Privacy Policy

Canvass

This Privacy Policy explains how Inaiya Vanigam Private Limited (“Canvass”, “we”, “us” or “our”) collects, uses, shares and protects your personal data when you use the Canvass platform, visit our website, or join a Canvass panel. Canvass and 1990 Research Labs are brand names of Inaiya Vanigam Private Limited.

Canvass is a research platform. We onboard participants, send surveys, and invite people to conversations (including calls of about 60 minutes) so that we and our research clients can understand people’s lives, experiences and opinions.

This Policy is meant to be read with our Terms and Conditions. It is a notice under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”).

Effective date: 12 November 2026

1. Who we are

The Data Fiduciary responsible for your personal data is Inaiya Vanigam Private Limited, a company incorporated under the Companies Act, 2013. Canvass and 1990 Research Labs are brand names of this company.

Legal entity: Inaiya Vanigam Private Limited
CIN: U46901KA2024PTC191348
GSTIN: 29AAHCI7813D1ZI
Registered office: #74, 15th Cross, JP Nagar, III Phase, Bangalore 560078, Karnataka, India
Contact: dharmesh@1990labs.com, or WhatsApp at +91 93805 86748

2. Research purpose

We use the Canvass platform, and the personal data we collect on it, for research purposes. That includes running panels, surveys and interviews, analysing the results, and reporting findings to research clients.

We do not use the platform to sell you products, and we do not ask you to pay us. Research clients must not use your personal data to target you as an identifiable person or to cross-sell products or services to you. Section 9 explains this in more detail.

3. Two kinds of agreement: joining Canvass, and consenting to a study

Please read this section carefully. Joining Canvass is not the same as agreeing to take part in a particular study.

A. Joining the platform or a panel

When you create a Canvass account, or sign up for a panel from our website, you enter our Terms and this Privacy Policy. You also agree to receive notifications and updates about that panel or about Canvass, for example on WhatsApp or by other contact details you give us. This lets us tell you about opportunities, your account, payments or vouchers, and service messages.

B. Consent for a specific study, survey or call

Every study, panel project, survey or interview has its own terms, conditions and consent form. Those documents explain that study’s purpose, what will be asked, what personal data will be collected, how it will be used and shared, how long it will be kept, and any incentive. You will be asked to read and agree to them before you enrol in that study or start that survey. You may decline a study and still remain a Canvass member, unless that study’s form says otherwise.

We rely on your consent, and on the need to use data for the purpose we have told you about, as the lawful basis for processing under the DPDP Act. We will give you a notice, in clear language, before or at the time we ask for your consent. Where we ask for consent, we will do so through a clear action by you (for example, ticking a box or tapping “Agree”), and we will not treat silence or a pre-ticked box as consent.

4. What personal data we collect

We collect only what we need for the purpose we have told you about. Some details are collected when you create an account. Other details are collected later, for a particular study or survey, and only as far as that research requires.

This may include:

Identity and contact details, such as your name, mobile number, email address and city or other location you provide.
Account and profile details you choose to share, such as age, gender, occupation, education or household information, where needed to see if you qualify for a study.
Research responses, including survey answers, interview recordings or notes, and opinions you share in a study you have agreed to join.
Payment details, as described in section 5.
Technical and usage data, such as device type, browser, approximate location derived from your connection, and pages or buttons you use on our website, including data collected by cookies or similar tools as described in section 12.

What we never ask for. Canvass will never ask you for a bank OTP (one-time password), a credit or debit card number, or a card CVV or security code. If anyone claiming to represent Canvass asks for these, do not share them and contact us using the details in section 14.

You should only give us accurate information, and only information you are free to share.

5. Payments and bank details

Canvass pays participants. We never ask participants to pay us or to transfer money to us.

When you create an account, we ask for your bank account number and IFSC code only so that we can pay you. We use these details to send incentives or reimbursements you have earned, and to keep a record of those payments. We do not use them to take money from your account.

Some studies may offer a shopping voucher or another stated incentive instead of, or as well as, a bank transfer. How a particular incentive is delivered will be described in that study’s consent form or in the message we send you (for example, a voucher code on WhatsApp).

6. How we use your personal data

We use your personal data to:

Create and look after your account, and operate the Canvass platform.
Enrol you in a panel you signed up for, and send you notifications and updates about that panel, including on WhatsApp if you have agreed to that.
Invite you to studies, check whether you qualify, and run surveys and interviews you have consented to.
Analyse research results, write reports, and share findings with research clients in the way that study’s consent describes (which may include anonymised or aggregated findings, and, only if that consent allows it, limited personal data).
Pay you, issue vouchers, and keep payment records we need for tax, audit or law.
Keep the platform secure, prevent fraud or misuse, and fix problems.
Comply with law, and handle questions, withdrawals and grievances.
Measure and improve our website and, where used, the performance of our advertising, as described in section 12.

We will not use your personal data for a purpose that is not reasonably connected with the purpose we told you about, unless we have a fresh lawful basis and, where required, a fresh notice and consent.

You may withdraw your consent as easily as you gave it.

You may turn down or withdraw from a particular study by using the method described in that study’s consent form, or by contacting us.
You may ask us to stop sending panel or marketing notifications. Service messages that we must send (for example, about a payment or a security issue) may still be sent.
You may ask us to close your account and erase your personal data, subject to section 10.

Withdrawal does not undo processing that was lawful before you withdrew. If you withdraw consent that we need to operate your account or to pay you, we may not be able to keep providing that service, and we will tell you.

