Legal
We are FLOW ("Platform," "we," "us," "our"), based in New Delhi, India.
We operate an invoice cash flow management platform that enables invoice payment to be received earlier or faster than the due date, as well as any other related products and services that refer or link to these legal terms (collectively, the "Services").
You can contact us by email at samar@flowdsoo.com, or by mail to New Roshanpura, Najafgarh, New Delhi 110043, Delhi 110043, India.
These Legal Terms constitute a legally binding agreement made between you, whether personally or on behalf of an entity ("you"), and FLOW, concerning your access to and use of the Services. You agree that by accessing the Services, you have read, understood, and agreed to be bound by all of these Legal Terms.
Supplemental terms and conditions or documents that may be posted on the Services from time to time are hereby expressly incorporated herein by reference. We reserve the right, in our sole discretion, to make changes or modifications to these Legal Terms at any time and for any reason. We will alert you about any changes by updating the "Last updated" date of these Legal Terms, and you waive any right to receive specific notice of each such change. It is your responsibility to periodically review these Legal Terms to stay informed of updates.
The Services are intended for users who are at least 18 years old. Persons under the age of 18 are not permitted to use or register for the Services.
We recommend that you print a copy of these Legal Terms for your records.
The information provided when using the Services is not intended for distribution to or use by any person or entity in any jurisdiction or country where such distribution or use would be contrary to law or regulation or which would subject us to any registration requirement within such jurisdiction or country. Accordingly, those persons who choose to access the Services from other locations do so on their own initiative and are solely responsible for compliance with local laws, if and to the extent local laws are applicable.
We are the owner or the licensee of all intellectual property rights in our Services, including all source code, databases, functionality, software, website designs, audio, video, text, photographs, and graphics in the Services (collectively, the "Content"), as well as the trademarks, service marks, and logos contained therein (the "Marks").
Our Content and Marks are protected by copyright and trademark laws and treaties around the world. The Content and Marks are provided in or through the Services "AS IS" for your internal business purpose only.
Subject to your compliance with these Legal Terms, we grant you a non-exclusive, non-transferable, revocable license to access the Services and download or print a copy of any portion of the Content to which you have properly gained access, solely for your internal business purpose.
Except as set out in this section, no part of the Services and no Content or Marks may be copied, reproduced, aggregated, republished, uploaded, posted, publicly displayed, encoded, translated, transmitted, distributed, sold, licensed, or otherwise exploited for any commercial purpose whatsoever, without our express prior written permission. Requests may be sent to: samar@flowdsoo.com.
By directly sending us any question, comment, suggestion, idea, feedback, or other information about the Services ("Submissions"), you agree to assign to us all intellectual property rights in such Submission. You agree that we shall own this Submission and be entitled to its unrestricted use and dissemination for any lawful purpose, commercial or otherwise, without acknowledgment or compensation to you.
We may remove or edit your Content at any time without notice if in our reasonable opinion we consider such Contributions harmful or in breach of these Legal Terms.
By using the Services, you represent and warrant that: (1) all registration information you submit will be true, accurate, current, and complete; (2) you will maintain the accuracy of such information; (3) you have the legal capacity and agree to comply with these Legal Terms; (4) you are not a minor in the jurisdiction in which you reside; (5) you will not access the Services through automated or non-human means; (6) you will not use the Services for any illegal or unauthorized purpose; and (7) your use of the Services will not violate any applicable law or regulation.
If you provide any information that is untrue, inaccurate, not current, or incomplete, we have the right to suspend or terminate your account and refuse any and all current or future use of the Services.
You may be required to register to use the Services. You agree to keep your password confidential and will be responsible for all use of your account and password. We reserve the right to remove, reclaim, or change a username you select if we determine, in our sole discretion, that such username is inappropriate, obscene, or otherwise objectionable.
You agree to provide current, complete, and accurate purchase and account information for all purchases made via the Services. Applicable taxes will be added to the price of purchases as required. We may change prices at any time. All payments shall be in Indian Rupees.
We reserve the right to refuse any order placed through the Services and to limit or cancel quantities purchased per person, per household, or per order.
Your subscription will continue and automatically renew unless canceled. You consent to our charging your payment method on a recurring monthly basis without requiring your prior approval for each recurring charge, until such time as you cancel.
We offer a 14-day free trial to new users who register with the Services. The account will not be charged and the subscription will be suspended until upgraded to a paid version at the end of the free trial.
You can cancel your subscription at any time by contacting us at samar@flowdsoo.com. Your cancellation will take effect at the end of the current paid term.
We may, from time to time, make changes to the subscription fee and will communicate any price changes to you in accordance with applicable law.
You may not access or use the Services for any purpose other than that for which we make the Services available. As a user of the Services, you agree not to:
FLOW is a technology software platform that enables invoice cash flow management through automation tools. FLOW is not a bank, non-banking financial company (NBFC), payment aggregator, payment gateway, factoring company, credit institution, or any other type of regulated financial entity. FLOW does not hold any licence issued by the Reserve Bank of India, Securities and Exchange Board of India, or any other financial sector regulator.
FLOW does not provide credit, loans, overdrafts, advances, or any form of financial product to users or buyers. Any invoice discounting or early payment arrangement facilitated through the platform is a commercial arrangement entered into solely between the SME user and their nominated financing partner. FLOW provides software infrastructure to support such arrangements and is not a party to any financing transaction.
FLOW is not a registered debt recovery agent, licensed collections agency, or authorised representative under the Securitisation and Reconstruction of Financial Assets and Enforcement of Security Interest Act, 2002 (SARFAESI). Automated dunning communications sent via FLOW are software-generated reminders initiated by you (the user) and are not debt recovery actions undertaken by FLOW. Any actual debt recovery, litigation, or enforcement action must be independently pursued by you through appropriate legal channels.
FLOW is not a Telecom Commercial Communication Service provider and does not hold a TRAI licence. Messaging services are provided through licensed third-party carriers. FLOW does not guarantee regulatory compliance of messaging content that you customise beyond platform defaults.
By using the Services, you acknowledge that FLOW's role is limited to providing software tools and automation features, and that you bear sole commercial, financial, and legal responsibility for all decisions made using the platform.
