Privacy Policy

Who this Policy covers

1.1 This Policy covers visitors, Clients, Freelancers, Agency representatives, authorised organisation users, support contacts, and other individuals whose personal data Independ processes in connection with its services.

1.2 Independ's ordinary account and Project service is intended for adults aged 18 or older. A person who is not legally capable of using the service must not create an account or enter a Project Contract.

1.3 A company, Client, Freelancer, or Agency that uploads another person's data remains responsible for having a lawful reason and appropriate authority to provide it. The person should receive any notice required for that disclosure.

1.4 The India-only launch covers Indian users, INR Projects, the main platform, Community Projects below INR 5,000, and the additional support route for Projects above INR 10 lakh.

Personal data we collect

2.1 Account and contact data. Name, email address, mobile number, account role, organisation, location, login and recovery records, communication preferences, and verified contact changes.

2.2 Identity and eligibility data. Date-of-birth or adult-status confirmation, identity-verification result, PAN status, address information, photograph or liveness result where used, sanctions or fraud-screening result, and other information needed to confirm eligibility. Independ ordinarily stores the verified legal name, verification status, masked identifier, verification reference, GSTIN or Udyam verification result where applicable, and relevant fraud or eligibility results. The user enters or uploads the underlying PAN, GSTIN, Udyam, identity document, photograph, or liveness material through the designated verification flow. Independ does not ordinarily retain an unmasked PAN, Aadhaar number, original identity-document image, or raw liveness recording after verification unless a separate notice identifies a legal, security, fraud, or Dispute reason for doing so.

2.3 Business and authority data. Legal entity name and type, CIN or registration information, GSTIN and GST status, Udyam information, registered or business address, authorised-signatory information, company email verification, Agency point-of-contact information, and evidence that a person may act for an organisation.

2.4 Freelancer and Agency data. Profile information, skills, service categories, work history, portfolio material, contribution and ownership disclosures, availability, proposal information, bidding and withdrawal history, Portfolio Reviewed application and outcome, team roster where applicable, and Project-capacity status.

2.5 Client and Project data. Project brief, intended use, scope, budget, milestones, dependencies, acceptance criteria, tools, security needs, files, instructions, references, selected Freelancer, proposal comparisons, negotiation records, and Project status.

2.6 Contract and Project-performance data. Accepted Terms and Project Contracts, acceptance evidence, Change Requests, contract versions, timestamps, submissions, review requests, revision requests, acceptance or rejection records, handover records, status updates, Project closure, and warranty or cure information where applicable.

2.7 Communications and collaboration data. Platform chat, Project Workspace records, support messages, email records, meeting references and notes, and information confirmed from approved external tools. Independ does not ordinarily require telephone-number sharing in the main-platform flow.

2.8 Community Project data. The original Project form, Community Project ID, internal operations register, community brief, Google Form application, applicant-comparison sheet, verified email communication, WhatsApp coordination records reported to Independ, contracts, payment status, material scope or change records, acceptance, refund, subcontract-payment, and Dispute records. A public community brief should exclude unnecessary Client identity, direct contact details, confidential information, and personal data.

2.9 Payment, bank, invoice, and tax data. Client payment amount and status, transaction reference, payment method category, invoice and receipt information, refund information, Freelancer or Agency invoice or bill, verified bank-account details, payout status, TDS or other withholding information, PAN, GST and place-of-supply information, Udyam status, reconciliation records, and accounting records. Card, UPI, or bank credentials entered directly with a payment provider are governed by that provider's checkout process. The payment flow operates as follows: Client checkout is processed through Razorpay. Independ receives the Razorpay order and payment identifiers, payment amount, payment status, payment-method category, payer information made available through the transaction, timestamps, refund status, and settlement references. Independ does not receive or store the Client's complete card number, CVV, UPI PIN, internet-banking password, or other authentication credentials. Freelancer and Agency payouts are processed through Independ's Axis Bank current account, and Independ retains verified beneficiary details, payment instructions, UTRs, and reconciliation records.

