🏠

Home

🔍

Explore

📞

Contact

Legal & Policies

Privacy Policy

Your privacy and data protection are important to us.

Last Updated: October 30, 2026

On this page

In short

IndiLookup (https://indilookup.com/) is a local business directory that helps you find businesses near you and contact them. This Privacy Policy explains, in plain language, what personal information we collect, why we collect it, who can see it, how long we keep it, and the choices and rights you have. It applies to our website.

  • We ask for your name and mobile number only when you want to see a business's phone number, send an enquiry, or request a call back.
  • To see a business's phone number, you tick a consent box and we verify your mobile number with a one-time code (OTP) sent by SMS.
  • When you send an enquiry, we share it with businesses so they can contact you. We do not sell your personal information.
  • You can ask us to show, correct or delete your information by writing to support@indilookup.com.

1. Information We Collect

  • Name and mobile number: when you ask to see a business's phone number, send an enquiry, or request a call back.
  • Your enquiry: the business category and area you asked about, and the page you sent it from.
  • Account details, if you sign up: name, email address, mobile number and password. Passwords are stored only as a secure hash, never as plain text. New accounts verify the email address with a code, and the mobile number with an SMS code.
  • Business details that business owners add to their own listing.
  • Reviews: if you sign in with Google to write a review, Google shares your name, email address and profile picture with us.
  • Browser and usage information: the pages you visit (the full page address, including any campaign tags in the link), the website or campaign that brought you here, device type, screen size, language, time zone, browser type, and your IP address (used for security and to limit abuse).
  • Approximate area: only if you allow location access in your browser. Your browser sends its coordinates to OpenStreetMap's Nominatim service to find the area name; we keep only the area name, not the coordinates.
  • Location from your IP address: when you look for businesses near you without sharing your browser location, we send your IP address to ip-api.com to get an approximate location, and keep that IP address and location for 30 days so we do not have to ask again.
  • Business owners who buy a plan or a Google Ads package: name, email address, mobile number, business, chosen keywords and budget, and payment details from our payment provider. We do not see or store card numbers.

Where it comes from

Directly from you, from your browser, and from Google when you use Google sign-in for reviews.

2. Why We Use It

We use your information only for these purposes:

  • To show you a business's phone number after you verify your mobile number, and to remember this browser so you are not asked again on every business.
  • To pass your enquiry or call-back request to businesses, so they can contact you. How enquiries reach businesses is explained in our Lead Policy.
  • To run your account, reviews and listings.
  • To send business owners notifications about their enquiries in the app.
  • To prevent misuse: limits on how many codes and numbers can be requested, checks on suspicious enquiries, and security logs.
  • To understand how the website is used, with our own first-party visit records, so we can improve it.

3. Mobile Verification (OTP) and Your Consent

When you ask to see a business's phone number or send an enquiry, we ask for your name and mobile number and send a one-time code (OTP) by SMS. This confirms that a real person is asking and protects business owners from automated copying of their numbers.

  • We send a code only after you tick the consent box. We record that you agreed, the version of the consent text, and the time.
  • The SMS is sent through our SMS provider and may come from the provider's sender ID. When our own registered sender ID is approved, we will use it.
  • The SMS provider receives only your mobile number and the code.
  • We never show or send the code to anyone else, and we keep only a protected (hashed) form of it for a few minutes.
  • Verifying your number to see a business's phone number does not, by itself, send your details to that business.
  • If SMS is unavailable, your enquiry is still sent and marked as not verified.

Withdrawing your consent

You can withdraw your consent at any time: choose "No" or "Not you?" in the contact popup on this browser, or email us. After that we stop using your number to show you business numbers. Withdrawing does not undo what was done before, and enquiries already delivered to businesses stay with those businesses.

4. Who Can See Your Information

  • Businesses: when you send an enquiry or request a call back, we share your name, mobile number and what you asked for with businesses in that category, so they can contact you. Which businesses receive it, and how much each one sees, is explained in our Lead Policy.
  • Service providers who help us run the website, only for that work: our hosting provider, backup storage provider, SMS provider, email provider, image hosting provider, payment provider (Razorpay), ip-api.com (approximate location from an IP address), OpenStreetMap Nominatim (area name from browser location), and Google (sign-in for reviews, maps, and keyword research for Google Ads packages).
  • Authorities, when the law requires it.

We do not sell your personal information.

Some of these providers may store or process information on servers outside India.

5. Business Listings

Many listings on IndiLookup are built from publicly available business information. If you own a listed business, you can claim the listing, or ask us to correct or remove it, by writing to support@indilookup.com.

