Privacy Policy

1. Introduction

1.1

This Privacy Policy (“Policy”) applies to Instaramp Fintech Private Limited, a company incorporated in India with Corporate Identity Number U66190KA2025PTC210950 (“Company”, “We”, “Us” or “Our”). The term “Company” includes its operators, partners, licensees, successors, subsidiaries and affiliates.

THIS POLICY IS A LEGAL AGREEMENT BETWEEN YOU, THE USER OF THE ONLINE PLATFORMS, AND US. WHEN YOU REGISTER YOUR ACCOUNT WITH US, OR OTHERWISE VISIT OR ACCESS THE ONLINE PLATFORMS, YOU GIVE US YOUR EXPRESS, SPECIFIC AND VOLUNTARY CONSENT TO USE, COLLECT, ACCESS, PROCESS, STORE, DISCLOSE, TRANSFER AND PROTECT YOUR PERSONAL DATA AS PER THIS POLICY AND FOR THE PURPOSES STATED IN IT.

YOU MAY BE REQUIRED TO AGREE TO THIS POLICY BY TICKING THE BOX NEXT TO THE WORDS “I AGREE WITH THE TERMS & CONDITIONS”. IF YOU DO NOT AGREE WITH THIS POLICY, DO NOT USE OR ACCESS THE ONLINE PLATFORMS. YOU MAY CHOOSE NOT TO GIVE YOUR CONSENT, OR WITHDRAW ANY CONSENT GIVEN EARLIER, BY TELLING US IN WRITING.

THIS POLICY MUST BE READ TOGETHER WITH THE TERMS OF SERVICE (“TERMS”) OF THE ONLINE PLATFORMS. CAPITALISED TERMS USED BUT NOT DEFINED IN THIS POLICY HAVE THE MEANINGS GIVEN TO THEM IN THE TERMS.

1.2

This Policy explains how the Company collects, processes, stores, shares and protects your personal and transactional information. It protects your personal and financial data from risks such as unauthorised access, breach or misuse. It also ensures that the Company meets its obligations under Indian law.

1.3

The Company operates the Instaramp on-ramp and off-ramp platform at www.instaramp.xyz. Whether you buy or sell Digital Assets through the Online Platforms, or you are a business that integrates the Company’s on-ramp and off-ramp APIs, we handle sensitive information, such as your identity and transaction details, with care.

2. Scope

2.1

This Policy applies to all persons who interact with the Company, including:

  1. Individual Users: persons who buy or sell Digital Assets through the Online Platforms;
  2. API Clients: businesses that use the Company’s APIs for conversions between fiat currency and Digital Assets;
  3. Employees: staff of the Company who manage and secure your data; and
  4. Third-Party Partners: entities, such as payment processors and KYC vendors, that support our operations.
2.2

This Policy covers all types of data that we process, including personal identification data, financial records and API usage logs.

3. Legal Framework

3.1

The Company processes Personal Data in compliance with the following laws and regulatory requirements of India:

  1. the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, which regulate the processing of personal data and set out your rights and our responsibilities;
  2. the Prevention of Money Laundering Act, 2002 (“PMLA”) and the rules made under it, which require anti-money laundering measures, including KYC and transaction reporting;
  3. the Information Technology Act, 2000 (“IT Act”) and the rules made under it, which set cyber security and breach response standards;
  4. the guidelines of the Financial Intelligence Unit – India (“FIU-IND”), including the AML & CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets (updated as on 08 January 2026), which require the Company, as a reporting entity, to collect specified information, monitor transactions, apply the Travel Rule and report suspicious activities; and
  5. the directions of the Reserve Bank of India (“RBI”), as applicable, on the security of fiat payment transactions.
3.2

This Policy aligns with these laws to protect your data and to maintain the integrity of our operations.