FLOW shall not be liable for any delay, interruption, degradation, or failure of the Services arising from events beyond our reasonable control ("Force Majeure Events"), including but not limited to:
Upon occurrence of a Force Majeure Event, FLOW will use commercially reasonable efforts to resume normal service operations as soon as practicable and will notify affected users where feasible. FLOW's obligations under these Legal Terms are suspended for the duration of the Force Majeure Event to the extent rendered impossible or impractical by such event. FLOW shall not be liable for any losses arising solely from service unavailability caused by a Force Majeure Event.
This clause does not excuse FLOW from obligations unaffected by the Force Majeure Event, nor from obligations that FLOW had already breached prior to the occurrence of the event.
FLOW delivers automated collections messages via WhatsApp through a licensed WhatsApp Business Solution Provider (BSP) operating in compliance with Meta's WhatsApp Business Messaging Policy. By enabling WhatsApp dunning for a buyer, you represent and warrant that: (1) the buyer's WhatsApp number is a legitimate business contact for collections communications relating to a genuine outstanding receivable; (2) you have not been notified by the buyer to cease communications; and (3) your use of WhatsApp messaging via FLOW complies with Meta's policies and all applicable Indian law.
FLOW does not guarantee delivery of WhatsApp messages. Meta may restrict, suspend, or limit message delivery at its sole discretion and without notice. FLOW is not liable for any WhatsApp Business Account suspension, restriction, or policy enforcement action arising from your misuse of the dunning feature. You agree to use WhatsApp dunning solely for its intended purpose — legitimate invoice payment reminders — and not for harassment, spam, or any communication unrelated to a genuine outstanding invoice.
FLOW sends SMS notifications via a TRAI-registered telecom service provider using pre-approved Sender IDs and message templates registered under the TRAI Telecom Commercial Communications Customer Preference Regulations. You acknowledge that SMS delivery may be blocked where: (a) the recipient's number is registered on the National Do Not Disturb (NDNC) registry; (b) TRAI or the telecom carrier filters the message under applicable regulations; or (c) the recipient's handset, carrier, or network is unavailable. FLOW shall not be liable for SMS non-delivery caused by DND registrations, carrier filtering, or TRAI regulatory action.
Email notifications are sent via a registered email service provider in compliance with applicable anti-spam regulations. FLOW does not guarantee email delivery and is not responsible for messages blocked by spam filters, email service provider policies, or recipient mail server configurations.
You are solely responsible for ensuring that all buyer contact information uploaded to the platform: (1) is accurate and belongs to authorised representatives of the buyer's business; (2) is used only for legitimate collections communications relating to genuine outstanding invoices; and (3) does not include individuals who have expressly withdrawn consent to receive such communications. Misuse of FLOW's messaging capabilities — including communications with parties who have no outstanding debt obligation, harassment, or sending unsolicited commercial communications — may result in immediate account termination without refund and may be reported to TRAI, Meta, or relevant law enforcement authorities.
The Services may contain links to other websites ("Third-Party Websites") as well as articles, photographs, text, graphics, and other content originating from third parties ("Third-Party Content"). Such Third-Party Websites and Third-Party Content are not investigated, monitored, or checked for accuracy, appropriateness, or completeness by us, and we are not responsible for any Third-Party Websites accessed through the Services.
Inclusion of, linking to, or permitting the use or installation of any Third-Party Websites or any Third-Party Content does not imply approval or endorsement thereof by us.
We reserve the right, but not the obligation, to: (1) monitor the Services for violations of these Legal Terms; (2) take appropriate legal action against anyone who violates the law or these Legal Terms; (3) in our sole discretion and without limitation, refuse, restrict access to, limit the availability of, or disable any of your Contributions or any portion thereof; and (4) otherwise manage the Services in a manner designed to protect our rights and property.
We care about data privacy and security. By using the Services, you agree to be bound by our Privacy Policy. Please be advised the Services are hosted in India. If you access the Services from any other region of the world, through your continued use of the Services, you are transferring your data to India, and you expressly consent to have your data transferred to and processed in India.
These Legal Terms shall remain in full force and effect while you use the Services.
If we terminate or suspend your account for any reason, you are prohibited from registering and creating a new account under your name, a fake or borrowed name, or the name of any third party.
We reserve the right to change, modify, or remove the contents of the Services at any time or for any reason at our sole discretion without notice. We cannot guarantee the Services will be available at all times. We reserve the right to change, revise, update, suspend, discontinue, or otherwise modify the Services at any time or for any reason without notice to you.
These Legal Terms shall be governed by and defined following the laws of India. FLOW and yourself irrevocably consent that the courts of India shall have exclusive jurisdiction to resolve any dispute which may arise in connection with these Legal Terms.
You agree to irrevocably submit all disputes related to these Legal Terms or the legal relationship established by these Legal Terms to the jurisdiction of the Indian courts. FLOW shall also maintain the right to bring proceedings as to the substance of the matter in the courts of the country where you reside or, if these Legal Terms are entered into in the course of your trade or profession, the state of your principal place of business.
There may be information on the Services that contains typographical errors, inaccuracies, or omissions, including descriptions, pricing, availability, and various other information. We reserve the right to correct any errors, inaccuracies, or omissions and to change or update the information on the Services at any time, without prior notice.
You agree to defend, indemnify, and hold us harmless, including our subsidiaries, affiliates, and all of our respective officers, agents, partners, and employees, from and against any loss, damage, liability, claim, or demand, including reasonable attorneys' fees and expenses, made by any third party due to or arising out of: (1) your Contributions; (2) use of the Services; (3) breach of these Legal Terms; (4) any breach of your representations and warranties; (5) your violation of the rights of a third party, including but not limited to intellectual property rights; or (6) any overt harmful act toward any other user of the Services.
We will maintain certain data that you transmit to the Services for the purpose of managing the performance of the Services. Although we perform regular routine backups of data, you are solely responsible for all data that you transmit or that relates to any activity you have undertaken using the Services. You agree that we shall have no liability to you for any loss or corruption of any such data.
Visiting the Services, sending us emails, and completing online forms constitute electronic communications. You consent to receive electronic communications, and you agree that all agreements, notices, disclosures, and other communications we provide to you electronically satisfy any legal requirement that such communication be in writing.
By opting into any FLOW text messaging program, you expressly consent to receive text messages (SMS) to your mobile number. FLOW text messages may include account alerts and payment reminders.
Approximately 3 messages per specific due date cycle, as part of the dunning automation workflow.
SMS notifications are part of the dunning automation. You may opt out by contacting us at samar@flowdsoo.com.
