Privacy policy

Last updated: 22 July 2026.

Who we are

IKAN Talent Mobility Pvt. Ltd. (“ikan”, “we”) operates ikan Residences. Under the DPDPA we act as a Data Fiduciary for the personal data described below. Our registered office is in Mumbai, India.

What we collect

• Identity & contact — name, email, phone, role (relocation manager, traveler, property partner).
• KYC & booking — passport, visa or Aadhaar (foreign nationals: passport + visa; residents: PAN + Aadhaar), employer details, dates, city, property choice. Required for FRRO/C-form filing and tenancy.
• Workplace and commute preferences — an office address you choose to provide and, only after you explicitly request a configured lookup, the resulting location pin used for distance matching.
• Aira interactions — chat messages and, when voice is used, live audio and generated transcripts. Used to run the conversation and audit any committed action. The standard voice flow does not record calls.
• Usage & security — pages visited, IP address, device type, action logs. Used for fraud prevention and platform reliability.
• Payment data — handled by our processors (Razorpay, Stripe). We never store full card numbers.

Why we collect it

• To confirm and run your booking, including FRRO and C-form compliance for foreign nationals.
• To operate Aira (the AI coordinator) — search, holds, quotes, after-care reminders.
• To communicate with you about your stay (email, SMS, in-app).
• To meet legal obligations under Indian tax law, the DPDPA, and tenancy regulations.
• To improve the platform via aggregated, non-identifying analytics.

Where we store and process it

• Primary database — managed Supabase Postgres in the configured AP-South (Mumbai) project; the infrastructure provider manages encryption at rest.
• Voice transport and compute — LiveKit routes live audio over its global edge; the Aira voice worker runs on Render in Singapore.
• AI and voice inference — configured Groq, Google, Anthropic, OpenAI, LiveKit, and Cartesia services may process the minimum conversation content needed for a requested AI or voice feature. The active provider depends on availability and configuration.
• Office-address lookup — when enabled and explicitly selected, the address is sent server-side to Mapbox permanent geocoding and the resulting pin is stored with the inquiry. Typing alone never triggers a lookup.
• Voice retention — the standard voice flow does not intentionally store call audio. Where voice transcripts are persisted, they are kept for up to 30 days. A contracted deployment that enables recording will disclose this before use and retain recordings for no more than 90 days.
• Audit logs — committed-action metadata is retained for up to 7 years where required for tax, security, and accountability records.
• Backups — provider-managed backups follow the configured infrastructure plan and the retention commitments in the applicable customer agreement.

Who we share it with

• RMC partners — only with explicit consent from the assignee, and only for their own assignees. Never aggregated across customers.
• Property partners — only the data needed to operate the stay (name, dates, KYC where legally required).
• Sub-processors and service providers — listed at /security with their role and whether use is core or feature-dependent. Contractual protections follow the applicable customer and provider agreements.
• Authorities — only when legally compelled (court order, FRRO filings).
• We never sell personal data or share it with advertising networks. ikan does not use personal data to train its own models; external AI providers process requests under their applicable API or enterprise terms and configured data controls.

Your rights under DPDPA

As a Data Principal you can:

• Access the personal data we hold about you.
• Correct or update inaccurate personal data.
• Erase personal data we no longer need (subject to statutory retention windows).
• Withdraw consent at any time for processing that relies on consent.
• Nominate a representative to exercise your rights in case of incapacity or death.
• Grieve directly to our grievance officer below, and escalate to the Data Protection Board of India if unresolved.

To exercise any right, email privacy@ikan-residences.com. We respond within 30 days.

Cookies & tracking

We use the minimum cookies required to keep you signed in, plus optional analytics you can decline. Full breakdown on the cookie policy.

Retention

• Active booking data — for the assignment plus 7 years (Indian tax/audit).
• Office addresses and saved location pins — the same retention period as the associated inquiry or booking.
• Persisted voice transcripts — up to 30 days. Standard voice calls are not recorded; optional contracted recordings are retained for no more than 90 days.
• Account data — until you ask us to delete it (and statutory retention is satisfied).
• Marketing preferences — until you change them.

Children

ikan Residences is a B2B platform. We do not knowingly collect personal data from anyone under 18. Where a child travels as a dependent on a corporate relocation, the booking is made and managed by the parent or guardian.

Changes to this policy

Material changes are notified by email and announced on the homepage at least 30 days before they take effect. The “Last updated” date above reflects the most recent version.

Privacy and grievance contact

You can submit a privacy request or grievance through the following channels:

• Email — privacy@ikan-residences.com.
• Post — use the registered address stated in your services agreement or ikan invoice.

Contact

General privacy questions: privacy@ikan-residences.com. Security disclosures: security@ikan-residences.com.