6. Cookies and Browser Storage

Our server sets two cookies. Both are first-party and HttpOnly (scripts on the page cannot read them) and are sent only over a secure connection:

  • il_vid (about 395 days): a random browser id that recognises your browser between visits.
  • il_cs(up to 400 days, renewed when you use it): set after you verify your mobile number, so this browser can see business numbers without a new code. It holds only a random code, not your name or number. Choosing "No" or "Not you?" in the popup ends it.

The website also keeps some items in your browser's own storage: visitor_id (the same browser id), visitor_session_id (the current visit, cleared when the tab closes), il_name_confirmed_at (when you last confirmed your name in the popup; no name is stored), il_policy_notice_dismissed (that you closed the "policy updated" notice), your login token and user id if you sign in, and page caches and drafts that make the website faster.

Your browser settings

You can clear cookies and site data at any time in your browser. You will then be asked to verify your mobile number again to see business numbers.

7. How Long We Keep It

  • A remembered browser (il_cs): up to 400 days after it was last used. At most 5 browsers are remembered per mobile number; a 6th replaces the oldest.
  • Which business numbers were viewed from a verified number: 7 days.
  • Detailed page-view events: deleted after about 180 days.
  • Location looked up from an IP address: 30 days.
  • The one-time code: a few minutes, and it works only once.
  • Account details: while your account exists.
  • Enquiries already delivered to businesses stay with those businesses.
  • A short summary of each browser id (first and last visit, recent pages, how it arrived), its visit sessions, and our customer record that links your name, mobile number and email (if you gave one) from your enquiries or verification: these do not yet have an automatic deletion period. We are working on automatic deletion; until then we delete them when you ask us.
  • Backups: our database is backed up every day. Deleted information can remain in backups for up to about 5 weeks, until those backups are replaced.

8. Advertising and Campaign Measurement

  • When we promote IndiLookup, we use campaign links. If you arrive through one, your visit record notes which campaign brought you, and an enquiry you send from that visit carries the same campaign code. Other tags in the link, such as utm_ tags, are stored as part of the page address.
  • We use this only to count visits, enquiries and spending per campaign. Only IndiLookup's admin staff see these reports.
  • Our website has no third-party analytics or advertising cookies, pixels or tags, and we do not share your visit records with advertising networks.
  • Business owners can buy a Google Ads package from us. To plan it we look up keyword data from Google; this sends keywords and a location, not visitors' personal information.

9. Data Security

  • HTTPS on every page.
  • Names and mobile numbers from enquiries and from the contact popup are stored encrypted.
  • Remembered-browser codes and one-time codes are stored only in hashed form.
  • Limits on code requests and number views to stop misuse.
  • Admin tools need a separate staff login, and staff sign-ins are logged.
  • Our database is backed up every day.

If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

10. Your Rights and Choices

You can ask us to:

  • tell you what personal information we hold about you and how we use it, and who we have shared it with;
  • give you a copy of it;
  • correct, complete or update it;
  • delete it (some information we may have to keep where the law requires, and enquiries already delivered to businesses stay with them);
  • withdraw your consent (see section 3);
  • let someone you nominate use these rights for you if you cannot.

How to ask: email support@indilookup.com from the email address on your account, or tell us the mobile number the request is about; we may send a code to that number to confirm it is you. We will reply within 30 days.

If you are not satisfied with our reply, you can complain to the Data Protection Board of India.

11. Children

IndiLookup is meant for adults (18 years and above). We do not knowingly collect personal information from children. If you believe a child has given us personal information, email us and we will delete it.

12. Changes and New Features

When we change this policy, we update this page and the "Last Updated" date above. Before we start any new feature that uses personal information in a new way, we will update this policy first and, where the law requires it, ask for your consent.

Planned features (not live today)

These do not happen today. Before any of them starts, we will update this policy and, where needed, the popup:

  • Seeing a business's phone number may, in future, also send your name and mobile number to businesses in that category as an enquiry.
  • One-time codes may, in future, also be sent on WhatsApp.
  • We may add an automatic bot check (from a bot-check provider) to the contact popup.
  • Business owners may choose (opt in) to receive a daily summary of their enquiries by email; every such email will have an unsubscribe link.
  • We may send business owners emails about claiming their listing, and send marketing emails.
  • We may advertise with partners such as Google Ads and measure how those campaigns perform. If that needs any new data, cookies or tags not described here, we will update this policy before we start and, where the law requires it, ask for your consent.
  • A "Remove my details" button on the website.

Business listings may link to other websites, WhatsApp and Google Maps. Their own privacy policies apply there.

14. Contact Us

For any question, request or complaint about your privacy, contact us: