Global Privacy Policy

1. Introduction

Enso Webworks Private Limited (“Enso Webworks”, “Enso”, “Company”, “we”, “us” or “our”) offers comprehensive suite of digital platforms and services that help our users explore new avenues, enhance productivity, communication and their true potential. Our offerings include:

InfoQueries – InfoQueries provides real-time assistance powered by cutting-edge AI, delivering accurate information and support whenever you need it.

InfoPhone – InfoPhone offers a secure environment for private conversations, prioritizing your privacy with advanced encryption and user-friendly interfaces.

InfoMemo – InfoMemo will provide verified email IDs to ensure communication is authenticated and trustworthy. It’s being designed to enhance the credibility of digital interactions, helping professionals and organizations maintain secure communication channels while preventing fraud or impersonation.

InfoProfile – InfoProfile is designed to streamline your digital networking with intelligent features that enhance connectivity and collaboration, ensuring seamless communication across platforms.

InfoCalling – InfoCalling is a professional communication platform for lawyers, doctors, designed to manage both online and offline appointments efficiently. It helps schedule, track, and follow up with clients or patients while keeping all communication secure.

InfoConverse – InfoConverse will be a video communication tool offering group calls and virtual meetings. Designed for teams and professional interactions, it will support face-to-face communication in remote or hybrid work setups.

InfoDatabox – InfoDatabox is a cloud-based storage platform for professionals and organizations needing secure, scalable data management. It will offer encrypted storage, easy access, and organized file-sharing options, making it suitable for teams managing sensitive information or large volumes of data.

InfoContract – InfoContract will enable users to manage, sign, and track documents digitally. With features like e-signatures and secure document sharing, it will streamline contract workflows for businesses and professionals, ensuring legal compliance and efficiency.

InfoUniverse – InfoUniverse will offer Single Sign-On (SSO) services, allowing users to access multiple applications with a single, secure login. It aims to simplify authentication workflows while enhancing security and user convenience across platforms.

InfoTelecast – InfoTelecast is envisioned as a platform for broadcasting and podcasting content in a one-way format, similar to webinars. It will support live presentations, training sessions, podcasts, and events where interaction is minimal but audience reach is essential.

InfoTodo – InfoTodo is planned as a task and notepad-like tool to help individuals and teams document their schedules, notes, and action items. It will focus on simplicity and ease of use, offering structured note-taking and task management to keep work organized and actionable.

InfoLegacy – InfoLegacy is designed to help users preserve and manage important digital information, ensuring that meaningful memories, documents, and personal data can be securely maintained and accessed when needed.

You may choose to create a single account to access and manage personalized features as per your needs like saving documents on InfoMemo, hosting meetings on InfoConverse, or managing your professional profile on InfoProfile. However, several of our services and platforms can be used without signing in, such as browsing InfoQueries or viewing public live sessions on InfoTelecast. Further, you can use private or incognito browsing modes to keep your activity private.

You may use our services and platforms as per your convenience and requirements while having the full control over your personal data and maintaining your privacy.

Your privacy is of utmost importance and we are committed to protect it while safeguarding your personal data.

When you interact with any of our platforms (collectively referred to as “InfoSuite platforms”), you share some information directly and we collect some of it by collecting data about your usage, time spent, interactions with our products to enhance your experiences. InfoPhone is an exception to this: it contains no analytics, crash-reporting, attribution or advertising software and collects only the data described in Section 12A.

2. Applicability

This Privacy Policy uniformly applies to all our platforms (except InfoCalling) and to all users, however where local legal requirements differ, we have provided jurisdiction-specific information through Annexures attached to this policy at the end. We understand that you trust us with your information when you use any of our platforms. This policy explains that:

Personal data we collect;

Source of personal data;

Need to collect data;

How we use this data;

Where and when do we share the data

How you can manage your data

The choices and rights that you have, to manage and delete your information; and

Safety measures undertaken to safely handle your data;

How to Contact us.

However, this Privacy Policy does not apply to third-party platforms, applications, websites, products, or services that may be linked to or integrated with our platforms. We encourage you to review the privacy policies of such third parties before sharing any personal data with them.

3. Personal data we collect

Enso collects data when you access InfoSuite platforms, for a variety of purposes described in forthcoming paragraphs including to operate effectively and provide you with the best experiences with our products.

Types of personal data we collect and process

The data we collect and process depends on your interactions with Enso, InfoSuite platforms and features you use, your privacy settings, location, and applicable laws.

This may include:

Contact details: such as name, email address, phone number.

Credentials: including passwords, authentication information, security hints /information used for authentication, account access and retrieving the account.

Demographic information: such as age, gender, country, and language preference.

Payment details: including account details, payment instrument numbers, CVV and related security codes.

Subscription data: including your licenses, and entitlements.

Interaction data: information about how you use InfoSuite platforms, including data you provide, your searches (e.g., search queries on InfoQueries), your likes, clicks etc. The interaction data may include the personal data you provide in order to make use of the platforms. Device and usage data: Data about your device, type of product, and the features you use, including information about your hardware and software, how our products perform, as well as your settings. For example:

Account history: Data about past and present activities associated with your account like username, email id, phone numbers etc.

Browse history: Data about the webpages you visit from your browser(s).

Device, connectivity, and configuration data: Your device configuration, the operating systems and other software installed on your device, including product keys. In addition, IP address, device identifiers, regional and language settings, and information about WLAN access points near your device.

Device and performance data: Data about the performance of the InfoSuite platforms and any problems you experience, including error reports, configuration and connectivity.

Troubleshooting and help data: Data you provide when you contact Enso for help, such as the InfoSuite platforms you use, and other details that help us provide support. For example, when you contact us, for customer support, phone or chat support sessions with our representatives may be monitored and recorded.

Interests and favourites: Data about your interests and favourites, such as the sports teams you follow, the programming languages you prefer, the stocks you track, or cities you add to track things like weather or traffic. In addition to those you explicitly provide, your interests and favourites can also be inferred or derived from other data we collect, such as your interactions on websites where any of our platforms are used to deliver the results. In InfoLegacy, some profile fields and narrative sections are inferred or generated by an artificial-intelligence model from publicly available information; such content is marked by source and must be reviewed and accepted by you before it is stored (see Section 12B).