4. Definitions

4.1

“Data Protection Law” means any data protection, data security or privacy law, including the DPDP Act, the IT Act, the EU General Data Protection Regulation 2016/679 (“GDPR”) to the extent applicable, and any law that governs Personal Data, Sensitive Personal Data or Information, or information from outbound telephone calls, electronic mail, facsimile messages and any other communication-related data protection, data security or privacy law.

4.2

“Personal Data” means any personally identifiable information that relates to an identified or identifiable individual, including data that identifies an individual or that can be used to identify, locate, track or contact an individual. Personal Data includes directly identifiable information, such as name, identification number or unique job title, and indirectly identifiable information, such as date of birth, unique mobile or wearable device identifier, information that can be used to identify a household, telephone number, key-coded data or online identifiers such as IP addresses. It includes any data that is “personal data” under the DPDP Act, the GDPR or a similar term under any other Data Protection Law.

4.3

“Sensitive Personal Data or Information” means personal information of a person that consists of information that relates to:

  1. passwords;
  2. financial information, such as bank account, credit card, debit card or other payment instrument details;
  3. physical, physiological and mental health condition;
  4. sexual orientation;
  5. medical records and history;
  6. biometric information;
  7. any detail that relates to the above items and that is provided to us to provide the Services; and
  8. any information that relates to the above items and that we receive for processing, or that is stored or processed under a lawful contract or otherwise.

5. Legal Basis for Processing

5.1

We process your Personal Data on one of the following bases, depending on the purpose of the processing:

  1. it is necessary for the legitimate interests of the Company, without undue effect on your interests or fundamental rights and freedoms, to give you communications related to our Services, promotions, offers and events. You have a right to opt out of marketing messages through the unsubscribe link at the bottom of our marketing emails;
  2. it is necessary to take steps to enter into or perform an agreement with you for the Services that you request, or to carry out our obligations under such an agreement;
  3. it is essential to meet our legal or regulatory responsibilities, both within and outside India; or
  4. you have given your explicit and free consent, which we obtain from you from time to time.
5.2

We process your Personal Data lawfully, fairly and transparently. We collect it for specified, explicit and legitimate purposes that we share with you. Under the DPDP Act, each collection of Personal Data has a clear purpose, and we seek your consent where the law requires it.

5.3

Any information that you give us that is not required is voluntary. You are free to choose whether to give us the types of personal information that we request. If you choose not to share certain information, we may not be able to serve you as effectively or offer you all our Services.

6. Information We Collect

6.1

We collect only the information that we need to provide our Services and to comply with legal requirements.

6.2

Information you give us. You may need to give us your Personal Data, including Sensitive Personal Data or Information, when you create a User Account or during your use of the Online Platforms. You must give accurate information and update it when needed. We receive the following information directly from you:

  1. Identification details: full name as it appears in the PAN, date of birth, nationality, gender, photograph, and a selfie with liveness detection, which we use to register your valid profile on the Online Platforms and to verify that you are physically present at onboarding;
  2. National identifiers: your Permanent Account Number (PAN), and the type and number of a government-issued identity document, such as a passport, driving licence, proof of possession of Aadhaar number or voter’s identity card, which we use to match your identity with the profile that you create;
  3. Correspondence details: email address, phone number and postal address, which we use to communicate with you, resolve your queries and provide support services. If you take part in our surveys, you may also give us additional information on your own accord;
  4. Financial data: bank account details, permanent account number (PAN), credit or debit card number, transaction history, UPI details, tax identification details, and Digital Asset information, including wallet addresses, which we use to enable and execute transactions on the Online Platforms;
  5. Location data: the latitude and longitude of your location at onboarding, with the date, timestamp and IP address, which the FIU-IND guidelines require. We may also ask for your location data to provide certain Services, to enable certain features of the Online Platforms, or if we suspect a fraudulent transaction;
  6. Transaction information: information about your transactions on the Online Platforms, such as the name of the recipient, the Digital Asset wallet addresses, the transaction hash, your name, the amount and the timestamp, and the originator and beneficiary information that the Travel Rule requires;
  7. Employment, income and business information: occupation, income range, office location, job title, and description of the business or role; and
  8. Other information: any other information that you give us when you leave us a message, during customer support conversations or surveys, or to assist in matters related to law enforcement or investigations.
6.3

Information from API Clients. For business clients that use our APIs, we collect company Know Your Business (“KYB”) details, API key usage logs, and the transaction data of end-users that is processed through our APIs.

