Privacy Policy

Effective date: 8 September 2026

This Privacy Policy explains how INS-LAB PVT LTD ("INS-LAB", "we", "our", or "us") collects, uses, stores, shares, and protects your personal data when you use our website at www.inslab.io and the services offered through it (the "Platform"). Please read it alongside our Terms & Conditions and Disclaimer.

1. Who We Are

INS-LAB PVT LTD is a private limited company incorporated in India in February 2022, holding IRDAI Corporate Agency Licence No. CA0983. For the purposes of the Digital Personal Data Protection Act, 2023, INS-LAB is the Data Fiduciary in respect of the personal data described in this Policy, and you are the Data Principal.

• Registered office: Door No 61, Old No. 319B, 3rd Floor, 9th Main Road, 5th Block, Jayanagar, Bengaluru, Karnataka 560041
• CIN: U66220KA2022PTC157688  |  GST: 29AAGCI5222H1ZK
• Contact: support@inslab.io  |  1800 572 2690

2. Legal Framework

This Policy is published in accordance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act");
• The Information Technology Act, 2000, and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• Applicable IRDAI regulations governing corporate agents, including regulations on the protection of policyholders' interests;
• The Telecom Commercial Communications Customer Preference Regulations, 2018 ("TCCCPR"), in respect of commercial communications.

3. Scope

This Policy applies to personal data we collect from:

• Visitors to www.inslab.io, whether or not they submit an enquiry;
• Individuals who submit an enquiry, quote request, loan application, grievance, or contact form;
• Individuals who interact with our AI assistant on the Platform;
• Customers whose insurance or loan applications we facilitate, including data received from insurers, banks, and non-banking financial companies ("NBFCs") in the course of that facilitation.

This Policy does not apply to the independent privacy practices of insurers, banks, or NBFCs to whom your application is submitted. Those entities are separate data fiduciaries and publish their own privacy policies.

4. Our Role

Understanding our role helps clarify how your data is used:

• Insurance: INS-LAB is an IRDAI-licensed corporate agent. We compare and arrange cover across our insurer panel. We are not an insurer. Policies are issued by, and premiums are payable to, the insurer you select.
• Loans: INS-LAB is a distributor and facilitator that connects applicants to partner banks and NBFCs. We are not an NBFC and are not licensed to lend. We do not sanction, approve, or disburse loans, and we do not guarantee any lender's decision, rate, or terms.

Because we act as an intermediary, delivering the services you request necessarily involves sharing your application data with the insurer or lender concerned, as described in Section 11.

5. Information We Collect

5.1 Information you provide directly

Through our enquiry, quote, loan application, and grievance forms, we collect only the fields presented on those forms, which may include:

• Name, mobile number (mandatory), and email address;
• Profession, company name, and net take-home income;
• Type of insurance or loan sought, loan amount, and enquiry subject;
• Any free-text message, grievance description, or supporting detail you choose to provide.

5.2 Eligibility and EMI calculator inputs

If you use our EMI or eligibility calculators, the figures you enter (such as income, existing obligations, loan amount, and tenure) are processed to generate an indicative result. Where you have accepted analytics cookies, these inputs may be recorded against your anonymous visitor identifier so we can understand which products visitors are evaluating and improve the tools. Calculator results are indicative only and are not an offer, sanction, or guarantee.

5.3 AI assistant conversations

Messages you send to our AI assistant, and any images you attach, are processed and stored so we can respond, maintain conversation context, and improve the service. Please do not share identity documents, account numbers, passwords, or health records through the assistant. See Section 10.

5.4 Information from insurers, lenders, and other sources

Where you ask us to arrange cover or a loan, we may receive application status, policy or sanction details, and related correspondence from the insurer, bank, or NBFC concerned. Credit checks, where required, are carried out by the lender with your separate authorisation.

5.5 KYC and sensitive personal data

Certain products require sensitive personal data, for example, health and medical history for health or life cover, or financial information and KYC documents such as PAN for a loan application.

We do not collect KYC documentation for our own purposes. Know Your Customer requirements are obligations of the insurer, bank, or NBFC concerned, not of INS-LAB. Where such documents are needed, we collect them solely to pass them to that insurer or lender as part of the application you have asked us to make, and we act as a conduit for that limited purpose. The insurer or lender is the entity that verifies, relies on, and retains that documentation under its own obligations and privacy policy. We do not use KYC documents to build a profile of you, and we do not share them with anyone other than the insurer or lender handling your application.

We do not collect biometric data (such as fingerprints or facial recognition) and we do not collect vehicle telematics data through this Platform.