Searches and commands: Search queries and commands when you use Enso platforms such as InfoQueries with search or related productivity functionality.

Voice data: Your voice data such as search queries, commands, or dictation you speak, which may include background sounds.

Images: Images and related information, such as picture metadata.

Contacts and relationships: Data about your contacts and relationships if you use a platform such as InfoProfile to share information with others, manage contacts, communicate with others, or improve your productivity. If you use InfoPhone on a mobile device and grant the contacts permission, the phone numbers (only) from your address book are uploaded to check which of your contacts use InfoPhone, as described in Section 12A.

Nominee data: if you use InfoLegacy, the name, email address and relationship to you of each person you nominate to access your vault, together with the permissions you grant them and their access requests.

Social data: Information about your relationships and interactions between you, other people, and organizations, such as types of engagement (e.g., likes, dislikes, events, etc.) related to people and organizations.

Location data: Data about your device’s location, which can be either precise or imprecise. For example, when you make a search to find nearby doctors, hotels restaurants around you or showing the road maps or places, you bookmark like home or work or wi-fi hotspots near you, cell towers or Bluetooth-enabled devices you are connecting with at different locations.

Biometric data and identifiers: Data about you resulting from specific technical processing relating to your physical, physiological, or behavioural characteristics which allow or confirm unique identification. Our collection and use of biometric data depend on the products and features you use in certain InfoSuite Platforms, as well as your consent.

Document Content: Content of your files when you upload, receive, create or share. For example, if you transmit a file using InfoDatabox to another InfoDatabox user, we need to collect the content of that file to display it to you and the other user. Other content we collect when providing products to you include:

Communications, including audio, video, text (typed, dictated, or otherwise), in a message, email, call, meeting request, or chat. On InfoPhone, this content is end-to-end encrypted before it leaves your device; Enso’s servers only store and relay encrypted data (ciphertext) that Enso cannot read.

Photos, images, songs, movies, software, and other media or documents you store, retrieve, or otherwise process with our cloud.

Feedback and ratings: Information you provide to us and the content of messages you send to us, such as feedback, survey data, and product reviews you write.

Traffic data: Data generated through your use of InfoSuite Platforms. Traffic data indicates with whom you have communicated and when your communications occurred. We will process your traffic data only as required to provide, maintain, and improve our communications services and we do so with your permission or based on legitimate interest. On InfoPhone, traffic data (also called communication metadata) is the information that end-to-end encryption does not protect and that remains visible to Enso – see Section 12A.2.

You control your personal data

You have full control over the personal data. You may choose not to provide your personal data; however, certain products or features may not be accessible if you decline to provide required data. When providing data is optional, certain personalized or enhanced features may not be available.

Similarly, if your personal data is necessary for legal, contractual, or operational reasons and you chose not to share it with us, we may be unable to provide you with full services or rich user experience or enter into or continue the contract, and we will inform you accordingly.

We may process personal data based on legal grounds depending upon your jurisdiction, including consent, legitimate interests, contractual necessity, and compliance with legal obligations.

4. Sources of personal data

Personal data collected directly: You provide some of this data directly, such as when you create an account on our platform on InfoProfile, submit a search query to InfoQueries, schedule a meeting on InfoConverse, upload a document on InfoDatabox, communicate via InfoPhone, or contact us for support.

We get some of it by collecting data about your interactions, use, and experience with our products and communications, Enso affiliates and subsidiaries.

Personal data collected through other sources: We also receive data from third parties and protect it in accordance with this Privacy Policy, applicable laws and any permissions or preferences you have opted. Such sources may include:

Data brokers;

Demographic data providers;

Information shared by you on social/public platforms and user-generated content (e.g., reviews, social media);

Communication and location service providers;

Co-branding, marketing, and development partners; and

We may also collect information about you from publicly available sources like land records or exam results or if your name or business details appear in public records or online publications, our InfoQueries search engine may index that information and make it accessible to others through search results. When you use InfoLegacy’s “Search by name” feature, we gather publicly available information about the named person from professional-networking profiles, online encyclopaedias and social-media profiles, as described in Section 12B.

5. How we use personal data

Enso uses the data to provide you an immersive experience. In particular, we use the data to:

operate our platforms, which include updating, securing, as well as providing support. This also includes storing and sharing your personal data when it is needed to carry out or execute the services you request.

Improve, personalize, optimize the user experience, and develop our products.

Communicate with you to improve campaign relevance and assess the effectiveness of marketing and referral programs.

We may use your personal data to provide and maintain our services and in accordance with law.

We may combine data to enhance the outcomes for you when you use two or more InfoSuite Platforms.

We may conduct research, analytics and service enhancements.

Our processing of personal data may involve both human and automated methods. The automated methods are supported by our manual reviews to ensure quality and accuracy.

6. Collection of children data

Our platforms and services are not designed for or directed to attract children. We do not knowingly collect, use, or process personal data from individuals who are below the age of digital consent as defined under applicable data protection and child privacy laws.

7. Personal data processing

Below we outline the categories of personal data Enso collects, their sources, purposes of processing, and categories of recipients.

Categories of Personal Data

Name and Contact Data

Sources of personal data: User interactions and partners with whom we offer co-branded services.

Purposes of processing (Collection and disclosure to third parties): Product provision, customer inquiries, security, troubleshooting, and marketing.

Recipients: Service providers and user-directed entities.

Credentials

Sources: User interactions and organizations that represent users.

Purposes of Processing (Collection and disclosure to third parties): Product provision, customer inquiries, security and troubleshooting, and marketing.

Recipients: Service providers and user-directed entities.

Demographic Data

Sources of personal data: User interactions and data brokers.

Purposes of processing (Collection and disclosure to third parties): Product personalization, development, troubleshooting, and marketing.

Recipients: Service providers and user-directed entities.

Payment or Financial Data

Sources of personal data: User interactions and financial institutions.

Purposes of processing (Collection and disclosure to third parties): Commerce transactions, fraud prevention, and security.

Recipients: Service providers and user-directed entities.

Subscription and licensing data

Sources of personal data: User interactions, third-party storefronts and third-party platforms.

Purposes of Processing (Collection and disclosure to third parties): Product activation, personalization, support, accounting, and marketing.

Recipients: Service providers and user-directed entities.

Interactions

Sources of personal data: User interactions including data Enso generates through those interactions.