2.10 Alerts, Disputes, reports, and grievance data. Allegations, responses, evidence, files, metadata, timestamps, technical and access logs, payment records, specialist material, reviewer notes, findings, financial calculations, appeal records, account action, and communications with a complainant or authority.

2.11 Technical, usage, and security data. IP address, device and browser information, operating system, session identifiers, login and activity timestamps, feature interactions, error logs, security events, fraud signals, account-linkage signals, and cookie or similar-technology data described in section 10.

2.12 AI-assistance data. Inputs, outputs, edits, structured fields, safety flags, and related context used for AI-assisted briefs, proposals, comparisons, negotiation, scope clarity, moderation, risk detection, summaries, or support. Independ currently uses OpenAI's API and the GPT-4o model family. Where needed to provide an AI-assisted function, Independ may send the complete relevant chat or Project conversation, rather than only selected structured fields. The production integration is configured so that OpenAI does not use API data to train its models and does not retain the request content under the data-control setting selected by Independ. OpenAI acts as Independ's processor or subprocessor and may process data outside India under its service architecture and applicable contractual data controls. The same content may separately remain in the user's Project, chat, support, security, or audit records where this Policy permits Independ to retain it.

2.13 Support and feedback data. Support request, complaint, survey, review, feedback, marketing preference, and the information needed to investigate or respond.

2.14 Independ does not ask users to put passwords, OTPs, API keys, recovery codes, production credentials, health information, biometric datasets, children's data, or unnecessary financial or identity documents in ordinary chat, Project files, email, or AI tools.

Where the data comes from

3.1 We collect data directly from the person when they visit, register, complete a field, upload a file, communicate, sign, pay, submit work, request support, or exercise a right.

3.2 We may receive data from an organisation, Client, Freelancer, Agency, authorised representative, team member, reference provider, or another user involved in a Project.

3.3 We may receive verification results and transaction information from identity, business, tax, bank, payment, security, communication, hosting, or support providers.

3.4 We may use information from lawful public records, official registries, sanctions sources, professional websites, or information the individual or an authorised person has made available for the relevant purpose.

3.5 Independ may create operational information such as a Project status, risk flag, comparison, support note, acceptance record, payment reconciliation, or Dispute finding. A flag or automated signal alone is not proof of wrongdoing.

Why we process personal data

4.1 Provide accounts and services. We use data to create and secure accounts, confirm eligibility and authority, show relevant profiles and Projects, operate proposals and negotiation, prepare Project Contracts, confirm kickoff, support delivery, process review and acceptance, and maintain Project records.

4.2 Operate managed Projects. We use data to supply the Client-facing service, engage and manage subcontractors, coordinate Project performance, process Change Requests, support Community Projects, and provide the additional coordination route for high-value Projects.

4.3 Process payments and records. We use data to request and reconcile Client payments, verify payout accounts, settle subcontract amounts, issue invoices and other documents, process refunds, handle withholding evidence, and meet accounting, tax, audit, and recordkeeping duties.

4.4 Provide support and remedies. We use data to answer questions, send reminders, handle mistaken acceptance, investigate an Alert, freeze and review a formal Dispute, value work, decide refunds or adjustments, consider an appeal, and handle a formal grievance.

4.5 Protect users and Independ. We use limited data to prevent account takeover, fraud, collusion, circumvention, unlawful work, malware, sanctions exposure, payment abuse, evidence destruction, harassment, and other prohibited conduct.

4.6 Improve reliability. We may use appropriately limited operational data to diagnose errors, measure service performance, improve workflow, maintain security, and test product changes. Private Project content is not used for general model training by default.

4.7 Communicate. We send essential verification, security, Project, payment, support, policy, and legal communications. We send marketing only through the channels and choices described at collection and in section 11.

4.8 Comply with law and defend claims. We process data to respond to lawful authority requests, preserve legal rights and evidence, investigate claims, enforce contracts, and comply with applicable legal, regulatory, tax, labour, payment, and consumer-protection duties.

Legal grounds and user choice

5.1 We process personal data for a lawful purpose and rely on consent or another permitted ground available under applicable law. The ground depends on the information, purpose, relationship, and provisions then in force.