6. Information Collected Automatically

This section describes what happens in the background as you browse. Nothing in this section, other than the strictly necessary cookie recording your consent choice, is collected unless you accept cookies on the banner shown on your first visit.

6.1 Device and session information

Device type, browser and operating system, screen and viewport size, language, time zone, referring website, UTM campaign parameters, the page you landed on, and the number of pages viewed in a session.

6.2 Approximate location

We derive an approximate country, region, and city from your IP address using an offline lookup database held on our own servers. This is city-level only. We do not collect GPS or precise device location.

6.3 Page activity

Pages visited and the order in which you visit them, time spent on a page, how far you scroll, and clicks on links and buttons.

6.4 Partially completed forms

We want to be explicit about this, because it is not obvious. If you begin filling in one of our forms, including typing your mobile number or email, and then leave the page without submitting it, the information you had entered may still be recorded. We use this to follow up on enquiries that were interrupted, and to identify where our forms are confusing or too long.

If you do not wish this to happen, decline cookies on the banner, or do not enter your details until you are ready to submit. You may also ask us to delete any such record at any time using the contact details in Section 20.

6.5 Visitor identifier

Where you accept cookies, we set a first-party cookie named inslab_vid containing a randomly generated identifier. It lets us recognise a returning browser and link the activity above into a single session history. It does not, by itself, identify you by name; if you later submit a form, that identifier may be associated with your enquiry.

7. How We Use Information

We use personal data for the following purposes, and not for unrelated purposes:

• To respond to your enquiry and contact you about the insurance or loan you asked about;
• To prepare quotes, compare products, and submit applications to insurers, banks, or NBFCs on your instruction;
• To assist with policy servicing, renewals, claims, and loan application follow-up;
• To assign your enquiry to an advisor, and to escalate it internally if it is not attended to within our service standards;
• To prioritise follow-up. We apply an internal score to enquiries based on the information provided and on-site activity, so that advisors attend to the most time-sensitive enquiries first. This score affects the order and speed of our follow-up only; it is not a credit assessment, and it does not determine whether any insurer or lender approves your application.
• To operate, secure, debug, and improve the Platform, and to measure which pages and campaigns are effective;
• To send service communications, and, where permitted, promotional communications, subject to Section 16;
• To comply with legal, regulatory, and audit obligations, and to establish, exercise, or defend legal claims;
• To detect, prevent, and investigate fraud, abuse, and security incidents.

8. Consent

Where the DPDP Act requires consent, we ask for it before processing, and our request identifies the personal data concerned and the purpose. Specifically:

• Submitting a form constitutes your consent for us to contact you and to share your application with the insurers or lenders needed to fulfil that request;
• Analytics and tracking described in Section 6 occur only if you accept cookies on the consent banner;
• Sensitive personal data is collected only for the specific product you have asked us to arrange.

You may withdraw consent at any time, and withdrawing it is as easy as giving it: email support@inslab.io, or clear this site's cookies to withdraw analytics consent. Withdrawal does not affect processing carried out before withdrawal. Where withdrawal prevents us from continuing a service (for example, an in-flight application), we will tell you.

9. Cookies and Tracking Technologies

On your first visit, a banner asks you to accept or decline non-essential cookies. Until you accept, we set no analytics cookie, load no third-party analytics, and record none of the activity in Section 6.

• Strictly necessary: a cookie recording your consent choice. Always set, because the site cannot honour your choice without it.
• First-party analytics: the inslab_vid identifier described in Section 6.5.
• Google Analytics 4: loaded only after you accept, to measure traffic and page performance.
• Microsoft Clarity: loaded only after you accept, providing aggregated heatmaps and session replay of on-page activity. Clarity is configured to mask text entered into form fields, so the content you type into forms is not captured by this tool.

We do not use these cookies for advertising, we do not run advertising or retargeting pixels on this Platform, and we do not sell your personal data. You can withdraw consent at any time by clearing this site's cookies or blocking cookies in your browser; some features may be affected.

10. AI Assistant

Our on-site assistant is powered by Google's Gemini model. The content of your messages, including any attached images, is transmitted to Google for processing in order to generate a reply. Conversations are stored on our systems so we can maintain context and improve the service, and are deleted in line with Section 13. Do not share identity documents, passwords, bank or card details, or health records with the assistant.

The assistant provides general information about our products and helps direct your enquiry. It supports our advisors rather than replacing them, and it does not make decisions about your insurance or loan application. Those decisions rest with the insurer or lender.

11. Sharing and Disclosure

We share personal data only as set out below. We do not sell personal data, and we do not share it with third parties for their own marketing.