Purposes of Processing (Collection and disclosure to third parties): Product improvement, development, and marketing.

Recipients: Service providers and user-directed entities.

Content

Sources of personal data: User interactions.

Purposes of Processing (Collection and disclosure to third parties): Product delivery, safety, and troubleshooting.

Recipients: Service providers and user-directed entities.

Video or recordings

Sources of personal data: User interactions and publicly available sources.

Purposes of Processing (Collection and disclosure to third parties): Product enhancement, marketing, safety, and troubleshooting.

Recipients: Service providers and user-directed entities.

Feedback and ratings

Sources of personal data: User interactions.

Purposes of Processing (Collection and disclosure to third parties): Product improvement, development, customer support, and troubleshooting.

Recipients: Service providers and user-directed entities.

Categories of Sensitive Data

Depending on your privacy settings, consent, and product use, Enso may collect, and process, certain personal data that qualifies as “sensitive data” under applicable data privacy laws.

The following list outlines the categories of sensitive data Enso collects, their sources, purposes of processing, and categories of third-party recipients.

Account, and financial information

Sources: User interactions and organizations that represent users.

Purposes of Processing (Collection and Disclosure to Third Parties): To provide the product, fulfil financial transactions and product delivery.

Recipients: Service providers and payment processing providers.

Precise geo-location information

Sources of sensitive data: User interactions

Purposes of Processing (Collection and disclosure to third parties): Service provision and product improvement.

Recipients: Service providers

Racial or ethnic origin, religious or philosophical beliefs, or union membership

Sources of sensitive data: Communications with users.

Purposes of Processing (Collection and disclosure to third parties): Research and product improvement.

Recipients: Service providers.

Medical or mental health, sex life, or sexual orientation

Sources of sensitive data: Communications with users.

Purposes of Processing (Collection and disclosure to third parties): Research and accessibility improvement.

Recipients: Service providers.

Contents of your mail, email, or text messages (where Enso is not the intended recipient of the communication)

Sources of sensitive data: User interactions.

Purposes of Processing (Collection and disclosure to third parties): Product provision, security, and troubleshooting.

Recipients: Service providers.

Note: InfoPhone messages, media and calls are end-to-end encrypted. Enso and its service providers handle only encrypted data and cannot access their content.

Enso does not use or disclose your sensitive data except for the following purposes:

Perform the services or provide the goods you reasonably expect.

Ensure the security and integrity of our services, systems, and data, prevent malicious deceptive, fraudulent or illegal acts, and to protect the physical safety of individuals.

Short-term non-personalized advertising, without profiling.

Perform services on behalf of Enso, such as maintaining accounts, providing customer service, processing payments, providing financing, providing analytics, providing storage, and similar services.

Verify or maintain quality or safety of InfoSuite platforms.

Any other activities permitted under applicable data privacy laws.

Purposes and legal bases for processing

Enso processes your personal data with your consent or as required to provide the features that you use, select, to perform a contract or legal obligations, ensure security of our other users and functionality of our servers. Apart from consent, we may also rely on contractual obligation, legal obligation, vital and public interest as the grounds for processing personal data. Our legal bases depend on how and which one of the InfoSuite platforms you use.

In certain cases, we may also process your data based on the basis of legitimate interest. However, in such cases, we carefully consider and balance those interests against your rights, interests and freedoms, ensuring that your rights are not overridden.

8. Purposes of processing:

We use data to operate our products and provide you with rich and interactive features. For example, if you enter a search query on InfoQueries, we use that query to display search results to you or inform when updates are available by way of notifications, pop-ups, emails.

Product development and improvement. We may use your personal data to continually improve our services at InfoSuite platforms, including adding exciting new platforms, features, ways to interact as well as new capabilities. For example, we use error reports to improve security features, or voice recordings to develop and improve speech recognition accuracy.

Personalization. Many products include personalized features, such as algorithm curated recommendations with the objective of enhancing your productivity and enjoyment. With your permission, we may use automated algorithmic processes to curate your InfoSuite experiences based on the data we have about you. For example, if you have a Enso account, with your permission, we can sync your settings on several devices. Many of our products provide controls to disable personalized features.

Product activation. We use device related data such as device type, device location, and unique device, application, network, and subscription identifiers to activate products that require activation.

Customer support. We use data to diagnose issues, troubleshoot and provide other customer support services, including to help us provide, improve, and secure the quality of our products, services, and training, and to investigate security incidents. Call recordings may be used to authenticate users and investigate security incidents.

To secure and troubleshoot. Data is used to secure InfoSuite ecosystem that comprise our platforms and users, detecting malware and malicious activities, improving performance or compatibility issues. This may include using automated systems to detect security threats and safety issues.

Updates and maintenance. We process certain device data to develop and deliver the software updates, latest features and security patches while ensuring optimum performances. For example, available memory of your device’s, and evaluate whether your device is ready to process such updates.

Promotional communications. We may use your personal data with your consent to deliver promotional and sponsored communications by email, SMS, in-app notifications, and telephone. You may manage or opt-out of these communications at any time. However, these choices do not apply to mandatory service communications that are part of certain InfoSuite platforms.

Relevant offers. We analyse data from a variety of sources to provide you with relevant and valuable information that will be best suited and relevant to you as per your usage patterns.

Advertising. We only use personal data we collect through our interactions with you for advertising on InfoSuite platforms and on third-party platforms. We may use automated processes to deliver more relevant ads. Enso does not use your private communications like email, chats, video calls, voice mail, or your documents, photos, or other personal files to target ads to you. InfoPhone carries no advertising and contains no advertising technology; no InfoPhone data is used for advertising.

Transactions and commerce. We use your personal data to carry out transactions, offer subscriptions and payments, and to deliver purchased products or services with us.

Reporting and business operations. We use data to analyse our operations and perform business intelligence. This enables us to make informed decisions and report on the performance of our business.

Legal compliance. We process your personal data to comply with applicable laws of your jurisdiction including those related to data protection, age verification, and consumer rights.

Research and innovation. With appropriate technical and organizational measures, we may use your personal data to conduct research, including advanced machine learning and artificial intelligence capabilities for the benefit of the public interest or scientific purposes.