Message and data rates may apply to any SMS messages sent or received. The rates are determined by your carrier. Carriers are not liable for delayed or undelivered messages.
For assistance, reply HELP or contact us at samar@flowdsoo.com.
These Legal Terms and any policies or operating rules posted by us on the Services constitute the entire agreement and understanding between you and us. Our failure to exercise or enforce any right or provision of these Legal Terms shall not operate as a waiver of such right or provision. These Legal Terms operate to the fullest extent permissible by law. We may assign any or all of our rights and obligations to others at any time.
If any provision or part of a provision of these Legal Terms is determined to be unlawful, void, or unenforceable, that provision is deemed severable from these Legal Terms and does not affect the validity and enforceability of any remaining provisions.
By uploading an invoice and enabling dunning, you expressly authorize FLOW to send automated payment reminder communications (WhatsApp, SMS, and Email) to your buyer's contact details on your behalf. You confirm that the buyer contact details you provide are accurate, belong to an authorized representative of the buyer's business, and that you have a legitimate outstanding receivable against that buyer.
FLOW sends these communications in your business name. You remain solely responsible for the accuracy of buyer contact information and the validity of the underlying invoice. FLOW is a software automation tool and is not a licensed debt collection agency. All communications sent via FLOW are on your behalf. FLOW does not act as your legal agent or representative.
A 2% platform commission is charged upon successful recovery during the free Trial period only. Paid subscription plans carry no commission. Dunning communications follow a pre-set escalation schedule including WhatsApp reminders, email notices, SMS alerts, and an automated legal demand letter at the final step. The legal demand letter is a formal written communication. It is not a court filing and does not constitute legal action. Any actual litigation must be initiated independently by you.
FLOW does not guarantee recovery of any invoice amount through automated dunning or any other platform feature. Recovery outcomes depend entirely on the buyer's financial position, willingness to pay, and the strength of the underlying commercial claim. Dunning communications are operational tools only and do not constitute legally enforceable demands, court orders, or guarantees of payment.
If a buyer notifies you that they dispute the outstanding invoice or wish to cease receiving communications, you are solely responsible for pausing or cancelling the dunning sequence for that buyer immediately using the controls provided in the platform. FLOW is not liable for continued automated communications if you fail to act upon a buyer dispute or opt-out request. FLOW reserves the right to unilaterally pause a dunning sequence if it receives credible evidence of abuse, harassment, communications to incorrect contacts, or communications relating to disputed or time-barred debts.
You warrant that all buyer contact details entered into the platform are accurate, current, and relate to an authorised representative of the buyer's business. FLOW shall not be liable for dunning communications sent to incorrect, outdated, or unauthorised contact details, for communications reaching unintended recipients, or for any third-party claims arising from misdirected communications. The cost of any legal proceedings initiated against FLOW by a third party as a result of your provision of inaccurate contact data shall be recoverable from you under the indemnification clause of these Legal Terms.
The automated legal demand letter generated and dispatched by FLOW at the final escalation step is a standardised formal communication. It is drafted as a general collections notice and is not reviewed by a licensed advocate prior to dispatch unless you have separately engaged one. FLOW makes no representation that the legal demand letter satisfies the requirements of any specific statute, including the Negotiable Instruments Act, 1881, the Code of Civil Procedure, 1908, or any other applicable law. You should obtain independent legal advice before relying on the legal demand letter as a precursor to litigation.
All invoices uploaded to FLOW are processed using AI-powered optical character recognition (OCR) to extract invoice data including invoice number, date, amount, due date, buyer GSTIN, and line items. You acknowledge that AI extraction may occasionally produce errors and you are responsible for verifying extracted data before proceeding.
Each invoice is automatically assigned a fraud risk score (0-100) based on platform signals. Invoices scoring above the MEDIUM threshold require manual Checker approval before payout processing. Invoices scoring in the CRITICAL range are automatically placed on Risk Hold and flagged for admin review.
A cryptographic hash (SHA-256) of each uploaded invoice document is recorded at the time of upload for document integrity verification. Invoice data and documents are retained for a minimum of 7 years as required under the GST Act. Invoices cannot be permanently deleted during this retention period.
FLOW makes no warranty regarding the accuracy, completeness, or reliability of any AI-extracted invoice data or fraud risk score. Extracted data and scores are provided as operational aids only. You remain solely responsible for verifying all extracted data before initiating any dunning, payout, or financial action. FLOW shall not be liable for any losses, disputes, or regulatory penalties arising from errors in AI-extracted data or from automated fraud scoring decisions.
The automated fraud risk scoring system constitutes automated decision-making that may materially affect your access to platform features including payout processing. If your invoice is placed on Risk Hold or flagged CRITICAL by the automated scoring system and you believe the decision is incorrect, you have the right to request human review. To request a review, contact samar@flowdsoo.com with your account details and the affected invoice reference number. FLOW will review and respond within 5 business days. FLOW's determination following human review is final and binding, subject to applicable law. FLOW does not guarantee that a human review will result in release of a held invoice.
FLOW offers a 14-day free trial followed by paid monthly subscription plans (Starter, Growth, Business, Pro, Enterprise). By subscribing, you authorize FLOW to charge your registered payment method on a recurring monthly basis. The first charge occurs on Day 15 after registration.
During the free Trial period, FLOW charges a 2% platform commission on every invoice amount recovered through the platform. Commission is recorded in your commission ledger and collected at end of month. Paid subscription plans (Starter, Growth, Pro, Enterprise) do not carry any commission — your subscription fee is the only recurring charge.
If a payment charge fails, our payment processor will retry automatically. After all retry attempts are exhausted, your account is placed on HALTED status with a 3-day grace period to update your payment method. After the grace period, platform access is suspended, all active dunning sequences pause, and SDK/API access is revoked immediately.
Subscriptions are billed monthly. If you believe a charge was made in error, contact samar@flowdsoo.com within 7 days with your account details and the specific charge for investigation.
FLOW processes your business data and your buyers' contact data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act). Personal data collected includes business representative names, email addresses, phone numbers, PAN numbers, and GSTIN. Sensitive financial data including PAN numbers and bank account numbers are encrypted using AES-256 encryption and are never stored in plaintext.
Data is hosted on Supabase infrastructure. Our sub-processors include WAHA (WhatsApp delivery), Fast2SMS (SMS delivery), Maileroo (email delivery), Groq (AI invoice data extraction), Upstash (session management), and Sentry (anonymized error monitoring).