6.4

Information we collect automatically. We may collect the following information automatically during your association with us:

  1. Technical information: device ID, IMEI or equipment identification numbers, IMSI or subscriber identification, UUID, MAC address, operating system version, device details, network operator, Wi-Fi or data network connectivity, Internet Protocol (IP) address, login information and timestamps, browser details, time zone setting, browser plug-in types and versions, operating system and platform, and similar information;
  2. Access to apps and services: including messaging through SMS, storage data and device details;
  3. Information about your visit: the URL clickstream with timestamps, transactions executed or attempted by you, items that you view or search, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs), the methods used to browse away from a page, and any phone number used to call our support number;
  4. Fund transfer information: information about the fund transfer requests that you make when you access the Services, which you or a selected third party may provide;
  5. Metadata: technical data associated with the content that you submit, post or share on the Online Platforms, such as geolocation, date and attribution; and
  6. Cookies and tracking technology: the Online Platforms use cookies and tracking technology, including pixels, depending on the features offered. Third parties may also use such technology if you interact with their content through the Online Platforms. We try to identify these cookies before they are used, and to give you the choice to accept or deny them.

We process this information to make sure that the Services are in order, and to continuously monitor and update the Online Platforms and the Services.

6.5

Information from third parties. We may receive information about you from third parties if you have volunteered or consented to its sharing with us. We may combine and process such data internally for our Services. We also work closely with selected third parties, such as subcontractors, advertising networks, analytics providers, search information providers and infrastructure service providers (including cloud service providers), and we may receive information about you from them. We may also receive aggregated information from different browser types for analysis.

6.6

Correspondence. If you send us personal correspondence, such as emails or letters, or if other Users or third parties send us correspondence about your activities or postings on the Online Platforms, we may collect and store such information.

6.7

SMS access. To automatically input the transaction ID, reference or UTR number linked with your payment to the Company, we may need access to your SMS messages. We will seek your explicit consent before we read your SMS messages to extract the transaction ID, reference or UTR number. Our systems read only transactional SMS messages that contain the keyword of the partner entity name. If you choose to enter the transaction ID, reference or UTR number manually, you accept responsibility for any manual error that results in your payment not being matched to your transaction. We will not upload, publish or share your SMS data with any remote server, external advertising agency or third party, or upload it to our systems or servers.

7. How We Use Your Information

7.1

When you give consent under this Policy, you permit us to collect, use, copy, transmit, process, disclose, store and back up your Personal Data and Sensitive Personal Data or Information for the Services and for the other purposes in this Section. We are not responsible for the authenticity of any personal identification information, Personal Data, Sensitive Personal Data or Information, or other information that you supply to us or to any person who acts on our behalf.

7.2

We use your information for the following purposes:

  1. Identity verification: to create and register your User Account, maintain your records and profile details, authenticate such information, and complete KYC verification under the PMLA. KYC verification includes the verification of your tax identification details and other identification documents. We may ask you to validate such information by OTP, or have a third-party service provider authenticate and validate it, with your consent;
  2. Transaction processing: to facilitate On-Ramp and Off-Ramp transactions, fiat payments and receipts, and API-driven conversions, and to carry out our obligations under any contract between you and the Company;
  3. Regulatory compliance: to maintain records, to screen Users, wallets and transactions against sanctions lists, to apply the Travel Rule, and to report transactions to FIU-IND and other authorities as the law requires;
  4. Prevention of financial crime: to prevent and identify suspicious or illegal transactions, to mitigate risks related to money laundering and other illegal activities, and to discharge our other duties under applicable laws;
  5. Security: to enhance the security of the Online Platforms, and to detect and prevent unauthorised access or fraudulent activity;
  6. Personalisation: to personalise the content and Services offered to you;
  7. Communication: to inform you of promotions, offers, surveys, events, products and services that may interest you;
  8. Third-party services: to provide services to you, or to permit selected third parties to provide them to you; and
  9. Service improvement: to analyse usage patterns, on an anonymised basis, and to improve the Online Platforms.
7.3