9. Sharing of personal data

We may share your personal data, only when necessary, with your consent or to complete a transaction or to deliver Enso services and features you have requested or authorized. For instance, we share your content with third parties when you instruct to do so, such as share photos and documents on InfoDatabox, or link accounts with another service. Or when you make a payment, we share transaction details with banks, card networks, or payment processors to complete the transaction, for fraud prevention and credit risk reduction.

We may also share limited data with our third-party advertising partners when you interact with a website or app that uses Enso’s ad services, device or interaction data may be exchanged to help deliver relevant ads and assess performance.

Additionally, we may share personal data among Enso-controlled affiliates and subsidiaries for the purpose described in this privacy policy.

We may share personal data with our trusted vendors to provide support services such as customer care, hosting, etc. and they are bound by our data privacy and security requirements. We may also disclose personal data as part of a corporate transaction such as a merger or sale of assets.

We may access, retain, transfer, disclose, or preserve personal data, including your content in private folders, when we have a good faith to belief that such action is necessary for of the following:

Legal Compliance: Complying with applicable law or respond to valid legal process, including from law enforcement or other government agencies.

Safety and Harm Prevention: To protect our users, organizations, or public which may include detecting or preventing spam or combating harmful or illegal behaviour including the creation and sharing of harmful or illegal content.

Security Operations: To securely operate our platforms, to prevent or stop an attack on our systems or networks.

Protection of Enso’s Rights and Property: It includes enforcing our User Agreement, Terms of Service and Community Guidelines. In case of misuse or potential misuse of Enso’s Intellectual or physical property, we may refer the matter to law enforcement.

For InfoPhone, Enso cannot access, disclose or preserve the content of your messages, media or calls in response to any of the above, because that content is end-to-end encrypted. Any disclosure is limited to the account data and communication metadata described in Section 12A.

Please note that some of our platforms may be integrated with or link to third party services whose privacy practices differ from those of Enso. If you provide personal data to any of those products, your data is governed by their respective privacy policies.

Parties that control collection of personal data

In certain situations, Enso may allow a third party to control the collection of your personal data. Enso may permit advertising partners to collect personal data about your interactions with our websites to deliver personalized ads on its behalf, You may opt out from such sharing by contacting us.

Advertising

Advertising supports, sustains, and enhances InfoSuite platforms. Enso does not use what you say in emails, human-to-human chat, video calls or voicemail, or your documents, photos, or other personal files to target ads. We use other data, detailed below, for advertising on our InfoSuite platforms and on third-party platforms. For example:

We may use data to select and deliver ads on third-party platforms.

When the advertising ID is enabled, third parties may access it to deliver ads within applications.

We may share data with partners so that the ads you see on our platforms and their products are more relevant and valuable to you.

Advertisers may include Enso’s web beacons to allow Enso to collect information on their sites. We use this data on behalf of our advertising customers to provide ads.

The ads that you see may be selected based on data we process about you, such as your interests and favourites, your location, your transactions, how you use our platforms, your search queries, or the content you view.

If you are signed in to your Enso account and have consented to personalized advertising, Enso may tailor ads to your online activity as mentioned in the sections below.

10. Managing your personal data

Enso provides various ways for you to access, manage, and control your personal data depending upon the platforms you navigate and information we collect and process. You may:

Manage how Enso use your data for personalized advertising by contacting us.

Choose whether to receive sponsored emails, SMS or calls, from Enso by visiting our privacy support and requests page.

Exercise your data protection rights as per your jurisdiction by contacting our Data Protection Officer (DPO) using the details in Contact Us section.

Your Rights as Data Subjects

Regardless of your location, you have the following rights over the personal data that Enso processes about you:

Right to withdraw your consent where processing is based on your prior consent.

Right to be informed about how your personal data is collected and used.

Right to request access to, correction of, or deletion of your personal data.

Right to request portability of your data to another service.

Right to object to or restrict the processing of your personal data. For example, you can object our use of your personal data for targeted marketing or advertisement purposes, or where we are processing your data based on public interest or our legitimate interest.

In some cases, your rights over your personal data may be limited by applicable law and may be declined with reason in written response.

If your Enso account is provided by an organization, contact your organization directly to manage your data access and control rights.

As mentioned above, you can exercise your data subject rights by contacting our DPO.

Browser-based controls

You can control some of your personal data through browser settings. For example:

Cookie controls. You can manage or withdraw consent to cookies by using the browser’s cookie settings in your browser as described in the Cookies section of this Privacy policy.

Tracking protections. You can use tracking protection list in your browser that allow you to block trackers and prevent them from collecting data about your browsing activity.

11. Cookies and similar technologies

We use cookies and similar technologies to support core InfoSuite platform functionalities, personalize user experiences, maintain sessions, analyse usage trends, enhance security, and serve relevant targeted advertising. InfoSuite platforms use additional identifiers for similar purposes, and many of our websites and applications also contain web beacons or other similar technologies, as described below.

InfoPhone exception: InfoPhone, including the InfoPhone web application, sets no cookies and uses no web beacons, analytics identifiers or advertising technologies. This Section 11 does not apply to InfoPhone.

Our use of Cookies and Similar Technologies

The use of cookies depends on the context of your interaction and the InfoSuite platform in use. Common purposes include:

Storing your preferences and settings. Cookies store your preferences and settings on your device to optimize user experience and avoid repeated configurations on your device. Further, if you opt out of interest-based advertising, we store that preference in a cookie on your device.

Sign-in and authentication. We also use cookies to identify and authenticate your identity. When you sign in to one of InfoSuite platform using your Enso account, we store a unique ID number, and the time you signed in, in an encrypted cookie on your device. This cookie enables session continuity so you don't need to log in repeatedly while navigating between pages within the platform. You can also save your sign-in information(credentials) so you do not have to sign in each time you return to the InfoSuite Platform.

Security. We use cookies to process information that helps us to protect you, our products, as well as to detect fraud, abuse or any unauthorised activity.

Storing information you provide to a website. We use cookies to remember information that you shared, such as when you add products to a shopping cart on one of the InfoSuite platform, we store the data in a cookie so that you can resume from the same place when you access that webpage later.

Social media. Some of our platforms include social media cookies, including those that enable users who are signed in to the social media service to share content via that service.

Feedback. Enso uses cookies to enable you to provide feedback on a platform.