5.2 Where we ask for consent, the request should identify the relevant data and purpose in clear language. A person may withdraw consent through the relevant control under Settings > Privacy, the unsubscribe or opt-out control shown with an email to support@xlancr.com with comparable ease, subject to lawful processing already completed and records that Independ must retain.

5.3 Some information is necessary to provide the requested account or Project service. If a person does not provide required identity, authority, tax, payment, security, or Project information, Independ may be unable to verify the account, publish a Project, accept a proposal, form a Project Contract, process a payment or payout, or provide another requested function.

5.4 Optional marketing, optional analytics, optional AI processing, and any materially different model-training use require the notice and choice applicable to that feature. Refusing an optional purpose does not remove access to an unrelated core service.

5.5 A user may opt out of non-essential AI processing where the feature is not required for the requested service. Independ will explain any resulting feature limitation.

AI and automated checks

6.1 Independ may use AI to assist Project posting, proposal drafting, comparison, negotiation, scope clarity, summaries, support, moderation, risk detection, and other disclosed workflow functions.

6.2 Users remain responsible for reviewing and affirmatively submitting every Project, proposal, negotiation term, Change Request, milestone, acceptance, and other binding decision.

6.3 AI output does not sign a contract, approve a Change Request, submit work, accept a milestone, issue a refund, decide a Dispute, or permanently terminate an account by itself.

6.4 Automated and keyword checks may flag prohibited, restricted, unsafe, deceptive, or suspicious material for review. Independ makes the final posting or material account decision after appropriate human review.

6.5 A material suspension, payout restriction, fraud finding, or Dispute decision will not rely solely on an unexplained automated output. Independ considers available evidence, context, urgency, possible error, and the user's response where reasonably possible.

6.6 Private Project content is not used for general model training by default. A materially different training use requires separate clear disclosure, an applicable lawful basis, and a separate choice where required.

Who receives personal data

7.1 Other Project participants. A Client may see the relevant Freelancer or Agency profile, portfolio, proposal, Project communications, submissions, and performance records. The selected supplier may see the Client's brief and information needed to perform. The Client does not receive Independ's private Subcontract Price, and the supplier does not receive Independ's private Client Service Price or margin.

7.2 Community participants. A Community announcement receives only the limited Project information needed to invite applications. Applicants use the designated form. The Client receives an applicant comparison without unnecessary direct contact details. Direct WhatsApp coordination begins only after both Project Contracts are accepted and the required 50 percent advance is received.

7.3 Agency personnel. The verified Agency point of contact operates the Agency account. The Agency is responsible for lawful internal access by its authorised employees or contractors and for binding them to appropriate confidentiality, IP, and security duties.

7.4 Independ personnel. Authorised personnel may access data only for assigned service delivery, support, safety, fraud, payment, accounting, Dispute, security, legal, or compliance purposes. Material staff actions should be logged.

7.5 Service providers. We may use providers for identity and business verification, payments, banking, hosting, storage, email, communication, support, security, analytics, electronic acceptance, document generation, and AI assistance. They receive information needed for their function under applicable contractual and legal controls. The providers currently used are: Razorpay for Client checkout, payment status, refunds, and related transaction records in India; Axis Bank for the company current account, settlements, and Freelancer or Agency payouts in India; Hostinger for platform hosting, databases, file storage, and backups on Indian servers; PaySprint, as a third-party service provider, for PAN, GSTIN, and bank-account verification in India; Google Workspace for Gmail, Forms, Sheets, Drive, document handling, and Google Meet; WhatsApp and Meta for Community Project announcements and permitted post-contract coordination; OpenAI for AI-assisted posting, proposals, negotiation, moderation, summaries, and support; Google Analytics and PostHog for usage and product analytics; and Sentry for error and performance monitoring. Google provides the email service. Independ has not deployed a separate electronic-signing provider; electronic acceptance is recorded through the platform and related communication records. Google, Meta, OpenAI, PostHog, and Sentry may process data outside India under their applicable service architecture.

7.6 Professional advisers and authorities. We may disclose relevant information to auditors, accountants, legal advisers, insurers, banks, payment providers, regulators, courts, police, tax authorities, or another competent authority where reasonably necessary and lawful.

7.7 Corporate events. Information may be reviewed or transferred as part of a genuine financing, investment, merger, reorganisation, acquisition, or sale, subject to confidentiality, due diligence, notice, and legal requirements.

7.8 We do not sell private Project files, identity records, tax records, or payment information as an advertising product.

Data location and cross-border processing

8.1 Independ's platform hosting, databases, files, and backups are hosted through Hostinger on Indian servers. Razorpay, Axis Bank, and PaySprint process the payment, banking, or verification functions described in this Policy in India. Google Workspace, Google Analytics, WhatsApp and Meta, OpenAI, PostHog, and Sentry may process or support data outside India under their applicable service architecture. Independ records each production provider's purpose, processing location, transfer terms, retention setting, and access controls in its internal provider register. Current location information is available on request through the Privacy Contact.

8.2 Where data is processed outside India, Independ will use the contractual, security, notice, and other measures required by applicable law and any government restriction then in force.

8.3 A third-party service chosen or used by a user, such as WhatsApp, Google Meet, GitHub, a repository, a cloud tool, or a credential manager, may process data under its own privacy notice and locations. Independ remains responsible for its own processing and for its processors to the extent required by law.

How long we keep data

9.1 Signed Terms, Project Contracts, payment and payout records, invoices, tax documents, refund records, acceptance records, and final Dispute decisions are ordinarily retained for eight financial years or a longer mandatory or legal-hold period.

9.2 Final deliverables remain available through Independ for 12 months after Project closure. Intermediate drafts and large working files remain available for 90 days after closure.

9.3 Ordinary Project chat and activity records are ordinarily retained for three years after Project closure. Dispute and IP evidence is ordinarily retained for three years after final decision or longer under a legal hold.

9.4 Account and verification data is retained while needed for the account, Project, security, fraud, tax, legal, and audit purposes described here. Independ ordinarily retains the verification result, masked identifier, provider reference, and relevant risk result while the account is active and for three years after account closure. PAN, GST, Udyam, invoice, withholding, and other information forming part of tax or financial records is retained for eight financial years. Independ does not ordinarily retain raw identity-document images or liveness recordings after verification and requires the verification flow to delete that raw material within 30 days unless a shorter provider period applies or a documented legal, fraud, security, or Dispute hold requires longer preservation.

9.5 Where the product supports the record type, Independ ordinarily sends file-expiry reminders 30 days and 7 days before scheduled deletion.

9.6 A legal hold, investigation, tax proceeding, payment claim, chargeback, security incident, regulator request, or unresolved Dispute may pause deletion of relevant records. Access should be restricted to the people and purpose requiring preservation.

9.7 Backup copies and provider systems may take additional time to cycle out securely. Independ's ordinary target is to remove deleted data from active systems promptly and allow encrypted backup copies to cycle out within 90 days. A provider may apply a shorter cycle or a longer mandatory preservation period disclosed in its service terms. Data under a lawful legal, fraud, security, tax, audit, or Dispute hold remains restricted until that hold ends.

9.8 These periods are ordinary operational periods. They do not authorise indefinite retention of unnecessary data or guarantee that every user file will remain available for the full period. Users should export applicable deliverables and records before their access period ends.

Cookies and similar technologies

10.1 Essential cookies or local storage may keep a person signed in, secure a session, remember a necessary preference, balance traffic, or prevent fraud. Disabling them may prevent the service from working.

10.2 Optional analytics, advertising, or similar technology will be used only with the notice and choice required for that purpose. Independ uses essential cookies or local storage for sign-in, session security, fraud prevention, load balancing, and essential preferences. It uses Google Analytics for website and usage analytics, PostHog for product and feature analytics, and Sentry for error and performance monitoring. Depending on the deployed configuration, those services may receive online identifiers, IP-derived information, device and browser details, page or feature events, approximate location, diagnostics, and relevant error context. Non-essential analytics will be activated only after the notice and choice required by law. The live cookie or privacy control identifies the active technology and allows a user to reject or withdraw optional analytics. Exact cookie names and configured durations are shown in that live control.

