1. Who we are, and the law we follow

iScoreIt is operated by ISCOREIT (OPC) PRIVATE LIMITED (“iScoreIt”, “we”, “us”). We provide identity verification, risk scoring and fraud intelligence services to businesses such as banks, NBFCs, fintechs and marketplaces. Most of the personal data we handle is about people who never deal with us directly: the customers, applicants and counterparties our clients verify.

We follow the Information Technology Act, 2000 (section 43A) and the SPDI Rules, 2011; the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, whose core duties apply from 13 May 2027 and which we already follow; the Aadhaar Act, 2016 and UIDAI regulations; and the CERT-In directions of 28 April 2022. Where these and our own commitments differ, the stricter rule applies.

2. Our two roles

Our duties depend on whose purpose the data serves.

Personal data	Whose it is	Our role
Verification requests and results	Individuals our clients verify	Data Processor for the client
Client onboarding (KYB) documents	Clients’ directors and signatories	Data Fiduciary
Dashboard user accounts	Client users and iScoreIt staff	Data Fiduciary
Website enquiries and marketing contacts	Prospects and visitors	Data Fiduciary
Job candidates, vendor and partner contacts	Applicants, suppliers’ staff	Data Fiduciary

When we act as a Data Processor, the client decides why and how the data is processed and answers to you; we act only on its instructions, under our Data processing agreement. If you were verified by one of our clients, please contact that business first. When we act as a Data Fiduciary, this policy applies to us directly.

3. How we use personal data

• For clients: only to carry out the checks a client requests, return the results, bill for them, provide support and keep the service secure.
• For ourselves: to answer enquiries and arrange demos, run client accounts and the dashboard, recruit, manage vendors, and meet legal, tax and audit obligations.

We collect, return and keep only the minimum the purpose requires, and we never invent a field a source didn’t supply. We never sell verification data, use it for our own purposes, build our own database or profiles from it, or combine one client’s data with another’s.

4. Notice, consent and marketing

• Where we are the Data Fiduciary, we rely on consent that is free, specific, informed and given by a clear action — and withdrawing it is as easy as giving it — or on a legitimate use the DPDP Act allows.
• Our notices are in plain English. On request, we provide them in any language listed in the Eighth Schedule to the Constitution.
• We send marketing only to people who have agreed to receive it, and act on an unsubscribe request within 10 working days.
• We don’t knowingly collect children’s data for our own purposes. Where a client service could involve a child, the client must first obtain verifiable consent from a parent or guardian.
• For checks we run for clients, the client must give the individual valid notice and obtain consent, or have another legal basis, before each request.

5. Aadhaar and identity data

• We use Aadhaar data only for the verification the individual consented to, and obtain it only through DigiLocker and authorised providers.
• We never store full Aadhaar numbers or biometric data. Numbers are masked to the last four digits before anything is written.
• Aadhaar request and response payloads are deleted within 2 days, and uploaded images as soon as the call ends.
• Other identifiers, including PAN, bank account and mobile numbers, are masked in logs and internal screens.

6. Sharing and where data is kept

• We share personal data only with the client that requested a check (its results); our sub-processors and vendors, under written agreements; professional advisers bound by confidentiality; and authorities where the law requires.
• Requests from police, regulators or courts are checked for their legal basis, answered with only what is required, and recorded.
• All production personal data — servers, databases, backups and logs — is stored and processed in India. Any transfer outside India is assessed first, and we never transfer to a country the government has restricted under the DPDP Act.

7. How long we keep it

Every record has an end date. Periods tied to a law are the minimum that law sets; where a client’s agreement sets a different period for its data, the agreement applies.

Record	Kept for
Full Aadhaar numbers, biometric data	Never stored
Verification payloads (masked), Aadhaar services	2 days, then purged nightly
Verification payloads (masked), all other services	7 days, then purged nightly
Files uploaded for a verification	Until the call ends
API call records without payloads	8 years (billing, tax and audit)
Invoices and accounting records	8 years from the end of the financial year
Server, application, access and security logs	1 year
Database backups	30 days
Client onboarding (KYB) documents	The relationship, plus 3 years
Dashboard user accounts	While active; erased within 90 days of closure
Support tickets	3 years after closure
Website enquiries and marketing contacts	2 years after last contact, or until consent is withdrawn
Unsuccessful job candidates	6 months, or longer with consent

Deletion is automated and logged. Data deleted from live systems leaves our backups within 30 days. Data that has been genuinely anonymised, so no one can be identified from it, may be kept for statistics and service improvement.

8. Security

• TLS 1.2 or later on every public endpoint; databases and backups encrypted at rest with AES-256 or equivalent.
• Access limited to people who need it, with multi-factor authentication on every account that supports it.
• Logs of who accessed what, monitored and kept for one year.
• An independent vulnerability assessment and penetration test at least once a year. We are working towards ISO/IEC 27001 certification.

9. Personal data breaches

• Where we process data for a client, we notify that client without undue delay, within the time its agreement sets, with what it needs to meet its own duties.
• Breaches of a type CERT-In lists are reported to CERT-In within 6 hours of being noticed.
• Where we are the Data Fiduciary, from 13 May 2027 we notify the Data Protection Board and each affected individual without delay, and send the Board a detailed report within 72 hours.

10. Your rights

Requests are free. We confirm your identity using details we already hold, and ask only for what we need to find your data. We acknowledge a request within 2 working days and respond in full within 30 days.