Interest-based advertising. Enso uses cookies to collect data about your online activity and identify your interests so that we can provide direct digital advertising. You can choose to opt out of receiving interest-based advertising from Enso as described above.

Advertising display. Enso uses cookies to analyse the number of visitors and clicks on an advertisement and record which advertisements you have seen, so you do not see the same on a loop.

Analytics. We use cookie identifiers to gather usage and performance data to develop other statistics about the operations of our products.

Performance. Enso uses cookies to maintain and improve system performance such as load balancing cookies; this helps us keep our websites remain up and running.

Where required by law, Enso seeks your consent prior to placing non-essential and personal advertising cookies on your device.

Third-Party Cookies

In addition to the cookies Enso places on your device, we also use cookies from third parties to enhance your experience and services on our platforms. Some third parties place cookies directly when you visit Enso sites. This can happen in the following scenarios:

Service providers that we engage to support platforms functionality.

Content and advertising providers that deliver content on InfoSuite platforms, also place cookies on their own when their content is embedded on InfoSuite platforms (such as videos or news, or ads).

These third-parties process data in accordance with their own privacy policies, and may combine information about your activities across websites, apps, or online services. The types of third-party cookies in use will vary depending on the context, InfoSuite platform, as well as your account settings and permissions:

Necessary cookies. Required cookies are used to perform essential functions such as to log you in, save your language preferences, improve performance, route traffic, page load times, and measure audiences. These cookies are necessary for our platforms to work.

Social Media cookies.  These cookies connect your InfoSuite activity to your social media profiles and may be used to show you relevant ads or tailored content.

Analytics cookies. Third party analytics cookies are used to help us better understand how you use our platforms. They are used to gather information about the pages you visit and how many clicks you need to accomplish a task.

Advertising cookies. Advertising cookies are used to track ads you click on or purchases you make to show relevant ads.

Where legally required, Enso obtains your consent before placing or using optional cookies.

We encourage you to review the third-party privacy policies for details on their privacy practices with respect to their cookies that may be set on our websites.

How to control cookies

Most modern web browsers automatically accept cookies by default, but also provide options to block or delete them. You can manage cookies by adjusting your browser settings as follow:

Settings > Privacy and services > Clear Browsing data > Cookies and other site data.

As outlined above, optional cookies are placed only with your consent. You may choose to give consent to certain categories of optional cookies or withdraw consent at any time.

If you block cookies, you may not be able to sign in or use some features which depend on cookies, and saved preferences may be lost.

Additional privacy controls that can impact cookies, including the tracking protections feature in Enso browsers, are described in the How to access and control your personal data section of this privacy policy.

Some Enso webpages and communications contain electronic tags known as web beacons (also known as clear GIFs, pixel tags, or single-pixel images) that we use to help deliver cookies on InfoSuite platforms, count visitors, determine if your mails were opened and deliver co-branded content or services.

Additionally, Enso may work with other companies to place our web beacons on their websites or advertisements. This helps us to gather aggregated, non-identifying metrics related to your activity on the website of an Enso partner in connection with your use of an InfoSuite platform.

In addition to standard cookies and web beacons, InfoSuite platforms may also use other data storage technologies to maintain your preferences, improve speed, performance, and track usage patterns by storing certain files locally.

12. Manage your Enso account data

An Enso account allows you to sign into InfoSuite platforms, as well as certain partner services. Personal data linked to your Enso account may include your credentials, information about your activities, and your interests.

Using your Enso account provides a personalized and seamless experience across products and devices, enables cloud data storage, facilitates payments, and unlocks other integrated features. There are two types of Enso account:

Personal Enso Account: Created by you and linked to your personal email address.

Organisational/Workplace or School Account: When you or your organization create your Enso account tied to your organization email address.

Personal Enso Accounts

The personal data collected and its use depends on how you interact with the account.

Creating your Enso account. When you create a personal Enso account, you will provide certain personal data such as your display name, email address, and phone number, can be used to help others to search you and connect with you within InfoSuite platforms.

Note: If you use a work or school email address to create a personal Enso account, your employer or school may access your data. In some cases, you will need to change the email address to a personal email address in order to continue accessing consumer-oriented products.

Signing in to Enso account. Each time you sign in to your personal Enso account, we record the date and time, information about the product you signed in to, your sign-in name, your device identifier, IP address, and your system and browser version.

Staying Signed in. When you sign in to your account, you will stay signed in until you sign out. Staying signed in enables personalization, consistent experiences across all InfoSuite platforms and devices, access to synchronised data across devices, payments information.

Using third-party products. When you sign in to a third-party product with your Enso account, data is shared with the third party in accordance with its privacy policy. If you share your profile data, the third party can display your name or user name and your profile picture (if you have added one to your profile) when you are signed in to that third-party product.

Similarly, if you carry out transactions using your Enso account, Enso will pass information such as name, payment instrument details, billing and shipping addresses, and relevant contact information stored in your Enso account to the third party or with the financial intermediaries or payment processors as necessary to process your transaction.

The third party can use or share the data it receives when you sign in or make a purchase according to its own practices and policies. You should carefully review the privacy policy for each product you sign in to and each merchant you purchase from to determine how it will use the data it collects.

Organisational/Workplace or School Accounts.

Many InfoSuite platforms are designed for use by organizations, such as NGO’s, schools and businesses. If your organization provides you with access to InfoSuite platforms, your use of the platforms is subject to your organization's policies, if any.

Data associated with a workplace or school account, is handled similar to the personal Enso account.

When signing in with a work or school account note that:

The organization owning your email address may manage and administer your account, and access data shared by you, including the contents of your communications and stored files.

Losing access to your organization account may also revoke access to your Enso account.

Enso is not responsible for the privacy or security practices of your organization, which may differ from Enso’s own.

If your organization is administering your use of InfoSuite platforms, please direct your privacy inquiries, including any requests to exercise your data subject rights, to your administrator.

12A. InfoPhone – Product-specific privacy notice

This Section applies to InfoPhone in addition to the rest of this Privacy Policy. Where this Section differs from a general statement elsewhere in this Policy, this Section prevails for InfoPhone.

12A.1 End-to-end encryption: what it protects

Messages of every type (text, replies, reactions, edits, shared locations, contact cards, call logs and disappearing messages), media files, and the audio and video of calls are encrypted on your device using the Messaging Layer Security (MLS) protocol (RFC 9420) before they are sent. Media files, including thumbnails and previews, are encrypted with a fresh per-file key (AES-256-GCM) before upload. Enso’s servers, object storage and content delivery network only order, store and deliver encrypted data that Enso cannot read.

