta Colony, East Delhi, Delhi, 110031, India. In this policy, "Ishqkala", "we" and "us" mean ISHQKALA PRIVATE LIMITED
Questions about this policy or a privacy request can be sent to privacy@ishqkala.si or made by phone at 1800-309-7826.
Two kinds of data, two sets of rules
Business Data is information we decide how to use: details of website visitors, prospects, event attendees, and the names, business emails and roles of people who hold platform accounts. For Business Data, Ishqkala is the controller, or the business under California law, and this policy applies in full.
Customer Claim Data is everything a carrier, TPA or self-insured entity loads into the platform: FNOL records, adjuster diary notes, police and fire reports, repair estimates, photographs, ISO ClaimSearch match reports and bodily injury medical records, along with the personal information of insureds, claimants, drivers, witnesses and adverse parties inside those files. We process Customer Claim Data only on our customer's documented instructions, as a processor and service provider, and as a business associate where HIPAA applies. The customer's own privacy notice governs that data. If your information appears in a claim file, contact the insurer or administrator handling the claim. Any request we receive about Customer Claim Data is forwarded to the responsible customer within five business days.
Business Data we collect
Information you give us: your name, business email, phone number, job title, company and the contents of forms you submit, such as a Free Closed-Claim Audit request (company, lines of business and an approximate claim volume), a demo request, an event registration or a support ticket.
Information collected automatically: IP address, browser and device type, pages viewed, referring page, time on page and an approximate city-level location derived from the IP address. Our Cookie Policy lists each cookie we set and how long it lasts.
Information from others: professional details you have made public, and contact details shared by event organizers or referral partners when you asked them to connect you with us.
Claim identifiers never reach analytics
Website and product analytics record events such as audit_requested, demo_request_submitted and sol_database_queried. No claim file identifier is ever sent to client-side tracking or analytics scripts: no claim numbers, claimant or insured names, policy numbers, VINs, insured details or settlement dollar amounts.
Each analytics event carries only an event name, a page path with query strings removed, a coarse account tier and a random session identifier. Pages in the platform that display claim content load no third-party analytics scripts at all. An allowlist in our event pipeline enforces this, and an automated test blocks any release that sends a field outside the allowlist. Figures typed into the Subrogation Recovery Calculator are computed in your browser; we record only that the calculation was completed.
How we use Business Data
We use Business Data to respond to requests, schedule audits and demos, set up and secure accounts, authenticate users, send service and security notices, provide support, improve the website and meet legal obligations. We send marketing email only to business contacts, and every message carries a one-click unsubscribe link.
We never use Customer Claim Data for marketing, for profiling individuals, or to train any AI model, ours or a third party's.
Where data is stored
Customer Claim Data is stored and processed only in Amazon Web Services US regions, with AWS GovCloud (US) available to customers who elect it. Authorized Ishqkala personnel, including our engineering and support teams in India, reach production systems only through hardened virtual workspaces hosted in the same US region, so claim files are never downloaded to or stored on devices outside the United States.
Business Data is held by our US-based service providers and may be accessed by our team in India to respond to you and support your account.
Retention and security
We keep prospect records for up to three years after our last interaction, support tickets for the life of the account plus two years, and security logs for one year. Customer Claim Data is retained under the customer's contract and deleted within 30 days after the end of the post-termination export window, with encrypted backups aging out within a further 35 days.
Our security program is audited under SOC 2 Type II. Data is encrypted with AES-256 at rest and TLS 1.3 in transit, every account requires multi-factor authentication, and production access is approved per session and logged. Our Security Policy describes these controls in more detail.
Your rights and choices
Depending on where you live, including California under the CCPA as amended by the CPRA, other US states with comprehensive privacy laws, and India under the Digital Personal Data Protection Act, 2023, you may have the right to access, correct or delete your personal information, to obtain a copy, to opt out of targeted advertising, and to appeal a decision on your request. We do not discriminate against anyone for exercising these rights, and we honor Global Privacy Control signals as an opt-out.
Send requests to privacy@ishqkala.si or call 1800-309-7826. We verify your identity before acting and respond within 45 days. An authorized agent may submit a request with your signed permission. Residents of India may also write to our Grievance Officer at privacy@ishqkala.si.
Children and changes
Our services are built for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18.
We will post any change to this policy on this page with a new updated date, and we will email account administrators at least 30 days before a material change takes effect.