Legal — Data Protection
DPDP Consent Notices
Issued under Section 5 & Rule 3 of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025
Version 1.0 | Effective June 27, 2026
Introduction
What is This Document?
This is a DPDP Consent Notice — a document required by the Digital Personal Data Protection Act, 2023 (India). It is written in plain language and tells you:
- What personal data FLOW collects from you
- Exactly why FLOW collects each item
- Who FLOW shares it with
- How long FLOW keeps it
- How to withdraw your consent
- How to exercise your rights and make a complaint
This notice is standalone — it is understandable on its own without reading any other document. It is not a summary of our Privacy Policy. It is the consent document you are entitled to under Indian law.
Three notices apply to FLOW users:
Notice A — Your personal data when you register and use the platform
Notice B — Your KYC and financial data during onboarding
Notice C — What happens to your buyers' data when you upload it
Your Rights
Your Rights Under the DPDP Act, 2023
As a Data Principal, you have the following rights over your personal data that FLOW processes. To exercise any right, email privacy@flowdso.com. We will respond within 30 days.
Right to Access
Request a summary of what personal data FLOW holds about you and the purposes for which it is processed
Right to Correction
Request that FLOW correct any inaccurate or incomplete personal data it holds about you
Right to Erasure
Request deletion of your personal data. Note: data subject to a 7-year statutory retention obligation (KYC, invoice records) cannot be deleted during that period
Right to Nominate
Nominate another individual to exercise your data rights on your behalf in the event of death or incapacity
Right to Withdraw Consent
Withdraw your consent at any time. Withdrawal must be as easy as giving consent — see the Withdrawal section below
Right to Grieve
Raise a grievance with FLOW's Grievance Officer and, if unsatisfied, escalate to the Data Protection Board of India (DPBI)
Notice A
Notice A — Account Registration & Platform Access
Consent-based
Applies at: account registration and ongoing platform use
This notice applies when you create a FLOW account. Processing is based on your consent, given by clicking "Create Account." You may withdraw this consent at any time (see Withdrawal section below).
Personal Data We Collect & Why
Full name of authorised business representative
To identify you as the account holder; to personalise platform communications; to appear as the sender name in legal demand letters dispatched to your buyers by the Marshal dunning agent on your behalf
Business email address
To deliver account notifications, invoice upload confirmations, dunning progress alerts, payment received alerts, subscription invoices, security alerts, and platform announcements
Mobile / WhatsApp number
To send one-time passwords (OTP) for login authentication; to send transactional SMS alerts for key platform events; to enable optional WhatsApp dunning status notifications if you choose to activate them
Business name & registered address
To label and identify your FLOW account; to appear in legal demand letters and collections communications sent to buyers in your name; to maintain platform records identifying your business
Login password
To authenticate your identity at each login session. Stored exclusively as a one-way cryptographic hash — never stored in readable form and never accessible by FLOW personnel
Who We Share This Data With
Your registration data is shared only with these sub-processors, solely to deliver the platform services described above:
- Supabase — Cloud database; stores your account data on infrastructure accessible from India
- Clerk — Authentication and session management provider
- Upstash — Distributed session token management
- Maileroo — Transactional email delivery provider
- MSG91 / Fast2SMS — SMS OTP and transactional SMS delivery
- Sentry — Anonymised error monitoring; no personally identifiable data transmitted beyond IP address
FLOW does not sell, rent, or trade your registration data to any third party. It is not used for advertising, third-party marketing, or behavioural profiling unrelated to the FLOW platform.
How Long We Keep It
For the duration of your active account. After account closure: 3 years for operational records, then permanently deleted. Activity and audit logs: up to 7 years where required under GST Act or PMLA.
Basis of Processing
Consent — given by clicking "Create Account" at registration. You may withdraw this consent at any time. Withdrawal results in account closure and cessation of all consent-based processing.
Notice B
Notice B — KYC & Financial Verification Data
Legal obligation
Applies at: KYC onboarding & bank account setup for payouts
This notice applies when you complete KYC verification and link your bank account for payout processing. Most of this data is collected under legal obligation (PMLA / GST Act) and cannot be deleted upon request during the mandatory 7-year retention period.
Important: Unlike Notice A data (which is consent-based), KYC and financial data below is primarily collected under statutory legal obligation. Even if you close your account or withdraw consent, this data must be retained for 7 years as mandated by the Prevention of Money Laundering Act, 2002 and the GST Act.