Calls are encrypted frame by frame. Call keys are derived from the conversation’s group secret for each session, so a participant who is added cannot decrypt earlier media and a participant who is removed cannot decrypt later media. The call relay only forwards encrypted frames and does not record calls.

Push notifications carry either encrypted content that is decrypted on your device or a contentless “wake” signal. Apple and Google never receive your message text.

Backups are encrypted on your device under a randomly generated recovery key that only you hold. Enso cannot read or recover your backup. If you lose your recovery key, your backup cannot be recovered by anyone, including Enso.

When you link a new device, your message history is transferred under a key derived from a QR-code secret that never passes through Enso’s servers. Each of your devices holds its own cryptographic identity.

InfoPhone does not claim that its encryption is resistant to quantum computers, and it does not offer “deniability”: within a conversation, messages are cryptographically attributable to their sender.

12A.2 What end-to-end encryption does not protect (communication metadata)

Encryption protects the content of your communications, not the record that they occurred. The following remains visible to Enso and is processed to operate the service: who communicates with whom and when; timestamps; the size of encrypted messages; group memberships and changes to them; your online/presence state and last-seen time; delivery and read receipts, including which message they refer to; and routing identifiers. Enso’s servers are trusted to order and deliver messages and to enforce group membership; they are never able to read content.

Encryption also cannot protect data on your own or your contacts’ devices. If a device is compromised, or if a recipient keeps, screenshots or forwards content, that is outside the protection of end-to-end encryption.

12A.3 Personal data InfoPhone collects

Identity and account: your phone number, which is your primary identifier and is verified by a one-time password sent by SMS (the code is stored in hashed form and expires after 10 minutes); your profile (display name, avatar, free-text status and optional email address); and an internal messaging identifier that is randomly generated and not derived from your phone number, together with the cryptographic identities of each of your devices.

Device and technical data: for each linked device (up to five), the device identifier, name, platform and push/VoIP notification tokens; your IP address and, at login, the country, region, city, time zone and latitude/longitude supplied by your device; and hashed device credentials, with revocation records kept for 30 days.

Contact matching: if you grant the contacts permission on a mobile device, the phone numbers in your address book (numbers only – names, email addresses and photos never leave your device) are uploaded so that we can show you which of your contacts use InfoPhone. Numbers belonging to people who are not InfoPhone users are matched in memory and are not stored; what we retain is the link between two registered users. End-to-end encryption does not change this flow.

Social graph: your block list (in both directions), your group memberships including your role and join/leave history, and group names, descriptions and avatars.

Content and communications: encrypted messages held only in a 30-day delivery archive and encrypted media held in object storage – Enso cannot read either; your encrypted backup; call records (initiator, participants, timings and outcome – the call audio and video themselves are end-to-end encrypted and never stored); and moderation reports you submit, which contain free-text details and any content you choose to quote and which are readable by our moderation team.

Preferences: work-mode schedules (hours, time zone and auto-reply text) and per-chat mute, pin and star settings synchronised across your devices.

Device permissions InfoPhone may request: contacts, camera, microphone, photo library, location (only for the location-sharing picker), Face ID (iOS) and notifications.

No tracking: InfoPhone contains no analytics, crash-reporting, attribution or advertising software on any platform. Firebase is used for push messaging only, and the InfoPhone web application sets no cookies.

12A.4 Purposes and legal bases

We process InfoPhone data to: verify your identifier and secure your account (performance of our contract with you and our legitimate interest in security); deliver messages, media, calls and notifications and synchronise your devices (performance of our contract); show you which of your contacts use InfoPhone (your consent, given through the contacts permission); provide optional features such as location sharing and backups (your consent, given when you use the feature); handle the reports you submit and prevent abuse (our legitimate interest and legal obligations); and comply with applicable law.

12A.5 Where InfoPhone data is stored and who processes it

InfoPhone’s servers run on Amazon Web Services in the ap-south-1 (Mumbai, India) region; the primary place of storage for InfoPhone data is India. Encrypted media may be cached at CloudFront edge locations around the world. The following sub-processors receive the data indicated:

MSG91 (SMS one-time passwords, India): your phone number and the one-time code.

Twilio (SMS one-time passwords, global fallback): your phone number and the one-time code.

Apple Push Notification service and Google Firebase Cloud Messaging (push notification delivery): your push token and minimal routing information, plus either encrypted content or a contentless wake signal – never message text or phone numbers.

Amazon Web Services S3 and CloudFront (storage and delivery of encrypted media, backups and avatars): encrypted data only; CloudFront access logs record the object identifiers in request paths.

LiveKit (call relay): your internal messaging identifier and end-to-end encrypted media frames – no phone numbers, and calls are not recorded.

ipinfo.io (approximate location when linking a device through the web application): your IP address, which your browser sends to ipinfo.io directly.

12A.6 How long InfoPhone data is kept

Encrypted messages in the delivery archive and offline queue: 30 days, purged daily.

Device credential revocation records: 30 days.

Transient caches (hashed one-time passwords, session and notification data): from minutes up to 30 days, depending on the item.

Call records, moderation reports, synchronisation state, backups and media: retained until you delete your account.

Group invite links: valid until revoked by a group admin; they do not expire automatically.

12A.7 Deleting your InfoPhone account and exercising your rights

You can delete your InfoPhone account in the app. Deletion removes your account and all server-side personal data associated with it – devices, contact links in both directions, group memberships, settings, privacy configuration and work modes – revokes your credentials, deregisters your messaging identity and erases your media, avatar (including cached copies) and backup from our storage.

Two limits apply in any end-to-end encrypted messenger: messages already delivered to other people’s devices remain on those devices, and encrypted messages addressed to your contacts remain in the delivery archive until the 30-day purge.

You can also request account deletion through our public account-deletion request page, and exercise your rights of access, correction, portability and objection by contacting our Data Protection Officer (see Contact us). We will respond within the time required by applicable law.