We do not sell your data, your buyer data, or your invoice data to any third party. As a Data Principal under the DPDP Act, you have the right to access, correct, and request erasure of your personal data subject to legal retention obligations. Data erasure requests will be processed within 30 days except where retention is required by law.
Upon account closure, you have 30 days to export your data after which it is deleted except for records subject to statutory retention requirements under the GST Act and PMLA.
FLOW is a software automation tool for invoice collections. We do not guarantee recovery of any invoice amount. Our total liability to you for any claim arising from use of the platform shall not exceed the total subscription fees paid by you in the three calendar months immediately preceding the date of the claim.
We are not liable for WhatsApp, SMS, or email delivery failures caused by carrier outages, spam filters, incorrect contact details, or Meta/WhatsApp, Fast2SMS, or Maileroo service disruptions.
The following activities are strictly prohibited and will result in immediate account termination without refund:
Violations may be reported to GSTN, the Enforcement Directorate, or the Cyber Crime Cell as legally required. You agree to indemnify FLOW against all claims, costs, and losses arising from your violation of these terms including legal fees incurred by FLOW.
FLOW provides multi-user team functionality that allows an account owner ("Team Owner") to invite additional users ("Team Members") to access the platform under the Team Owner's account. Team Members are assigned roles (e.g., "manager" or "viewer") that govern the scope of their access and permissions within the platform.
The Team Owner is solely responsible for: (1) the actions and conduct of all Team Members operating under their account; (2) ensuring that all Team Members comply with these Legal Terms; (3) the accuracy and appropriateness of role assignments; (4) revoking access for Team Members who no longer require it; and (5) ensuring that Team Member invitations are sent only to individuals authorised to access the Team Owner's business data.
Team Members may have access to invoices, buyer information, dunning communications, financial data, activity logs, and other business records associated with the Team Owner's account, as determined by their assigned role. The Team Owner acknowledges and consents to this data sharing by enabling team access. FLOW shall not be liable for any unauthorised disclosure, misuse, or loss arising from a Team Member's access to shared account data.
Each Team Member receives independent login credentials. Team Members are responsible for maintaining the confidentiality of their own credentials. FLOW is not responsible for any actions taken through a Team Member's account, whether authorised or unauthorised. The Team Owner may revoke a Team Member's access at any time through the platform.
FLOW provides the team access infrastructure on an "as-is" basis and does not warrant uninterrupted access for Team Members. FLOW shall not be liable for any business losses, data breaches, or operational disruptions arising from: (a) incorrect role assignments made by the Team Owner; (b) actions taken by Team Members within their permitted scope; or (c) failure by the Team Owner to revoke access for former employees, contractors, or other unauthorised individuals.
FLOW provides a cloud-based document storage facility ("Doc Cloud") that enables users to upload, store, and retrieve business documents including but not limited to invoices, purchase orders, contracts, and supporting correspondence. Documents are stored on Supabase-hosted infrastructure with private bucket configurations. All uploaded documents are associated with the user's account and are not publicly accessible.
You are solely responsible for: (1) the accuracy, legality, and authenticity of all documents uploaded to Doc Cloud; (2) maintaining your own backup copies of all uploaded documents; (3) ensuring that documents uploaded do not contain malware, viruses, or malicious code; and (4) ensuring you have the legal right to upload and store any documents submitted to the platform.
You shall not upload documents that: (a) are fraudulent, forged, or fabricated; (b) contain personally identifiable information of individuals without their consent where such consent is legally required; (c) violate any applicable law including but not limited to the Information Technology Act, 2000 and the DPDP Act, 2023; or (d) infringe upon any third party's intellectual property rights.
Documents are retained for the duration of your active account and for a minimum period of 7 years thereafter as required under the GST Act and applicable tax regulations. Upon account termination, you have 30 days to export your documents. FLOW may delete documents after the statutory retention period has expired. FLOW does not guarantee perpetual storage beyond the legally mandated retention period.
While FLOW employs commercially reasonable measures to ensure the availability and integrity of documents stored on Doc Cloud, FLOW does not guarantee uninterrupted access to stored documents. FLOW shall not be liable for any loss, corruption, or unavailability of documents arising from: (a) infrastructure outages or service disruptions of third-party hosting providers; (b) force majeure events; (c) user error including accidental deletion; or (d) cyberattacks, data breaches, or other security incidents beyond FLOW's reasonable control. You are strongly advised to maintain independent copies of all critical business documents.
Documents stored on Doc Cloud are secured using industry-standard encryption and access controls. However, no method of electronic storage is 100% secure. FLOW disclaims all liability for any unauthorised access to or breach of stored documents to the fullest extent permitted by applicable law.
FLOW provides an automated GST reconciliation feature that cross-references your uploaded invoice data against GST return filings, bank transaction records, payout statuses, and other financial data sources to identify discrepancies, mismatches, and reconciliation gaps. This reconciliation process runs on an automated schedule and is designed to assist — not replace — your own accounting and compliance processes.
GST reconciliation outputs, reports, match scores, and discrepancy alerts generated by FLOW are provided for informational purposes only and do not constitute tax advice, legal advice, financial advice, or a certified audit. You are solely responsible for verifying all reconciliation outputs and for filing accurate GST returns with the Goods and Services Tax Network (GSTN) and relevant tax authorities. FLOW does not act as your chartered accountant, tax consultant, or statutory auditor.
FLOW does not warrant or guarantee the accuracy, completeness, or reliability of any reconciliation output. Reconciliation results may be affected by: (a) errors or omissions in your uploaded invoice data; (b) delays or inaccuracies in bank API responses; (c) timing differences between GST filing dates and invoice dates; (d) changes in GST portal data formats or API availability; or (e) technical failures in third-party data sources. You acknowledge that automated reconciliation is inherently subject to data quality limitations and processing delays.
FLOW shall not be liable for: (a) any penalties, interest, fines, or assessments levied by any tax authority as a result of discrepancies identified or not identified by the reconciliation feature; (b) any financial losses arising from reliance on reconciliation outputs without independent verification; (c) any losses arising from data feeds that are delayed, unavailable, or inaccurate due to third-party service disruptions; or (d) any consequential, incidental, or indirect damages arising from the use of the GST reconciliation feature.
