Privacy policy

If you request email updates, we record your email address, consent and request date in private Cloudflare storage for up to 180 days. This records a signup request; it does not confirm delivery or an active email campaign. To withdraw consent or delete your request, contact help@sionline.co.in. When you sign up, your browser also sends your email address directly to FormSubmit (formsubmit.co) so our team receives a notification; FormSubmit sees your IP address and browser details as part of that connection.

Support request forms may also collect your agent or distributor ID, shop name, address, state, complaint type, requested service or feedback rating. These details are used to answer the request and may be included in enquiry notification emails.

SI Online Technomart Private Limited, trading as SiOnline, is an IRCTC Authorised Principal Service Provider based in Ratlam, Madhya Pradesh. We onboard and support agents across a range of services: railway ticketing, PAN, FASTag, bill payments, recharge and banking services.

This policy explains what personal information we hold, why, and what you can ask us to do about it. It covers both visitors to this website and agents who hold an account with us.

When you enquire

If you submit a website enquiry, call, message or email us about becoming an agent, we hold what you tell us: your name, phone number, email address, location, and what you are interested in. We hold it in order to answer you and to follow up. That is the entire purpose.

When you register as an agent

Registration requires identity and address documents, typically PAN, Aadhaar, a photograph, address proof and bank account details, plus business documents where you are registering an entity. We collect these because the organisations that issue agent credentials require them, and we pass them on for that purpose.

We do not collect documents speculatively. If a document is not needed for the service you are registering for, we should not be asking for it. If we do, tell us.

While you are an agent

Running your account generates records: transactions, wallet deposits and settlements, support conversations, and the contact details we hold for you. We keep these because they are how your account works and how a query six months from now gets answered.

This deserves its own section, because it is the most practically useful thing on this page.

We will never ask you for a password, a PIN, an OTP, or remote access to your computer. Not by phone, not on WhatsApp, not by email, not during a support call, not while resolving a refund. There is no circumstance in which a genuine request from us includes any of those.

If someone asks, they are not us, whatever number they are calling from and whatever they know about your account. End the contact and ring +91 91091 35959, the one number we publish. Report it through our grievance page; we act on impersonation because it affects our agents directly.

Less than you might expect, and we would rather describe it accurately than paste a generic paragraph.

Our online enquiry forms collect your name, mobile number, location, selected service, consent to contact you, and any optional email, applicant type or message you provide. We record the submission time, originating page and enquiry reference. Enquiries are stored privately using Cloudflare, our hosting provider. We also save your IP address (the number your internet connection shows to websites) and the name of the form you used with your enquiry record. We use them to handle your enquiry, to check for spam and abuse, and to help with support. A copy of the enquiry is sent to SiOnline’s own portal so our team can follow it up. That copy has the details you submitted, the form name, the page you sent it from and your IP address. Separately, a salted hash made from your IP address is kept for a short time only to limit automated submissions; it is not part of your enquiry record. To email our team about your enquiry, your browser also sends the details you submitted (and the form name and page) directly to FormSubmit (formsubmit.co), a third-party form service. FormSubmit therefore receives those details and, as any website you connect to does, your IP address and browser details. We do not send your IP address to FormSubmit ourselves, but your browser does. If saving your enquiry on our website fails, your browser may still send the details to FormSubmit so our team does not lose your request. The enquiry form never sends what you type to Google or Meta (see the Google and Meta tools section below). As with any website, our hosting infrastructure keeps ordinary server logs (things like IP address, browser type and the pages requested) for security and diagnostics.

Tutorial videos load a YouTube player only after you choose Play tutorial. Loading or using that player sends information to YouTube, which may set its own cookies under its privacy policy. No player is loaded when you simply open the tutorial gallery.

On our live website, sionline.co.in, we run a simple first-party page counter unless you switch it off. It does not run on test or preview copies of this site. We record the page path, event type (such as a page view, form result or contact-button click), date and whether the visit is on preview or production. We do not store form contents, full IP addresses, URL queries or a visitor identifier in analytics records. Records expire after 30 days. If you choose Decline, the counter stops. Your choice is stored in your browser; use Analytics preferences in the footer to change it. Do Not Track is respected. The same choice also covers the Google and Meta tools described below.

On our live website, sionline.co.in, we use three tools from other companies. They run by default, from the moment you open a page, unless you switch them off. We do not show a box asking first. They are never loaded on test or preview copies of this site, or if your browser sends a Do Not Track signal, or if you have chosen Decline on this device.