12A.8 Your privacy controls in InfoPhone

You can set who may see your profile photo, last seen, status/about and online state – everyone, my contacts, my contacts except selected people, or nobody – with per-person exceptions. Where a setting cannot be resolved, it fails closed and nothing is shown. Blocking in either direction overrides all other visibility settings, and last-seen visibility is reciprocal.

Your online presence is sent only to contacts you permit; other users cannot probe it. Read receipts can be switched off account-wide; receipts are not stored on our servers, although each receipt identifies the message it acknowledges. Typing indicators are never stored. Mutes and blocks are per chat or per contact and are synchronised across your devices.

12B. InfoLegacy – Product-specific privacy notice

This Section applies to InfoLegacy in addition to the rest of this Privacy Policy. Where this Section differs from a general statement elsewhere in this Policy, this Section prevails for InfoLegacy.

12B.1 Who InfoLegacy processes data about

InfoLegacy processes personal data about three groups of people: you, as the account holder; the profile subject, meaning the person a profile is about; and your nominees, meaning the people you invite to access your vault. InfoLegacy is designed for building a profile about yourself. You may create a profile about another person only where that person has consented or you are otherwise lawfully entitled to do so, and you are responsible for that (see our User Agreement). If you believe that someone has created an InfoLegacy profile about you without your consent, contact our Data Protection Officer and we will investigate, suspend the profile where appropriate and honour your rights of access, rectification and erasure.

12B.2 How the profile-creation pipeline works

When you choose “Search by name” during profile creation, InfoLegacy runs a series of steps, each of which runs only if the previous steps did not produce enough information:

Step 1 – Identification. Your name, email address and, where known, your location are taken from your signed-in session as search and disambiguation hints. The name is sent to a web-search service operated by Ollama (ollama.com); the returned results are passed to an AI model that extracts candidate LinkedIn profile links, and you choose the correct one. Links that do not appear in the search results are discarded.

Step 2 – LinkedIn. The profile at the link you selected is retrieved through Apify, a third-party scraping service, and the following fields are extracted: first and last name, headline, location, summary, profile image, positions (title and company), education (degree and school), skills, publications, certifications and honours or awards.

Step 3 – Wikipedia. If more information is needed, the name is searched on Wikipedia through Apify and the matching article (title, link, summary, thumbnail and full text) is retrieved; occupation, birthplace or nationality, career, education, awards, publications and early-life details are extracted from it.

Step 4 – AI inference. If more information is still needed, the subject’s name, email domain, known location and the fields already found are sent to an AI model hosted by Ollama (ollama.com), which supplies missing fields from its own training knowledge and is required to cite a source link for each. This is inferred or generated personal data and may be inaccurate or out of date.

Step 5 – X (Twitter). If more information is still needed, the name and location are searched on X through Apify and the display name, bio, location, profile picture, username, website link and join date of the matching profile are retrieved. Recent posts are not stored and are never used to populate a profile.

Step 6 – Your review. Nothing gathered is stored or published automatically. Every field is shown to you on a review screen; you can edit or remove each one and must explicitly accept before the profile is stored. Fields you edit are attributed to you rather than to the original source.

If none of these sources yields usable information, InfoLegacy can instead import your own InfoProfile profile data. Each external source can be switched off by Enso, and we may change or replace the services used.

12B.3 Personal data InfoLegacy collects

Account and identity: email address, first and last name, avatar, InfoProfile single-sign-on identifiers, role and account status, last-login time, and limited account metadata.

Session, device and activity: session tokens, browser or device user agent, IP address and session expiry; and an activity log of actions taken in your account (action, item affected, details and IP address) kept for security and audit purposes.

Profile data gathered or inferred as described in Section 12B.2, normalised into: basic information (full name, headline, location, bio, profile image); sections (experience, education, skills, awards, publications); and AI-generated narrative sections (early life, skills and expertise, values and philosophy, legacy vision).

The stored profile: display name, link, source profile links, status, the generated sections, an information box, per-section verification flags and provenance records showing which source each field came from.

Vault and documents: the items you add to your vault (type, title, content and metadata) and the files you upload (name, type, size and storage reference).

Nominees: the name, email address and relationship of each nominee, the permissions you grant, their access requests and related notifications.

Special categories of data: InfoLegacy does not intentionally collect data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life or sexual orientation, and does not filter for it. Free-text material gathered from public sources and AI-generated narrative may nevertheless incidentally contain such information. You can remove it at the review stage or at any time afterwards; where you accept it into your own profile, we process it on the basis of your explicit consent and only to display it as part of your profile.

12B.4 Who processes InfoLegacy data

Apify (apify.com): receives the subject’s name, location and search terms, and the selected LinkedIn profile link, as inputs to the scraping tasks it runs on its own infrastructure against LinkedIn, Wikipedia and X, and returns the results to us.

Ollama Cloud (ollama.com): receives the subject’s name as web-search queries (Step 1) and the subject’s name, email domain, known location and already-known fields (Step 4).

InfoProfile (our single-sign-on service): handles your sign-in and, if you choose the fallback import, provides your InfoProfile profile data.

Our hosting, database, cache and file-storage providers hold the data above on our behalf. Gathered data is held only transiently in our cache until you accept or abandon the profile; accepted data is held in our database.

Each of these providers processes data under our instructions and a data-processing agreement, and transfers outside your country are protected by the safeguards described in Section 13.

12B.5 Purposes and legal bases

We process InfoLegacy data to: operate your account, vault and nominee access (performance of our contract with you); gather and organise publicly available information about you when you choose “Search by name” (your consent, given when you start the search, and our legitimate interest in reducing manual data entry, subject to your review and acceptance of every field); generate narrative sections with artificial intelligence (your consent); invite and manage nominees (performance of our contract and the legitimate interest of you and your nominees); keep session and activity logs (our legitimate interest in security and auditability); and comply with applicable law.

12B.6 Accuracy and AI-generated content

Information gathered from public sources may be about a different person with the same name, and information inferred by an AI model may be wrong or out of date. The review step exists so that you can correct or delete it before anything is stored, and you can edit or delete any field afterwards. Each stored field carries a record of its source. If a profile is about you and was created by someone else, you can ask us to correct or erase it by contacting our Data Protection Officer.

12B.7 How long InfoLegacy data is kept

Raw results gathered from external sources: deleted as soon as you accept the profile, and in any event automatically after 24 hours if you abandon the process.