You agree to: (1) independently verify all reconciliation results before relying on them for tax compliance or financial reporting; (2) maintain accurate and complete invoice records to ensure meaningful reconciliation outputs; (3) promptly report any suspected errors or discrepancies in reconciliation results to our support team; and (4) not hold FLOW responsible for compliance failures resulting from unverified reconciliation data.
All payout disbursements are processed through Razorpay (Razorpay Software Private Limited), a payment aggregator regulated by the Reserve Bank of India. FLOW passes your verified bank account details to Razorpay solely for the purpose of disbursing recovered invoice amounts to your registered account. FLOW does not hold, pool, or intermediate your funds at any point. Razorpay's own terms of service, privacy policy, and regulatory obligations apply to the disbursement leg of any transaction.
When a buyer payment is received and reconciled on the platform, FLOW may initiate a payout instruction to Razorpay, subject to: (a) automated fraud and risk review checks passing; (b) manual Checker approval where required by your invoice's fraud risk score; (c) your account being in good standing with no outstanding platform fees; and (d) your KYC verification being current and valid. Razorpay's own processing checks and compliance requirements may independently affect payout execution.
FLOW does not guarantee payout processing timelines. Payout processing is subject to: (a) Razorpay's settlement cycle and internal compliance checks; (b) banking system availability including NEFT, RTGS, IMPS, and UPI cut-off times; (c) your bank's processing schedules and holding periods; and (d) regulatory holds where required by law or on direction from any competent authority. FLOW shall not be liable for delays in payout processing caused by Razorpay's processing queues, third-party banking infrastructure, RBI directives, or platform risk review requirements.
FLOW is not liable for failed payouts caused by: (a) incorrect bank account details, IFSC codes, or account holder names provided by you; (b) Razorpay's compliance or fraud review rejecting the payout instruction; (c) bank account freezes, liens, or restrictions imposed by your bank or any regulatory or judicial authority; (d) IFSC code changes or branch closures; or (e) bank infrastructure failures or force majeure events. In the event of a failed payout, FLOW will notify you. You are responsible for providing corrected bank details, which will be re-submitted to Razorpay after re-verification.
Any dispute regarding a payout must be raised with FLOW within 30 days of the expected payout date by contacting samar@flowdsoo.com. Disputes raised after 30 days may not be investigated. FLOW will investigate and respond to payout disputes within 10 business days. FLOW's determination on payout disputes following investigation is binding, subject to applicable law and your rights under Indian consumer protection legislation.
FLOW does not guarantee recovery of any invoice amount through dunning, collections, or any other platform feature. Payout is contingent solely on actual payment being received from the buyer and cleared through the applicable payment channel. FLOW does not advance funds, provide invoice factoring, act as a guarantor for buyer payments, or assume any credit risk on behalf of users.
During the free Trial period, a 2% platform commission on the recovered invoice amount will be deducted from the payout before transfer to your bank account. On paid subscription plans, no commission is deducted. All applicable taxes on platform fees (including GST) are your responsibility unless expressly stated otherwise.
Subject to your compliance with these Legal Terms and an active paid subscription, FLOW grants you a limited, non-exclusive, non-transferable, revocable license to access and use the FLOW SDK and API solely for the purpose of integrating your business systems with the FLOW platform. This license does not extend to building competing products, reselling API access, or any use beyond the scope of your FLOW account.
Upon enabling SDK access, you will receive an API key (and, for partner-level access, an API key and secret pair). You are solely responsible for safeguarding these credentials. Treat your API keys as confidential — do not embed them in client-side code, public repositories, or share them with unauthorised parties. You must notify us immediately at samar@flowdsoo.com if you suspect unauthorised use of your API credentials. FLOW is not liable for any losses arising from your failure to secure your API keys.
FLOW may impose rate limits on API requests at its sole discretion. Exceeding rate limits may result in temporary throttling, request rejection, or suspension of API access. Current rate limits are communicated via API response headers. Automated scripts or systems that intentionally circumvent rate limits are a violation of these terms.
The API is provided on an "as-is" and "as-available" basis. FLOW does not guarantee any uptime, latency, or availability SLA for API endpoints. We may modify, deprecate, or discontinue API endpoints, fields, or versions at any time. Where practicable, we will provide reasonable notice of breaking changes. You are responsible for maintaining compatibility with current API versions.
FLOW may revoke or suspend your API access immediately and without notice in the event of: (a) violation of these Legal Terms; (b) non-payment or account suspension; (c) suspected security breach or abuse; or (d) termination of your account. Upon revocation, all API keys associated with your account are invalidated and all pending webhook deliveries are cancelled.
Data transmitted through the API, SDK, connectors, or webhooks that constitutes personal data under the Digital Personal Data Protection Act, 2023 is subject to the same data protection obligations as data collected directly through the platform. You are responsible for ensuring that data submitted via the API is accurate, lawful, and that you have the necessary authorisation to transmit it.
FLOW provides connectors to import invoice data from third-party applications including but not limited to Zoho Books, Tally Prime, SAP S/4HANA, Oracle NetSuite, Busy Accounting, HostBooks, MARG ERP, Shopify, Razorpay, MyBillBook, and Vyapar. By using a connector, you represent and warrant that: (1) you are the authorised owner or administrator of the third-party account from which data is being imported; (2) you have the legal right to export and transmit that data to FLOW; and (3) your use of the connector complies with the terms of service of the applicable third-party application.
FLOW is not responsible for the accuracy, completeness, timeliness, or reliability of data imported from third-party applications. Data quality depends on the source system and the export method used. You are solely responsible for verifying all imported data before acting on it within the FLOW platform. FLOW shall not be liable for any losses, incorrect dunning communications, or erroneous financial calculations arising from inaccurate data imported via connectors.
The availability of a connector for a third-party application does not imply endorsement, partnership, sponsorship, or affiliation between FLOW and the third-party application provider. All third-party product names, logos, and trademarks are the property of their respective owners.
FLOW may add, modify, suspend, or discontinue any connector at any time without prior notice. Changes to third-party APIs, export formats, or authentication methods may render connectors temporarily or permanently unavailable. FLOW is not liable for any business disruption caused by connector unavailability due to third-party changes.
Your use of third-party applications is governed by the terms of service and privacy policies of those respective applications. FLOW has no control over and assumes no responsibility for the content, privacy policies, or practices of any third-party application. You agree to independently comply with all applicable third-party terms when using FLOW connectors.