To withdraw consent or close your account, contact the Grievance Officer in section 14 or write to us at dharmesh@1990labs.com. We will also provide an in-product or message-based way to do this where we reasonably can, so that withdrawal is not harder than sign-up.

8. Your rights under the DPDP Act

Subject to the DPDP Act and its Rules, you have the right to:

Access a summary of the personal data we hold about you, the activities it is processed for, and the identities of others with whom it has been shared, as required by law.
Correct and complete your personal data if it is inaccurate or incomplete.
Erase your personal data when it is no longer needed for the stated purpose, or when you have withdrawn consent, unless we must keep it under law.
Have a grievance dealt with, as described in section 14.
Nominate another person to exercise your rights in the event of your death or incapacity, in the manner prescribed.

To use these rights, contact the Grievance Officer. We may need to verify it is you (or your nominee) before we act. We will respond within the time the law requires. If we cannot fulfil a request, we will tell you why, to the extent the law allows.

You also have the right to complain to the Data Protection Board of India if you are not satisfied with our response. See section 15.

We do not sell your personal data.

We may share personal data with:

Research clients, only as described in the consent form for that study. A client may receive your answers or other study data so that the research can be completed. Research clients must use this data only for the research purpose set out in that consent. They must not use participant data to target identifiable people (for example, with personalised advertising or outreach that uses the research data to find or profile you) or to cross-sell products or services to you.
Data Processors who work for us, such as companies that host our website or systems, send messages, process payments, or provide security or IT support. They may process your personal data only on our instructions, and they must protect it.
Professional advisers, such as lawyers, auditors or accountants, where needed.
Authorities, if the law requires it, or to protect rights, safety or the integrity of our research.

WhatsApp and similar messaging services are provided by third parties. If you agree to receive messages on WhatsApp, that service will process the message data under its own terms and privacy policy, which we do not control.

10. How long we keep personal data, and how we delete it

We keep personal data for one year, and then we delete it or anonymise it, unless the law requires us to keep it longer (for example, tax or accounting records, or to handle a dispute).

If a study’s consent form states a shorter period, we will follow that shorter period for that study’s data. If you withdraw consent or ask us to erase your data sooner, we will do so unless an exception in the DPDP Act or another law applies, and we will tell you if we must keep a record.

When we delete or anonymise personal data, we will do so in a reasonably secure way.

11. Where we process personal data

We process personal data in India. We do not transfer your personal data outside India for processing.

12. Cookies and measurement tools

Our website uses cookies and similar tools. Some are needed for the site to work, to remember your preferences, or to understand how the site is used.

We also use the Meta Pixel (a measurement tool from Meta, the company that operates Facebook and Instagram). Cookies and the Meta Pixel run from the moment the page loads. We use them to measure our advertisements, to understand whether they are effective, and to improve our ads. These tools may collect device and usage data, such as the pages you visit and the buttons you use. They are used for research-panel recruitment and advertising measurement, not to sell you a product on Canvass.

We do not show a separate cookie or consent banner before these tools run.

You can opt out or limit this in these ways:

Change your browser settings to block or delete cookies. Blocking some cookies may affect how the site works.
Use Meta’s ad preferences to control how Meta uses data to show you ads. You can find these in your Facebook or Instagram settings, or in Meta’s help pages on ads and privacy.

13. Security and personal data breaches

We use reasonable security safeguards, appropriate to the nature of the data and the harm that could be caused if it is misused, to protect personal data. These include access controls, encryption in transit where appropriate, limited staff access, and contracts with our processors. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

If a personal data breach occurs that is likely to affect you, we will notify the Data Protection Board of India and affected Data Principals, in the manner and within the time required by the DPDP Act and the DPDP Rules, and we will take steps to contain and remedy the breach.

14. Grievance Officer

If you have a question, request or complaint about your personal data or this Policy, please contact our Grievance Officer:

Grievance Officer: Dharmesh Ba
Email: dharmesh@1990labs.com
Phone / WhatsApp: +91 93805 86748
Postal address: #74, 15th Cross, JP Nagar, III Phase, Bangalore 560078, Karnataka, India

We will acknowledge and respond within the time required by law.

15. Data Protection Board of India

If you are not satisfied with how we have handled your grievance, you have the right to complain to the Data Protection Board of India, in the manner prescribed under the DPDP Act and the DPDP Rules.

You can file a complaint with the Data Protection Board of India through the process it publishes.

16. Children

Canvass is for people who are 18 years or older. You must not create an account or take part in a study if you are under 18, unless we have first obtained verifiable consent from your parent or lawful guardian, as required by the DPDP Act, and have clearly offered that path.

We do not knowingly use the personal data of a child to track them, to direct targeted advertising at them, or to carry out other processing the DPDP Act restricts in relation to children. If you believe a child has given us personal data without the required consent, please contact the Grievance Officer and we will take appropriate steps, including deletion where required.

17. Changes to this Policy

We may update this Policy from time to time. The “Effective date” at the top will change when we do. If a change is material, we will give you reasonable notice, for example by a message or a notice on the website. If the law requires fresh consent, we will ask for it.

18. Governing law

This Policy is governed by the laws of India, including the DPDP Act and the DPDP Rules.

19. Contact

For general questions about Canvass, contact us at dharmesh@1990labs.com or on WhatsApp at +91 93805 86748. For privacy requests and grievances, please use the Grievance Officer details in section 14.