If another company acquires or merges with the Company, we may transfer your Personal Data. In such an event, we will notify you and obtain your prior consent before your Personal Data is transferred and becomes subject to a different privacy policy.

8. Disclosure and Sharing of Your Information

8.1

You consent that we may disclose and share the information that we collect from you with other third parties, where you submitted such information to us directly, or where we received it from a third party based on your consent. We share your information with third parties who provide us with services that are essential for us to provide our Services to you.

8.2

We share data only when necessary, with:

  1. regulatory authorities, such as FIU-IND, RBI and tax authorities, as the PMLA or other laws require;
  2. third-party partners, such as KYC vendors, payment processors, blockchain analytics providers and Travel Rule solution providers, under strict confidentiality agreements that comply with the DPDP Act;
  3. other virtual digital asset service providers, the originator and beneficiary information that the Travel Rule requires, when you transfer Digital Assets to or from a wallet that they host; and
  4. courts and agencies, such as the Directorate of Enforcement, where the law requires.
8.3

We may need to disclose your Personal Data in the following cases:

  1. where applicable law requires, or to respond to orders, directions or processes of law enforcement agencies, the judiciary, government authorities, or persons or authorities that investigate (suspected) illegal activities;
  2. to detect and prevent potential or actual identity theft, fraud, money laundering, abuse of the Services and other illegal acts;
  3. to respond to claims that an advertisement, posting or other content violates the intellectual property rights of a third party; or
  4. to enforce or apply our Terms and other agreements, or to protect the rights, property or safety of the Company, our Users or others. This includes the exchange of information with third parties for fraud protection and KYC verification.

9. Service Providers

9.1

We may use a variety of third-party service providers to help us provide our Services, including:

  1. to authenticate your identification information and documents, and to process your payments;
  2. to check information against public databases;
  3. for fraud prevention and risk assessment;
  4. to provide Services through third-party platforms and software tools;
  5. to provide customer service and for marketing; and
  6. to process and handle claims.
9.2

Third-party service providers have limited access to your Personal Data, only to perform these tasks and as per our strict directions and policies.

10. Data Storage and Cross-Border Transfers

10.1

We store Sensitive Personal Data or Information on secure servers located in India.

10.2

To support our operations, the Company, or its affiliates or partners in other jurisdictions, may transfer your Personal Data to, and store it in, locations outside India (“Alternate Country”). We will do this only when the transfer is lawful, and only when it is needed to meet our contractual and statutory obligations. Only such Personal Data as applicable law permits will be transferred outside India. You confirm that you have noted this and you consent to it.

10.3

When we transfer your Personal Data from your Home Country (the country, state and city in which you are present) to an Alternate Country, we will comply with our legal and regulatory obligations for your Personal Data. This includes a lawful basis for the transfer and appropriate safeguards to ensure an adequate level of protection for your Personal Data. We will also ensure that the recipient in the Alternate Country must protect your Personal Data to a standard comparable to the protection under applicable laws.

10.4

Our lawful basis for such a transfer will be your consent or one of the safeguards that applicable law permits.

11. Data Security

11.1

We use appropriate technical and organisational measures to prevent unlawful access to, or accidental loss of, the information that we collect, including the measures that applicable laws prescribe. These measures include firewalls, encryption and disaster recovery plans. We store all information that you give us on secure servers.