FLOW provides an outbound webhook system that delivers real-time event notifications (such as invoice.imported, invoice.paid, and other platform events) to an HTTPS endpoint URL configured by you. Webhook payloads are signed using HMAC-SHA256 with a shared secret unique to your account.
Webhooks are delivered on a best-effort, at-least-once basis. FLOW will retry failed deliveries up to 3 times at 5-minute intervals. After all retry attempts are exhausted, the event is marked as failed and is not retried further. FLOW does not guarantee delivery of any webhook event. You should implement idempotent event handling and use the API as a fallback to reconcile missed events. FLOW shall not be liable for missed, delayed, duplicate, or out-of-order webhook deliveries.
You are solely responsible for: (1) maintaining an HTTPS endpoint with a valid TLS certificate to receive webhook payloads; (2) verifying the HMAC-SHA256 signature on every incoming payload to authenticate that it originated from FLOW; (3) securing your webhook signing secret and rotating it periodically; and (4) responding to webhook deliveries with a 2xx HTTP status code within 10 seconds. FLOW is not liable for any security incidents, data breaches, or losses arising from your failure to properly verify webhook signatures or secure your endpoint.
You may configure which events trigger webhook deliveries through the platform dashboard. FLOW reserves the right to add new event types at any time. Unrecognised events should be acknowledged and ignored by your endpoint — do not treat unknown event types as errors.
FLOW provides downloadable desktop applications (.exe) and command-line scripts (.py) for certain connectors to enable local file-based invoice import. These applications are licensed, not sold, under the same terms as the FLOW platform. The license is non-exclusive, non-transferable, and revocable upon termination of your FLOW account.
Desktop applications and scripts are distributed solely through the FLOW platform dashboard. You must not redistribute, resell, or make these applications available to any third party without express written authorisation from FLOW. You are responsible for ensuring that your system meets the minimum requirements for running the software and that your antivirus or security software does not interfere with the application's operation.
FLOW warrants that desktop applications distributed through the platform are free of known viruses and malware at the time of distribution. However, FLOW is not responsible for: (a) antivirus false positives that may flag the application; (b) security vulnerabilities on your local machine or network; (c) data breaches resulting from your failure to secure the machine on which the application runs; or (d) modifications, tampering, or reverse-engineering of the application by you or any third party.
You must not decompile, reverse-engineer, disassemble, modify, or create derivative works from any FLOW desktop application or CLI script. You must not attempt to extract source code, algorithms, or data structures from the compiled executables.
Desktop applications and CLI scripts transmit invoice data from your local machine to the FLOW platform via encrypted HTTPS connections. Data is transmitted directly to your FLOW account and is not routed through any third-party intermediary. You are responsible for the accuracy and legality of data files processed by the application. FLOW does not store or access files on your local machine beyond what is necessary for the import operation.
FLOW may release updated versions of desktop applications and scripts. You are responsible for downloading and using the latest version. FLOW does not guarantee backward compatibility of older versions and may discontinue support for any version at any time.
FLOW offers a Partner API that enables authorised partners to manage sub-accounts, provision SDK access, and integrate FLOW into their own platforms. Partner-level API access requires a separate API key and secret pair and is subject to additional terms agreed upon during partner onboarding.
Partners are solely responsible for the security of their API key and secret pair. Partner credentials must not be shared with sub-account holders, embedded in client-side code, or stored in insecure locations. Compromised partner credentials must be reported immediately and will be revoked and reissued.
Partners must not access, read, modify, export, or transfer data between sub-accounts without explicit authorisation from the respective sub-account owner. Each sub-account's data is logically isolated and the Partner API enforces access boundaries. Attempting to circumvent data isolation controls is a violation of these terms and grounds for immediate termination of partner access.
Partners are responsible for ensuring that sub-accounts created through the Partner API comply with these Legal Terms. Partners must not create accounts on behalf of entities without their knowledge or consent. FLOW reserves the right to audit partner API usage and sub-account configurations for compliance.
Termination of a partner's access will result in the immediate revocation of all partner API keys. Sub-accounts provisioned by the partner will remain active but will be transitioned to direct FLOW accounts. Partners are responsible for communicating any access changes to their sub-account holders.
When you save a UPI Virtual Payment Address (VPA / UPI ID) in your FLOW profile settings, FLOW may automatically generate a hosted UPI payment page and attach a unique payment link to outbound dunning communications sent to your buyers, for invoices with an outstanding balance of less than ₹1,00,000 (one lakh Indian Rupees). This link directs to a FLOW-hosted pay page displaying a UPI QR code on desktop and a one-tap UPI deep-link ("upi://") on mobile devices, routing payment directly to your UPI ID using India's Unified Payments Interface (UPI) infrastructure operated by the National Payments Corporation of India (NPCI).
The UPI deep link is constructed using your UPI ID (Virtual Payment Address) as saved in your FLOW profile and transmitted as the "pa" (payee address) parameter in the UPI URI scheme. Your UPI ID is embedded in every payment link generated for your invoices and is visible to your buyer on the pay page. By saving a UPI ID in your profile, you authorise FLOW to use it in all UPI payment links generated for your outstanding invoices. You are solely responsible for the accuracy of the UPI ID you provide. An incorrect or expired UPI ID will result in payments being misdirected — FLOW bears no liability for this.
UPI payment links are capped at ₹1,00,000 per invoice balance, aligned with standard per-transaction limits applicable under UPI guidelines. Invoices with an outstanding balance exceeding ₹1,00,000 will not receive a UPI payment link automatically. For such invoices, a Razorpay Payment Link may be generated if you have connected your Razorpay account (see Section 42).
The amount reflected on the FLOW pay page and in the UPI QR code is not static. The pay page queries the FLOW platform every 30 seconds to retrieve the live outstanding balance — accounting for any partial payments received and interest accrued — and updates the displayed amount, QR code, and payment button accordingly. The amount shown to your buyer at the moment of payment may therefore differ from the original invoice value.
Payment made via a FLOW-generated UPI link is a direct transaction between your buyer and your UPI ID through India's UPI infrastructure. FLOW is not a party to the payment transaction. FLOW does not receive, hold, or process funds transferred via UPI payment links. Money moves directly from the buyer's UPI-linked bank account to the bank account associated with your UPI ID, without passing through FLOW's systems at any point.
