What they may do · DPDP §6(4)
What IndianOil ONE does with your data
IOCL's online policy says cookies and web beacons feed interest-based ads, that the data it covers includes Aadhaar-linked biometric information, and that it may pass your details to its dealers, distributors and other third parties.
-
Shares your data with partners
Passed to group companies, advertisers or analytics firms you never chose.
What this costs you. Your number and habits travel to companies you have never heard of and never agreed to. This is the step where the spam calls start.
Show me where they say that
IndianOil ONE’s own policy says “IOCL may disclose the Information to any of its Agents or Third Parties insofar as reasonably necessary for the purposes set out in this Policy and for the purpose of providing services/products to the Data Subject.”
Our summary information may be disclosed to IOCL's Agents — defined in the policy as including its distributors, dealers, CFA and contractors — and to Third Parties, and additionally where required by law or to Governmental Agencies.
-
Builds an advertising profile of you
They watch what you view, tap and buy, and use it to decide which ads you see.
What this costs you. Your attention gets priced. What you hesitate over becomes a bid — and a profile built to predict you is a profile built to persuade you.
Show me where they say that
IndianOil ONE’s own policy says “Because cookies and web beacons are the technology, generally driving collection of browsing information, the Data Subject can block cookies to control data collection related to interest-based advertising. This can be typically done through web-browser used to visit the IOCL Websites. Preventing the browser from accepting cookies prevents the collection of the browsing information for purposes of delivering interest-based ads.”
Our summary browsing behaviour collected through cookies and web beacons is used for interest-based advertising, and the only opt-out offered is blocking cookies in the browser.
-
Processes your face or other biometrics
Face matching, liveness checks or similar.
What this costs you. You can change a leaked password in a minute. You cannot change your face. A biometric breach is permanent in a way nothing else is.
Show me where they say that
IndianOil ONE’s own policy says “Such Information includes, interalia, Sensitive Personal Data or Information as defined under the Indian Information Technology Act, 2000 and the Aadhaar number and/or the biometric information associated with an Aadhaar number.”
Our summary the definition of the 'Information' this policy governs expressly includes the Aadhaar number and the biometric information associated with an Aadhaar number; the policy states it was prepared under the Aadhaar Act 2016 as well as the IT Act 2000.
What the policy does not mention
These are uses IndianOil ONE’s policy is silent on. Silence is not a promise — it means the document does not say, and we do not infer either way.
- Follows you onto other websites and apps
- Keeps your records long-term
- Trains AI models on your content
IndianOil ONE is one app. How many are on your phone?
Most people carry twenty to forty. Add yours and see the total in one screen — how many share your data, profile you for ads, or follow you across the web. Then take it back from all of them at once.
Manage my data with Saaph.in →Free to check · no account needed · built in India for the DPDP Act
Questions
What does IndianOil ONE do with my personal data?
According to IndianOil ONE's own privacy policy, read on 2026-08-14, it discloses 3 of the six uses we track: shares your data with partners, builds an advertising profile of you, processes your face or other biometrics.
Can I withdraw my consent from IndianOil ONE?
Section 6(4) of India's Digital Personal Data Protection Act 2023 gives you the right to withdraw consent for processing you agreed to. The Act's substantive provisions commence in stages up to May 2027, so a request made now asks for voluntary compliance and puts the date on record. Processing a company carries out under a legal obligation — such as KYC records the RBI requires — cannot be withdrawn.
Does IndianOil ONE track me for advertising?
Yes — IndianOil ONE's published policy discloses this. The exact sentence it is based on is quoted on this page, with the date we read it and a link to the source.
Every use above is one IndianOil ONE declared in its own published privacy policy, which we
read on 2026-08-14. Quotes are verbatim; the summary beside each one is ours
and is labelled as ours. Nothing here is inferred.
Saaph.in is a DPDP consent and request management platform operated by Ronin Works
Private Limited. It is a communication facilitator, not your legal or authorised
representative. The DPDP Act 2023 commences in stages up to May 2027, so a request
made today asks for voluntary compliance and records the date you asked.
Our privacy policy