11.2

Security audits. We conduct internal reviews and tests regularly to identify and address vulnerabilities. Independent cyber security firms assess our systems annually, including a cyber security audit by an auditor empanelled by the Indian Computer Emergency Response Team (“CERT-In”), as the FIU-IND guidelines require. These audits cover the Online Platforms, our APIs and our data systems. We may also submit to regular checks by third-party security evaluation specialists.

11.3

Access controls. The DPDP Act and the rules made under it require reasonable security safeguards, including control of access to Personal Data. For this reason, we use role-based access permissions. Our personnel can access only the Personal Data that they need to know. We limit API keys to specific functions, such as payment processing.

11.4

Audit trails. We preserve complete audit trails, including verification responses, timestamps and authentication logs, in a tamper-proof manner.

11.5

Transaction monitoring. We actively monitor transactions to detect suspicious activity. Automated systems flag anomalies, such as large unexplained transfers, for review. We report our findings to FIU-IND as Section 12 of the PMLA requires.

11.6

Your role. Do not share your password with anyone. Follow general internet etiquette when you operate your User Account. In public areas, take care and do not leave your computer or device unattended, especially while you are logged in to your User Account. We recommend that you use established malware and virus protection software and apps on your device.

11.7

If you post any of your Personal Data in public areas of the Online Platforms, others over whom we have no control may collect and use it.

11.8

Transmission through the internet is not completely secure. It is at your own risk. We will do our best to protect your Personal Data, but we cannot guarantee or give any warranty about it. We disclaim all liability for any breach of security, malicious attack, error, omission or commission concerning data transmitted through the Online Platforms, or that leads to a breach of User data or information.

11.9

Once we receive your Personal Data, we use strict procedures and security features to prevent unauthorised access to it, as far as is reasonably possible.

12. Personal Data Breach

12.1

If you suspect any misuse or loss of, or unauthorised access to, your personal information, tell us immediately at compliance@instaramp.xyz. We will investigate the matter and update you on the next steps as soon as possible.

12.2

We will report the theft or loss of Personal Data, and cyber security incidents, to CERT-In, the Data Protection Board of India, affected Users and other authorities, as the IT Act, the DPDP Act and other applicable laws require.

13. Data Retention

13.1

Despite anything in this Policy or the Terms, we retain the information and data that you give us for as long as your User Account is active, to resolve disputes, for investigations or ongoing prosecutions, in case of any suspicious or illegal transaction, to enforce any agreement, and as applicable laws require. The retention period may be extended as applicable law requires. It will be only for the period that is necessary for us to comply with the law and to provide our Services to you.

13.2

We retain KYC records and transaction records for the period that the PMLA, the Prevention of Money-laundering (Maintenance of Records) Rules, 2005 and the applicable FIU-IND guidelines prescribe, as set out in the AML Policy. At present, this is at least five (5) years after the business relationship ends for identity records, and at least five (5) years from the date of the transaction for transaction records. We keep records that relate to an ongoing investigation until the case is closed.

13.3

After the retention period ends, we securely delete or anonymise the data, as the DPDP Act requires. Some of your Personal Data may still exist in our systems for a period, for example while it waits to be overwritten. For our purposes, such data is put beyond use. This means that, while it still exists in electronic form, our employees will not have access to it or use it again. This is subject to retention to comply with applicable laws, resolve disputes, enforce this Policy and protect our rights.

13.4

We make no warranty and are not liable for the non-availability or non-retention of any information or data that you give us, after your User Account is deleted.

14. Children’s Personal Data

14.1

Unless otherwise indicated, you may use the Online Platforms and the Services only if you are over eighteen (18) years of age. We do not knowingly collect Personal Data from individuals under eighteen (18) years of age without the consent of their parents or legal guardians, or unless the parents or legal guardians give the information for use.

15. Cookies and Similar Technology

15.1

We may automatically track certain information about you based on your behaviour on the Online Platforms or while you access our Services. You agree that we may use such information for internal research on the demographics, interests and behaviour of our Users, to better understand, protect and serve our Users. We compile and analyse this information on an aggregated basis.

15.2

The Online Platforms use cookies to distinguish you from other Users. This helps us to give you a good experience when you browse the Online Platforms, and to improve the Online Platforms. When you continue to browse the Online Platforms, you agree to our use of cookies. A cookie is not linked to any personally identifiable information on the Online Platforms.

15.3

A cookie is a small file of letters and numbers that we store on your browser or on the hard drive of your computer or other device, if you agree. Cookies contain information that is transferred to the hard drive of your computer.

15.4

Third parties, such as advertising networks and providers of external services, may also use cookies, over which we have no control. These cookies are likely to be analytical, performance or targeting cookies.

15.5

We may use third-party web analytics services on the Online Platforms, such as Google Analytics and tools offered by Meta (Facebook) and LinkedIn. These services may use cookies, web server logs and web beacons to collect information and help us analyse how visitors use the Online Platforms. They may use the data that they collect to contextualise and personalise the marketing materials of their own advertising networks.

15.6

Google Analytics is a web analysis service of Google LLC (“Google”), provided under its policies at https://www.google.com/policies/privacy/partners/. You can prevent the collection and processing of data by Google through the Google Ads Settings page, or when you download and install its browser plug-in at https://tools.google.com/dlpage/gaoptout.

15.7

You can block cookies through the setting on your browser that allows you to refuse all or some cookies. If you block all cookies, including essential cookies, you may not be able to access all or parts of the Online Platforms or use our Services.

16. Third-Party Links

16.1

The Services and the Online Platforms may contain links to third-party applications or websites. When you click on one of these links, you enter another application or website over which we have no control and for which we bear no responsibility. We do not own or control these third-party applications or websites.

16.2

When you interact with them, you may give information directly to them, to us, or to both. Such a third-party application or website will often ask you to enter your Personal Data, and will use and collect your Personal Data as per its own privacy policy and standard practices. Use your own discretion in this regard. You agree that we are not liable for any breach of the privacy of your Personal Data, or any loss, that you incur from your use of these applications or websites.

17. Your Rights

17.1

Subject to applicable law, you have the following rights over the Personal Data that we hold:

  1. Right to access: to check whether we hold Personal Data about you, to access such data, and to request details of the data that we hold;
  2. Right to a copy: to ask for a copy of your Personal Data in a structured, commonly used and machine-readable format or, where possible, to ask us to send it to another data controller on your behalf;
  3. Right to correction: to require us to correct, as soon as reasonably practicable, any data about you that is inaccurate or incomplete, when you tell us in writing. To update KYC information, you may need to complete the KYC process again (“re-KYC”);
  4. Right to know our practices: to know our policies and practices in relation to the Personal Data that we hold;
  5. Right to object: to object to the use of your Personal Data where we use it (i) for our legitimate interests; (ii) to perform a task in the public interest or to exercise official authority;
    1. to send you direct marketing materials; or (iv) for scientific, historical, research or

    statistical purposes;

  6. Right to withdraw consent: to withdraw your consent where we process your Personal Data based on your consent;
  7. Right to erasure: to ask us to erase the Personal Data that we no longer need, subject to our legal retention obligations; and
  8. Right to grievance redressal: to raise a grievance with us and, if it is not resolved, with the Data Protection Board of India.
17.2

To exercise these rights, email us at compliance@instaramp.xyz. We will respond within thirty (30) days. We can handle most requests quickly, but complex requests may need more research and time. We may charge a reasonable fee to process any data access request.

17.3

The Company may retain all or some of your data as per its policies in force or applicable law. We may refuse or restrict a request for erasure or correction where the PMLA or another law requires us to keep the data.

17.4

Your rights do not extend to information about any report that we make to FIU-IND or another authority. The PMLA prohibits us from disclosing such information.

18. Right to Opt Out

18.1

We cannot use your Personal Data or Sensitive Personal Data or Information to give you access to the Online Platforms, or to process any application for our Services, without your consent. You give this consent when you do NOT tick the “Opt-out” box on the sign-up page or in the “Settings” section of the Online Platforms.

18.2

If you tick the “Opt-out” box, you tell us that you DO NOT want us to use your Personal Data for direct marketing, to send you direct marketing materials by phone, SMS, mail, email, fax or any other channel, or to give your Personal Data to any other person for use in advertising and marketing, whether or not such person is a member of the Company’s group.

18.3

The opt-out does not apply where you apply for, or will apply for, a Service that we provide jointly with a co-branding partner. In this case, the opt-out does not apply to the co-branding partner to whom you have consented, or will consent, to provide your Personal Data separately.

19. Non-Personal Information

19.1

Non-personal information is information that does not personally identify you. When you visit and interact with the Online Platforms, or with third parties with whom we have contracted to provide services, we may collect non-personal information, such as a list of the website pages that you visit, the domain name, the areas of the site that you visit and the URL, to enhance your online experience through an understanding of your web usage patterns.

19.2

We may use or disclose non-personal information for any purpose from time to time. For example, we may embed email addresses with images. Where we combine non-personal information with personal information, we treat the combined information as personal information under this Policy.

20. Our Data Protection Commitments

20.1

We will comply with all applicable Data Protection Laws and related standards in relation to your Personal Data, and we will ensure that no act or omission of ours causes a breach of them.

20.2

We limit the Personal Data that we collect or access to what is necessary to perform our obligations for the Services or to meet legal requirements. We will not share any Personal Data that we collect or hold with any third party for any reason, except as this Policy states.

20.3

Except as this Policy states, we may collect, use or analyse Personal Data only on an anonymised basis, and never in a way that can lead to or reveal your identity.

20.4

Do not include Sensitive Personal Data or Information in any email that you send to us. Do not send credit card or debit card numbers, or any other Sensitive Personal Data or Information, to us by email.

21. User and API Client Responsibilities

21.1

Prompt reporting. If you detect any unusual activity, such as a login that you do not recognise, tell us immediately at compliance@instaramp.xyz.

21.2

API key management. API Clients must limit API key permissions to the functions that they need, and must monitor API key usage regularly. Correct key management prevents misuse and protects the data of the API Client’s end-users.

22. Changes to this Policy

22.1

We may update this Policy from time to time when applicable law requires it or for business reasons, and we will give you notice of the update. We encourage you to review this Policy periodically for the latest information on our privacy practices. Your continued use of the Online Platforms is your agreement to this Policy and to any amendments to it.

23. Severability

23.1

If a court of competent jurisdiction holds any term or provision of this Policy to be invalid, void or unenforceable, the remaining terms and provisions of this Policy remain unaffected and in full force and effect.

24. Notices

24.1

We may give you any notice under any of our policies by email to the email address associated with your User Account. A notice that we give by email is effective when we send the email. You are responsible to keep your email address current.

24.2

To give us notice under any of our policies, contact us by email, overnight courier or registered mail at the address in Section 25. Notices to us must be sent with details to compliance@instaramp.xyz, or to any other email address that we notify to you by email or through the Online Platforms for this purpose.

24.3

A notice sent by overnight courier is effective one (1) business day after it is sent. A notice sent by registered mail is effective three (3) business days after it is sent.

25. Grievance Officer and Data Protection Officer

25.1

Send your grievances, feedback or questions about the collection, processing, use, disclosure or security of your information, or about any part of this Policy, and any request to exercise your data protection rights, in writing to:

Attention: Compliance OfficerInstaramp Fintech Private LimitedAddress: No. 120, K No. 311, Begur Hobli, Nyanappanahalli Village, Hulimavu, Bangalore South, Bengaluru, Karnataka, 560076, IndiaEmail: compliance@instaramp.xyz