FLOW generates UPI payment links and hosted pay pages on a best-effort basis and makes no representation or warranty of any kind regarding the outcome. FLOW does not guarantee: (a) that UPI payment links will be delivered to or opened by your buyer; (b) that UPI transactions initiated through the pay page will succeed; (c) that the buyer's UPI application will process the deep link or QR code correctly; (d) that payment will be received by your account within any specific timeframe; or (e) that NPCI, your bank, or the buyer's bank will not impose transaction limits, security holds, or processing failures. The availability and reliability of UPI as a payment system is governed entirely by NPCI and participating banks and is outside FLOW's control. We do our best to generate correct, functional links — but we cannot guarantee payment outcomes.
UPI payment links generated by FLOW expire 7 days from the date of generation. After expiry, the pay page will display a link-expired notice and no further payment can be initiated via that link. You may regenerate a payment link from your dashboard at any time for any active invoice.
FLOW does not receive automatic payment confirmation from NPCI or your bank when a UPI transaction succeeds. If your buyer pays via a FLOW UPI link, you must independently confirm receipt from your bank account or UPI app and mark the invoice as paid within FLOW. Dunning automation for that invoice will not stop automatically upon UPI payment unless you update the invoice status on the platform.
FLOW provides an optional integration with Razorpay, enabling you to connect your existing Razorpay merchant account to FLOW via the Razorpay OAuth 2.0 authorisation protocol. This integration serves two functions: (a) importing invoice and payment data from your Razorpay account into FLOW's intake queue, and (b) enabling FLOW to generate Razorpay Payment Links via your Razorpay account for invoices with an outstanding balance exceeding ₹1,00,000, where UPI deep links are not applicable.
To connect your Razorpay account, you complete a Razorpay-hosted OAuth authorisation flow. Upon successful authorisation, FLOW stores an access token and refresh token (together, "OAuth Tokens") associated with your Razorpay account. These tokens are encrypted in transit and at rest. FLOW uses your OAuth Tokens solely to make Razorpay API calls on your behalf — limited to the permissions you grant during the authorisation flow. FLOW does not store your Razorpay login credentials, password, or API secret.
FLOW automatically attempts to refresh your Razorpay access token before it expires — typically within 10 minutes of the token's expiry timestamp — using the stored refresh token. Refresh attempts may fail if you have revoked FLOW's access from your Razorpay dashboard, if the refresh token has expired due to prolonged inactivity, or due to Razorpay API service disruptions. In such cases, the Razorpay integration will become temporarily unavailable and you must re-authorise the connection from FLOW's Integrations dashboard.
Using FLOW's Razorpay connector, FLOW retrieves invoice and payment data from your Razorpay account via the Razorpay API (up to 100 records per import session) and places it in your FLOW intake queue for review. Imported data includes Razorpay payment IDs, customer information, amounts, currency, and status fields. You are responsible for reviewing all imported records before initiating any dunning sequence. FLOW does not guarantee the accuracy, completeness, or currency of data retrieved from Razorpay's API — we try our best to map Razorpay fields accurately, but the source data is controlled entirely by Razorpay and not by FLOW.
Where a Razorpay OAuth connection is active and the invoice outstanding balance exceeds ₹1,00,000, FLOW may create a Razorpay Payment Link through your connected Razorpay account. The Payment Link is created under your Razorpay merchant profile and is subject to Razorpay's own platform terms, transaction limits, and KYC restrictions applicable to your account. FLOW's commission structure, where applicable, may be applied at the point of Razorpay settlement via Razorpay Route. Payment Links expire 7 days from creation.
Your Razorpay merchant account — including all transactions, settlements, chargebacks, and disputes processed through it — is governed exclusively by Razorpay's own Terms of Service and Privacy Policy. FLOW is a Razorpay Partner operating under the Razorpay Partner Programme. FLOW is not responsible for: (a) Razorpay's acceptance or rejection of your account or transactions; (b) Razorpay's settlement timelines, holds, or account restrictions; (c) Razorpay's KYC requirements; (d) any fees charged by Razorpay; or (e) any dispute, chargeback, or fraud arising from payments processed through Razorpay. Razorpay is a payment aggregator regulated by the Reserve Bank of India.
You may disconnect your Razorpay account from FLOW at any time from the Integrations section of your FLOW dashboard, or by revoking FLOW's access directly from your Razorpay account settings. Upon disconnection, FLOW will delete your stored OAuth Tokens. Invoice records previously imported and dunning sequences already in progress will not be affected by disconnection.
FLOW does not guarantee: (a) the continued availability of the Razorpay OAuth integration; (b) the successful creation of Razorpay Payment Links for any specific invoice; (c) Razorpay's processing, settlement, or approval of any payment; (d) the accuracy of invoice data retrieved from Razorpay; or (e) that Razorpay will not change its API specifications, OAuth protocol, or platform terms in a manner that affects this integration. We will do our best to maintain the integration, but changes to Razorpay's platform are outside our control and may render this feature temporarily or permanently unavailable without prior notice from FLOW.
New Roshanpura, Najafgarh, New Delhi 110043
Delhi 110043, India
Email: samar@flowdsoo.com
Legal
FLOW
This Privacy Notice for FLOW ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"). Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services.
Do we process any sensitive personal information? We do not process sensitive personal information.
Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, or otherwise when you contact us. All personal information that you provide to us must be true, complete, and accurate.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services.
Like many businesses, we also collect information through cookies and similar technologies.
We process your personal information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so.
We may need to share your personal information in the following situations:
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. The following describes how we use such technologies and how you can manage them.
You can control and manage cookies through your browser settings. Blocking strictly necessary cookies will prevent you from accessing the platform. We do not currently respond to Do-Not-Track browser signals (see Section 10 below). By continuing to use the platform after being presented with this notice, you consent to our use of cookies as described above.
Third-party services embedded in or integrated with the platform may set their own cookies. We do not control third-party cookies. We recommend reviewing the privacy policies of Sentry (sentry.io/privacy) and other sub-processors listed in Section 6 of our Terms regarding data sub-processors.
FLOW uses AI-powered tools and automated systems in the following ways, some of which may materially affect your use of the platform:
In respect of automated fraud scoring decisions that place your invoice on Risk Hold or CRITICAL flag, you have the right to request a human review of that decision. Contact samar@flowdsoo.com with your account reference and the affected invoice ID. FLOW will review and respond within 5 business days. FLOW does not guarantee that a human review will reverse the automated decision. FLOW's post-review determination is final subject to applicable law.