10.3 Browser controls may remove or block some technologies. The live product must also provide any consent-management or withdrawal control promised in this Policy.

Communications and marketing

11.1 Essential service messages include account, verification, Project, contract, payment, security, support, policy, and legal communications. A user cannot opt out of an essential message while using the related service.

11.2 Marketing messages, if used, follow the preference and unsubscribe route shown at collection. Independ may send permitted product, community, Project, or promotional messages by email or WhatsApp. A person may use the unsubscribe link in an email, reply STOP or request removal on WhatsApp, change an available account preference, or use the in-platform support flow. Independ records the choice and stops the relevant non-essential channel within a reasonable operational period.

11.3 Withdrawing a marketing choice does not affect essential service messages or lawful records already created.

Security and personal-data breaches

12.1 Independ uses access controls, authentication, logging, least-privilege access, vendor controls, backups, monitoring, and other safeguards appropriate to the nature and risk of the data. No system or transmission method is completely secure.

12.2 Users must protect their account, device, email, and authentication information; must not share account credentials; and must report suspected compromise promptly through the in-platform support flow or support@xlancr.com with the subject 'URGENT SECURITY OR DATA INCIDENT'.

12.3 Independ does not provide an in-platform credential-sharing function at launch. Users must use a suitable external credential manager or access-management method, provide only minimum necessary access, and revoke or rotate access when the need ends or risk arises.

12.4 If a personal-data breach occurs, Independ will investigate, contain, document, remediate, and provide notices to affected individuals and the Data Protection Board or another authority where and when applicable law requires.

12.5 A person reporting an incident should preserve relevant evidence, avoid spreading the data, and cooperate with reasonable containment steps.

Your rights and requests

13.1 Subject to applicable law and the relevant provisions being in force, a person may request information about personal data being processed, correction of inaccurate or misleading data, completion of incomplete data, updating of changed data, and erasure where retention is no longer required.

13.2 A person may withdraw consent, change optional communication choices, request account closure, raise a privacy grievance, and nominate another individual to exercise applicable rights in the event of death or incapacity where the law provides that right.

13.3 Requests may be submitted through the in-platform support flow or an email to support@xlancr.com with the subject 'PRIVACY REQUEST'. We may verify identity, authority, and request scope before revealing, correcting, exporting, or deleting data.

13.4 Account closure does not automatically erase unresolved Projects, contracts, payments, payouts, refunds, Disputes, tax duties, fraud controls, legal holds, or records that Independ must or may lawfully retain. We will explain a material refusal or limitation where permitted.

13.5 Withdrawing consent does not undo lawful processing already completed. It may stop a function that cannot operate without the relevant data.

13.6 A person must provide authentic information when exercising a right and should first use the available grievance process before escalating where applicable law requires that sequence.

Privacy grievances and other complaint routes

14.1 Submit a privacy question, request, or grievance through the in-platform support flow or support@xlancr.com with the subject 'PRIVACY GRIEVANCE'. The support ticket or email thread acts as the tracking record.

14.2 A privacy grievance is different from ordinary support, a Project Alert, a formal Project Dispute, and a consumer grievance against Independ. The Legal and Grievance Information page explains the available routes.

14.3 Independ will respond within the period required by the applicable law and the published grievance process. A person may use the Data Protection Board or another competent forum when legally available and after any mandatory internal step.

14.4 A consumer may submit a statutory grievance directly without first using an Alert or Project Dispute. We acknowledge consumer grievances within 48 hours and ordinarily redress them within one month, subject to applicable law.

Changes to this Policy

15.1 We will identify the version and effective date of this Policy. We will give reasonable notice of a material change through the platform, registered email, or another suitable channel.

15.2 A material new purpose that requires fresh consent will not be introduced merely by editing this page. We will provide the required notice and choice before that processing begins.

15.3 A previous version may remain available where needed to show what applied at an earlier time.