Accepted profiles, vault items, uploaded documents and nominee data: retained until you delete them or delete your account, at which point they are deleted together with the stored copies of your uploaded files.

Session records and activity logs, including IP addresses: retained for no longer than is necessary for security and audit purposes and deleted when your account is deleted.

12B.8 Your choices and rights in InfoLegacy

You decide whether to use “Search by name” at all: you can instead enter profile information manually or import it from InfoProfile. You can edit or delete any part of a profile, remove vault items and documents, and revoke a nominee’s access at any time. Deleting your account deletes your profiles, vault, documents and nominee data. You can exercise your rights of access, rectification, erasure, portability and objection, including as the subject of a profile created by someone else, by contacting our Data Protection Officer (see Contact us).

13. Storage and processing of personal data

Typically, the primary storage location for personal data collected by Enso is in the user’s region or in India, often with a backup to a data centre. Processing of personal data including usage, access, transfer etc. may take place in your region, in India, or in any other jurisdiction where Enso or its affiliates, subsidiaries, or service providers operate facilities. InfoPhone data is hosted on Amazon Web Services in the ap-south-1 (Mumbai, India) region, with encrypted media cached at CloudFront edge locations worldwide (see Section 12A.5).

We handle all data collected under this Privacy Policy in accordance with its provisions and applicable data protection laws.

We may transfer personal data from the country of origin to other jurisdictions, some of which may not yet be recognized by local data protection authority as having an adequate level of data protection. Such countries may not guarantee you the same rights, or there may not be a privacy supervisory authority capable of addressing data protection complaints.

When we transfer personal data internationally, we implement appropriate legal safeguards and technical measures to ensure the continued protection of your personal data. These safeguards may include:

Adequacy decisions issued by competent authorities;

Binding corporate rules adopted by Enso and its affiliates; and

Standard contractual clauses (SCCs) adopted by the European Commission under Implementing Decision 2021/914, or equivalent instruments under applicable laws.

These measures will ensure your data protection rights and the consistent level of protection to your data, regardless where your data is processed.

14. How we protect your personal data

Enso implements a combination of organizational and technical safeguards to protect your personal data against unauthorized access, alteration, disclosure, loss, or destruction. Security is embedded into our systems and practices through the principle of privacy-by-design. The measures that we take to protect your data include:

Information Security Management Program: We maintain a documented and continuously evolving Information Security Management Program aligned with internationally recognized frameworks. This program is periodically reviewed and updated to address emerging threats, regulatory developments, and technological advancements.

Data Minimization: Where feasible, we apply data-minimization, pseudonymization, and anonymization techniques to limit the volume and identifiability of data we process. Your personal data is never retained or processed beyond the legitimate and declared purposes for which it was collected.

Employee Training: All Enso employees handling your personal data receive mandatory privacy and security training at onboarding and at regular intervals. They are bound by contractual confidentiality obligations and operate under access-control policies that restrict data use to authorized personnel only.

Vendor and Processor Oversight: Before engaging third-party processors, we conduct due-diligence assessments covering their data-protection and security practices. Each processor is bound by a written Data Processing Agreement (DPA) requiring compliance with applicable privacy laws, technical safeguards, and our internal security standards. Ongoing monitoring and periodic reassessments are performed to verify continued compliance.

Data Breach Management & Data Breach Notification: We maintain a breach management plan that defines how potential security incidents are identified, escalated, contained, and resolved. In the event of a confirmed personal data breach, we promptly investigate the incident, assess its scope and impact, implement remedial measures, and, where required by law, notify affected individuals and relevant supervisory authorities within the prescribed timelines.

15. Retention of personal data

Enso retains personal data for as long as necessary to deliver the services and fulfil the transactions you have initiated. We may also retain data for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements.

Since retention needs depend on the nature of the data, the purpose of processing, and the context of our relationship with you, actual retention periods may differ significantly.

In determining how long to retain personal data, Enso considers several factors including:

User Consent:   Where you have expressly consented to a longer retention period, Enso will retain the data in accordance with your consent.

User Activity: If users share, create, or store data with the understanding that it will be retained until they actively delete it, Enso retains that data accordingly. For example, document stored in InfoDatabox, or chat message in your InfoConverse chat is retained till you choose to delete it. In some cases, earlier deletion may occur, such as when account storage limits are exceeded.

InfoPhone: the retention periods for InfoPhone data are set out in Section 12A.6. Encrypted messages awaiting delivery are purged after 30 days; call records, moderation reports, synchronisation state, backups and media are retained until you delete your account.

InfoLegacy: raw results gathered from external sources are deleted when you accept the profile or automatically after 24 hours; accepted profiles, vault items, documents and nominee data are retained until you delete them or your account (see Section 12B.7).

User Control:   Where user options such as those in the Enso privacy settings allow you to access and delete your personal data at any time, the retention period aligns with these controls. In the absence of such functionality, a shorter retention period will generally apply.

Sensitivity of Data:  Personal data classified as sensitive is typically retained for a shorter duration to minimize risk.

Legal or Contractual Requirement:   Enso may be required to retain or delete data to comply with laws, regulatory mandates, or contractual obligations such as mandatory data retention laws in the applicable jurisdiction, government orders to preserve data relevant to an investigation, or data retained for litigation purposes.

De-Identified Data: In certain cases, Enso processes data in a de-identified form i.e. it cannot be linked to an individual to whom such data may relate without taking additional steps. Where applicable law requires, Enso maintains such data in a de-identified state and does not attempt to re-identify the individual to whom the data relates.

16. Changes to this privacy policy

Enso shall update this privacy policy periodically to reflect greater transparency or in response to:

feedback from customer, regulators, industry, or other stakeholders.

changes in our products.

changes in our data processing activities or policies.

When we post changes to this policy, we will revise the "last updated" date at the top of policy. If there are material changes to the policy, such as a change to the purposes of processing of personal data that is not consistent with the purpose for which it was originally collected, Enso will notify you in advance, either through a prominent on-site notice or direct communication.

We encourage you to regularly review this privacy policy to learn how Enso is protecting your information.

17. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, you can contact us at:

Data Protection Officer

Email: dpo@ensowebworks.com

Enso Webworks Private Limited, Address: 701 and 705, Dalamal House, Jamnalal Bajaj Marg, Nariman Point, Mumbai, Mumbai, Maharashtra, 400021