Personal Data We Collect & Why
PAN Number
Identity verification for KYC compliance; mandatory under the Prevention of Money Laundering Act, 2002 (PMLA) and applicable RBI guidelines for financial platform access. Stored AES-256 encrypted — never stored or transmitted in plaintext
GSTIN
Verification of your GST business registration; used for GST invoice reconciliation, cross-referencing invoice data against GSTN records, and payout identity verification
Bank account number & IFSC code
To process payouts of recovered invoice amounts to your registered business bank account via Razorpay, FLOW's RBI-regulated payment aggregator. Stored AES-256 encrypted. Shared solely with Razorpay for payout execution. Never shared for any other purpose.
UPI ID / VPA — optional
If you save a UPI ID in your FLOW profile, it is used solely to generate UPI deep-link payment pages (for invoices below ₹1,00,000) included in dunning communications to your buyers. Your UPI ID is embedded in the pay page URL and shown to your buyers as your payee address. This is optional and can be updated or removed at any time from Profile Settings.
Razorpay OAuth tokens — optional
If you connect your Razorpay account, FLOW stores an access token, refresh token, and Razorpay account identifier — encrypted at rest. Used solely to import invoices from Razorpay and to create Razorpay Payment Links on your behalf (for invoices above ₹1,00,000). FLOW does not store your Razorpay password or API secret. Tokens are deleted when you disconnect the integration.
Authorised signatory name & designation
To verify that the person operating the FLOW account has the authority to enter into financial transactions and receive payouts on behalf of the registered business entity, as required for PMLA compliance
KYC identity & address proof documents
To complete PMLA-mandated KYC verification before platform financial features (payouts, invoice discounting) are activated. Documents are stored encrypted and accessed only by authorised KYC review personnel
Who We Share This Data With
- Supabase — AES-256 encrypted cloud storage at rest
- Razorpay (Razorpay Software Private Limited, RBI-regulated payment aggregator) — For two purposes: (1) executing payout disbursements to your registered bank account (bank details shared encrypted, solely for payout); (2) if you connect your Razorpay account via OAuth, your OAuth tokens are used to call the Razorpay API on your behalf for invoice import and Razorpay Payment Link creation.
- NPCI / UPI payment infrastructure — Your UPI ID (VPA) is embedded in payment links generated by FLOW and transmitted to your buyers' UPI apps via NPCI's UPI payment rails when a buyer initiates payment. FLOW does not share your UPI ID with NPCI directly — it is included in the UPI URI scheme which the buyer's UPI app processes.
- Regulatory and law enforcement authorities — If required by a lawful court order, statutory demand, or regulatory direction from the Enforcement Directorate, Income Tax Department, GSTN, or any competent authority under Indian law
How Long We Keep It
Minimum 7 years from the date of your last transaction, as mandated by the PMLA, 2002 and the Goods and Services Tax Act. You cannot request deletion of KYC or financial data during this statutory retention period. After the retention period expires, data is permanently deleted.
Basis of Processing
Legal Obligation (primary basis) — PAN, GSTIN, and KYC documents are processed under the requirements of PMLA and the GST Act. This processing is mandatory and continues regardless of consent withdrawal.
Consent (secondary basis) — Bank account details for payout processing are consent-based. You may update your bank details at any time through the platform settings, subject to no pending payout being in progress.
WITHDRAWAL OF CONSENT DOES NOT AFFECT PROCESSING BASED ON LEGAL OBLIGATION. KYC AND TAX-RELATED DATA WILL BE RETAINED FOR THE FULL 7-YEAR STATUTORY PERIOD REGARDLESS OF ACCOUNT CLOSURE OR CONSENT WITHDRAWAL.
Notice C
Notice C — Buyer Data You Upload to the Platform
You are the Data Fiduciary
Applies when you upload buyer contacts or invoice details
This notice is addressed to you, the FLOW user (the SME). When you upload your buyers' personal data to FLOW, you are the Data Fiduciary for that data under the DPDP Act. FLOW acts as your Data Processor. You hold the legal responsibility for having a lawful basis to share your buyers' personal data with FLOW.