11.1 Insurers, banks, and NBFCs

To obtain quotes and process the application you have asked us to make. These entities process your data as independent data fiduciaries under their own privacy policies.

11.2 Service providers

Providers who support the Platform under contract and on our instructions, including our database and hosting provider, analytics providers named in Section 9, our AI model provider named in Section 10, our customer relationship management system, and email and communication providers. They may process your data only for the purposes we specify.

11.3 Legal and regulatory disclosure

Where required by law, regulation, court order, or a lawful request from a government, regulatory, or law-enforcement authority, including IRDAI; or where necessary to investigate fraud, enforce our terms, or protect the rights and safety of any person.

11.4 Corporate transactions

In connection with a merger, acquisition, restructuring, or transfer of business, in which case the recipient remains bound by protections no less protective than this Policy, and we will notify you of any material change.

12. Cross-Border Transfers

Some of the service providers described above process data on infrastructure located outside India, in particular our hosting and database provider, the analytics providers named in Section 9, and the AI model provider named in Section 10. Where personal data is transferred outside India, we do so in accordance with Section 16 of the DPDP Act and any restrictions notified by the Central Government, and we require contractual safeguards obliging recipients to protect the data and to process it only on our instructions.

13. Data Retention

We keep personal data only for as long as the purpose requires, or as long as the law requires, whichever is longer:

• AI assistant conversations: automatically deleted after 90 days.
• Website analytics and partially completed forms: retained while they remain useful for follow-up and site improvement, and deleted on request.
• Enquiries and applications: retained for the duration of the relationship and thereafter for the period required by IRDAI regulations, tax, accounting, and limitation laws.

When a retention period ends, data is deleted or irreversibly anonymised.

14. Security

We maintain reasonable security safeguards appropriate to the risk, including encryption of data in transit using TLS, hashed storage of staff credentials, role-based access controls restricting advisor access to their own assigned enquiries, database-level access restrictions, rate limiting, and security headers on our services. We review access periodically and log administrative activity.

No system can be guaranteed completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act.

15. Your Rights

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed, and the identities of those with whom it has been shared;
• Correction, completion, and updating of inaccurate or incomplete data;
• Erasure of personal data, where we are not required to retain it by law or for a purpose you have consented to;
• Withdraw consent at any time, as described in Section 8;
• Nominate another individual to exercise your rights in the event of your death or incapacity;
• Grievance redressal, as set out in Section 20.

To exercise any right, email support@inslab.io. We may need to verify your identity before acting. We will respond within the timelines in Section 20. You are responsible for providing accurate information and for not impersonating another person when making a request.

16. Marketing Preferences

We distinguish between two kinds of message:

• Service communications relating to an enquiry, application, policy, or claim you have with us. These are necessary to deliver the service and continue for as long as the relationship does.
• Promotional communications about other products and offers. You can opt out at any time by emailing support@inslab.io, or by using the unsubscribe link in any marketing email. We will action opt-outs within 7 working days.

Our commercial communications are sent in accordance with the TCCCPR, 2018 and your registered preferences with your telecom provider. Opting out of promotional messages does not stop service communications about an active application or policy.

17. Children's Data

The Platform is not directed at children. We do not knowingly collect personal data of a child under 18 years of age without verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. Where a policy covers a child as a dependant, that data is provided by the parent or guardian arranging the cover. If you believe a child's data has been provided to us without proper consent, contact us and we will delete it.

18. External Links

The Platform links to third-party websites, including those of insurers and lenders. We do not control and are not responsible for their content, security, or privacy practices. Review their policies before submitting information to them.

19. Updates to This Policy

We may update this Policy to reflect changes in our practices or the law. The effective date at the top of this page shows when it was last revised. Where a change materially affects how we use your personal data, we will take reasonable steps to notify you. Continued use of the Platform after an update constitutes acceptance of the revised Policy.

20. Grievance Redressal

If you have a question, complaint, or concern about this Policy or how your personal data is handled, contact our Grievance Officer, who is also our Data Protection Officer for the purposes of the DPDP Act:

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

• We will acknowledge your complaint within 24 hours;
• We will resolve it within 15 days of receipt.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India established under the DPDP Act. Complaints relating specifically to insurance services may also be escalated to IRDAI through the Bima Bharosa portal, or to the Insurance Ombudsman for your jurisdiction. Complaints relating to a loan should be raised with the bank or NBFC concerned, and thereafter under the Reserve Bank of India's Integrated Ombudsman Scheme.

By using the Platform, you confirm that you have read and understood this Privacy Policy.