Right	What it means
Access	A summary of the personal data we hold, how we process it, and who we share it with.
Correction	Fixing data that is inaccurate, incomplete, misleading or out of date — and passing the fix on to anyone we shared it with.
Erasure	Deleting data no longer needed, or after consent is withdrawn. Where the law requires us to keep something, we tell you what and why.
Withdrawing consent	Processing that relies on consent stops promptly. Earlier lawful processing is not affected.
Nomination	Naming someone to exercise these rights after your death or incapacity.
Grievance	Complaining about how we handled your data — resolved within 30 days.

If your data came to us through one of our clients, we pass your request to that client within 2 working days and help it respond.

11. Grievance Officer

To exercise your rights or raise a complaint, write to our Grievance Officer:
ISCOREIT (OPC) PRIVATE LIMITED
support@iscoreit.com

From 13 May 2027, if you are not satisfied with our response, you may complain to the Data Protection Board of India.

12. Changes

We review this policy at least once a year and whenever the law changes. Updates are posted on this page with a new date at the top.

1. Parties and roles

The client is the Data Fiduciary: it decides why and how personal data is processed, and answers to the individual. ISCOREIT (OPC) PRIVATE LIMITED is the Data Processor and acts only on the client’s documented instructions. The upstream verification providers we use act as our sub-processors.

2. Scope of processing

Item	Details
Purpose	Carrying out the checks the client requests, returning the results, billing for them, providing support and keeping the service secure.
Data principals	The customers, applicants and counterparties the client verifies.
Categories of data	Identity numbers, names, mobile numbers, bank account details, vehicle and licence details, face images, and AML and PEP results.
Location	India, for all production data.
Duration	The term of the client agreement, and the retention periods in section 7.

3. Our commitments

• We process personal data only for the purposes above, on the client’s instructions.
• We never sell verification data, use it for our own purposes, build our own database or profiles from it, or combine one client’s data with another’s.
• We protect it with TLS 1.2 or later in transit, AES-256 or equivalent encryption at rest, need-to-know access with multi-factor authentication, access logs kept for one year, and an independent penetration test at least once a year.
• We never store full Aadhaar numbers or biometric data, and mask Aadhaar to the last four digits before anything is written. PAN, bank account and mobile numbers are masked in logs and internal screens.
• We forward any request from an individual about the client’s data to the client within 2 working days, and help the client respond.
• Everyone who handles client data is bound by confidentiality and trained in data protection when they join and every year.

4. What we require of clients

• A lawful purpose for every check — such as customer onboarding, fraud prevention, credit assessment or employment verification.
• Valid notice to, and consent from, the individual, or another legal basis, before each request. The client keeps these records and provides them to us on request.
• Verifiable consent from a parent or guardian before any check that could involve a child.
• Reverse lookups, such as finding a name or address from a mobile number, only with a documented lawful purpose and the individual’s consent.
• No use of results to harass, stalk, intimidate or unlawfully discriminate against anyone, and no resale of data.

We may suspend a client’s access if we believe a service is being misused.

5. Sub-processors

We use only approved sub-processors, each bound by written obligations at least as strict as ours. Every new verification service and upstream provider passes a privacy and legal review before it goes live, including written confirmation of its data source, licence where one is required, and how consent is obtained. Clients can ask for the current list.

6. Data location and transfers

All production personal data is stored and processed in India. Any transfer outside India is assessed first and recorded. We never transfer to a country the government has restricted under the DPDP Act, and we follow any stricter limit in the client’s agreement.

7. Retention and deletion

Record	Kept for
Masked payloads, Aadhaar services	2 days
Masked payloads, other services	7 days
Uploaded files, such as document images	Until the call ends
API call records without payloads	8 years, for billing, tax and audit
Logs	1 year
Database backups	30 days

Automated purges run every night and log what they delete. Where the client’s agreement sets a different period, the agreement applies. We delete client data earlier when the client asks or the agreement ends, unless the law requires us to keep it.

8. Breach notification

We notify the client of any personal data breach affecting its data without undue delay, and within the time its agreement sets, with the facts it needs to meet its own duties — including to the Data Protection Board and affected individuals. Breaches of a type CERT-In lists are reported to CERT-In within 6 hours of being noticed. Every breach is recorded with its facts, effects and the action taken.

9. Audits

We allow audits as the client’s agreement provides, and make available the records that show we meet these terms. Regulated clients such as banks and NBFCs may pass down their own sector requirements.

10. Requesting a signed copy

For the full DPA, signed, write to support@iscoreit.com.

1. The short version

This website does not set advertising or analytics cookies, and it does not track you across other sites. That is why you do not see a cookie banner here.

2. What cookies are

Cookies are small text files a website stores in your browser. Similar technologies, such as local storage, work in much the same way. We refer to all of them as “cookies” in this policy.

3. What we use

Type	Purpose	Used here
Strictly necessary	Keep the iScoreIt console signed in and secure, and protect against abuse.	Console only
Analytics	Measure how visitors use the site.	No
Advertising	Build profiles or show ads on other sites.	No

4. Third-party services

To load quickly, this site fetches fonts from Google Fonts and scripts from the Cloudflare CDN. Those providers receive your IP address and browser details when the files are requested, under their own privacy policies; they do not set cookies through this site. If you choose to book a demo, you are taken to Calendly, which applies its own cookie policy.

5. Managing cookies

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop you from signing in to the console, but it will not affect browsing this website.

6. Changes and contact

If we ever add non-essential cookies, we will update this policy and ask for your consent first. This website is operated by ISCOREIT (OPC) PRIVATE LIMITED. Questions? Write to support@iscoreit.com. See also our Privacy policy.