In plain terms: your buyers have not agreed directly with FLOW. They have (or should have) a commercial relationship with you. When you provide their data to FLOW, you are responsible for ensuring you are legally permitted to do so.
Buyer Data FLOW Processes on Your Behalf
Buyer representative name
Addressed in automated WhatsApp, SMS, and email payment reminders; included in the legal demand letter header dispatched on your behalf via the Marshal dunning agent
Buyer email address
Sending automated email payment reminders and the legal demand letter to the buyer contact, in your name and on your behalf
Buyer phone / WhatsApp number
Sending automated WhatsApp dunning messages and SMS payment reminders on your behalf via a licensed WhatsApp Business Solution Provider and a TRAI-registered SMS provider
Buyer GSTIN
Cross-referencing the invoice with GSTN records for automated fraud risk scoring; detecting phantom, unregistered, or mismatched buyer registrations
Invoice amount, date & due date
Calculating escalation timelines in the dunning sequence; generating accurate payment amount references in reminder messages; automated fraud risk scoring of the uploaded invoice
What FLOW Does — and Does Not Do — With Buyer Data
- Sends automated dunning communications (WhatsApp, SMS, email) in your name and on your authority
- Runs automated fraud risk scoring to detect fabricated, inflated, duplicate, or forged invoices
- Generates and dispatches a standardised legal demand letter at the final escalation step
- Maintains audit logs of all communications dispatched (retained 7 years for statutory compliance)
FLOW does not use buyer data for marketing, profiling, reselling to third parties, or any purpose unrelated to providing the platform services to you.
Your Obligations as the Data Fiduciary for Buyer Data
- You must have a genuine outstanding receivable — do not upload data for buyers who owe you nothing
- Contact details must belong to an authorised business representative of the buying entity, not a personal number or email
- Do not upload data relating to buyers who have formally disputed the invoice or notified you to cease contact
- You are responsible for any notice obligations you may have to your buyers under applicable Indian law
- You indemnify FLOW against all claims, fines, penalties, and costs arising from your failure to have a lawful basis for the buyer data you upload
How Long Buyer Data Is Retained
Audit logs of all buyer communications: 7 years (statutory compliance). Buyer contact data: for the active life of the relevant invoice plus the statutory retention period. On account closure, buyer data not subject to statutory retention is deleted within 90 days.
Withdrawal of Consent
How to Withdraw Your Consent
The DPDP Act, 2023 requires that withdrawing consent must be as easy as giving it. You gave consent by clicking "Create Account." You can withdraw it by following these steps:
1
Email
privacy@flowdso.com with the subject line:
DPDP Consent Withdrawal — [your account email address]
2
We will acknowledge your request within 24 hours and send you a secure data export link (valid for 30 days) so you can retrieve your data
3
We will close your account and stop all consent-based processing within 7 days of your withdrawal request
4
All active dunning sequences are immediately paused. No new sequences are initiated. Legal-obligation data (KYC, invoice records, audit logs) continues to be retained for the mandatory 7-year statutory period
Withdrawal of consent does not affect the lawfulness of processing that was completed before the date of withdrawal.
Grievance & DPBI
How to Raise a Grievance & Complain to the DPBI
Step 1 — Contact Our Grievance Officer
If you have a complaint about how FLOW processes your personal data, contact our Grievance Officer first:
Step 2 — Escalate to the Data Protection Board of India (DPBI)
If you are unsatisfied with our Grievance Officer's response after the 30-day resolution period, you may escalate your complaint to the Data Protection Board of India (DPBI) — the statutory adjudicatory authority under Section 18 of the DPDP Act.
The DPBI public complaint portal will be operational once notified by the Government of India under the DPDP Rules, 2025. Until the portal is live, complaints may be directed to MeitY (Ministry of Electronics and Information Technology). FLOW will update this notice with the DPBI portal URL once available.
Languages
This notice is published in English. You may request this notice in any of the 22 languages listed in the Eighth Schedule of the Constitution of India by emailing privacy@flowdso.com. We will provide a translated version within 15 business days.
Updates to This Notice
FLOW will update this notice when required by changes in applicable law or in our data processing practices. Material changes will be communicated to you by email at least 15 days before they take effect. The version number and effective date at the top of this document will be updated accordingly.
This notice was last updated on June 27, 2026. For the full Privacy Policy and Terms & Conditions, visit flowdsoo.com/legal.