• Google Analytics (Google): counts page views and clicks on our phone, email, WhatsApp and button links. It also counts when an enquiry form is sent or fails, along with the kind of enquiry you chose, for example "FASTag". Depending on the settings in our Google account, it may also count simple actions such as scrolling, file downloads and clicks on links to other sites. It may set cookies and receives your IP address, browser and device details, and the address of the page you view.
• Google Ads (Google): when an enquiry about one of our services is sent successfully, it tells Google Ads that a visit led to an enquiry. This helps us see which of our ads work. We have turned off ad personalisation for this tag and we do not send any money value. It may set cookies and receives your IP address and browser details.
• Meta Pixel (Meta, the company behind Facebook and Instagram): counts page views, and records a "Lead" when an enquiry about one of our services is sent successfully. We have switched off its automatic reading of form fields and button text. It may set cookies and receives your IP address and browser details.

What they do not get: the name, mobile number, email, city, message or screenshot you put in a form. Enquiry details go only to our own storage, our portal and our notification email, as described above. Complaint, support and other request forms from existing agents do not count as an ad enquiry.

Where the data goes: Google and Meta keep and use what they receive on their own servers, which can be outside India, under their own rules. They decide how long they keep it. Read Google’s privacy policy and Meta’s privacy policy. We do not sell your information to them.

How to switch them off, or on again: use Analytics preferences in the footer of any page, then choose Decline. The tools stop sending data from that page and we clear their cookies on your device, and they do not load on later visits from the same browser. Choose Allow in the same place to turn them back on. Your choice is saved only on your device, so you need to repeat it in another browser. You can also turn on Do Not Track in your browser, and none of these tools will load. Because they run from the first page view, a visit can be counted before you have switched them off. To ask us to help with your data, contact us using the details below.

We share what is necessary, with organisations that need it to deliver the service you asked for:

• IRCTC: for railway ticketing agent registration and activation.
• UTIITSL: for PAN service agent registration.
• Banks, issuers and sponsor banks: for FASTag, AEPS, money transfer and banking services, each of which onboards you under its own KYC requirements.
• Certifying authorities: where a Class 3 digital signature is issued to you.
• Google and Meta: for the analytics and ad tools described in the Google and Meta tools section, on our live website, unless you switch them off.
• Cloudflare: to host this website and store online enquiries privately.
• FormSubmit: your browser sends enquiry and newsletter signup details to it directly, so it can deliver notification emails to our team. See FormSubmit’s privacy policy.
• Payment processors: to take a payment from you.
• Regulators, law enforcement and courts: where we are legally required to.

Once your information is with one of those organisations, their own policy governs what they do with it. We are not able to change how IRCTC or a bank handles data we were required to submit.

We do not sell your information, and we do not share agent lists or enquiry details with third parties for their own marketing.

We restrict access to agent records to the people who need them to do their job, and we hold documents only as long as we have a reason to.

We are not going to make a claim about unbreakable security, because nobody honestly can. What we will say is what you can do, since in practice most account compromises begin at the agent's end rather than ours: keep your own passwords to yourself, do not share a login with staff, and treat any unsolicited request for credentials as fraudulent regardless of who it appears to come from.

For as long as you hold an account with us, and after that for as long as we are required to. Records relating to registrations, transactions and statutory obligations have retention periods set by law and by the organisations involved rather than by us.

Optional error-report screenshots are stored privately for up to 180 days alongside the request reference. Only authorised staff can retrieve them. Upload PNG or JPEG screenshots without passwords, OTPs, customer identity documents or payment details. Screenshots are not published, and the image file is never sent to FormSubmit or attached to notification emails.

Website enquiry records are retained for up to 180 days for follow-up, then automatically removed from website storage. FormSubmit and the recipient email service process separate copies; deletion from website storage does not remove those copies. Contact us about deletion of email copies. Other registration records follow the retention requirements above. If you enquired and would rather we did not hold your details, ask and we will remove them.

Contact us and you can ask to:

• See what we hold about you.
• Correct anything inaccurate, particularly a phone number or email, which matters because that is where account notices go.
• Stop marketing contact while keeping your account.
• Delete what we are not required to keep.

Where we cannot do something (usually because a record has to be retained, or because the information now sits with IRCTC or a bank), we will tell you which it is and why, rather than simply declining.

To make a request, use the contact details below with your agent ID if you have one. If you are unhappy with our response, our grievance page sets out the escalation route and the timelines we work to.

Agent registration requires the applicant to be 18 or over. This site is not directed at children and we do not knowingly collect information from them.

We will update this page when what we do changes, and the date at the top is the date of the current version.

If something here is inaccurate, including if you believe we are doing something this page does not describe, tell us. We would rather correct the page than defend it.

Include your agent ID if you have one. Never include a password or an OTP, not even in a request about your own account.