Under the DPDP Act 2023, you do not have a statutory right to opt out of automated decision-making, but FLOW voluntarily provides the human review mechanism above as a platform commitment.
Our servers are located in India. Regardless of your location, please be aware that your information may be transferred to, stored by, and processed by us in our facilities in India.
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Invoice data is retained for a minimum of 7 years as required under the GST Act.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or securely store your personal information and isolate it from any further processing until deletion is possible.
We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services.
You may review, change, or terminate your account at any time. Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us using the contact details provided below.
Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, or enforce our legal terms.
Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.
When a Team Owner invites Team Members to the platform, we collect and process the following personal information of Team Members: full name, email address, and assigned role. This data is collected directly from the Team Owner at the time of invitation.
Team Member data is used solely for the purpose of provisioning access, authenticating sessions, enforcing role-based permissions, and logging activity within the Team Owner's account. Team Member activity (including login timestamps, actions performed, and data accessed) is logged for audit and security purposes.
Team Member personal data is retained for the duration of the Team Owner's active account. Upon revocation of a Team Member's access, their login credentials are deactivated. Activity logs associated with that Team Member are retained in accordance with statutory requirements and our internal audit obligations.
Team Members may request access to or deletion of their personal data by contacting us at privacy@flowdso.com, subject to the Team Owner's consent and legal retention obligations.
When you upload invoices or buyer contact details to the platform, you may be providing FLOW with personal data belonging to third parties (your buyers) — including buyer representative names, email addresses, phone numbers, business addresses, GSTIN, and PAN numbers. In respect of this buyer data, you are acting as the Data Fiduciary under the Digital Personal Data Protection Act, 2023, and FLOW processes such data solely as a Data Processor acting on your instructions.
By uploading buyer data to FLOW, you represent and warrant that: (1) you have a lawful basis under the DPDP Act or other applicable law for sharing the buyer's personal data with a third-party processor; (2) you have complied with all applicable notice obligations vis-à-vis your buyers to the extent required by law; (3) the buyer contact data you provide is accurate, belongs to authorised representatives of the buyer's business, and is provided solely for the purpose of invoice management and collections; and (4) your buyers' data will be used only for the legitimate commercial purpose of recovering genuine outstanding receivables.
FLOW shall process buyer personal data solely for the purposes of: (a) sending automated dunning communications on your behalf; (b) fraud risk assessment on the underlying invoice; (c) platform audit, compliance, and statutory retention obligations; and (d) any other purpose explicitly directed by you in writing. FLOW shall not use buyer personal data for marketing, profiling, sale to third parties, or any purpose unrelated to the provision of Services to you.
If a buyer contacts FLOW directly to request access to, correction of, or erasure of their personal data processed by FLOW on your behalf, FLOW will notify you promptly and act on your documented instructions. Where erasure is legally mandatory (and no statutory retention obligation applies), FLOW may act directly to fulfil the request. You agree to indemnify FLOW against any claim, fine, or liability arising from your failure to have a lawful basis for the buyer data you submit to the platform.
Buyer personal data is retained for the duration of your active account and for the minimum statutory periods required under the GST Act, PMLA, and other applicable Indian law. Upon account closure, buyer data not subject to statutory retention is deleted within 90 days.
When you use FLOW's Doc Cloud feature, we process and store the documents you upload, including invoices, purchase orders, contracts, and other business correspondence. Documents may contain personal data of third parties (buyer names, addresses, contact details, GSTIN, PAN numbers) embedded within them.
Uploaded documents are stored in private, access-controlled cloud storage (Supabase infrastructure) and are accessible only to the account owner and authorised Team Members based on their assigned roles. Documents are encrypted in transit and at rest.
We process document metadata (file name, upload timestamp, file size, document hash, uploader identity) for platform administration, integrity verification, and audit trail purposes. We do not access the contents of your documents for marketing, advertising, or any purpose unrelated to the provision of Services.
Document data is retained for a minimum of 7 years as required under the GST Act and applicable Indian tax regulations, even after account closure. Upon expiry of the statutory retention period, documents are permanently deleted unless you request earlier deletion and no legal retention obligation applies.
The GST reconciliation feature processes your invoice data, GSTIN details, HSN/SAC codes, tax amounts, bank transaction data, and payout records to generate reconciliation reports. This data may be cross-referenced with information obtained from bank APIs and other financial data sources integrated with the platform.
Reconciliation outputs (match results, discrepancy alerts, exception reports) are stored within your account and are accessible only to you and your authorised Team Members. We do not share reconciliation data with any third party, including tax authorities, unless required by law or upon your explicit written instruction.
We may process aggregated, anonymised reconciliation metrics (such as average match rates and common discrepancy types) to improve our reconciliation algorithms. Such aggregated data does not identify you or your business.
Reconciliation records are retained for a minimum of 7 years in compliance with the GST Act and applicable record-keeping regulations.
When you use the FLOW SDK or API, we collect and process: your API key identifier, the IP address of the requesting system, request timestamps, request/response metadata (HTTP method, endpoint, status code), and rate limit usage. This data is logged for security monitoring, abuse prevention, debugging, and platform administration.
When you use a FLOW connector (web-based, desktop application, or CLI script) to import data from a third-party application, we process the invoice and business data transmitted through that connector. This may include invoice numbers, amounts, dates, buyer names, addresses, GSTIN, PAN, contact details, and other fields present in the source data. We process this data solely for the purpose of providing the FLOW Services and subject to the same data protection obligations described in this Privacy Notice.
FLOW does not independently collect data from your third-party application accounts. All connector data is initiated and authorised by you. We do not retain your third-party application login credentials — connectors operate using exported files (CSV) or locally-configured API endpoints that you control.
FLOW desktop applications (.exe) and CLI scripts (.py) run on your local machine and transmit data to the FLOW platform via encrypted HTTPS connections. These applications do not collect telemetry, usage analytics, or any data from your machine beyond the invoice files you explicitly select for import. No data is stored locally by the application after transmission.
When you save a UPI ID (Virtual Payment Address / VPA) in your FLOW profile, we store this identifier to generate UPI payment links attached to your dunning communications. Your UPI ID is embedded in pay page URLs and UPI QR codes presented to your buyers as the payee address for payment. Your UPI ID is visible to your buyers on FLOW-generated pay pages — this is necessary for UPI payments to function. We do not validate your UPI ID against NPCI systems. You are solely responsible for its accuracy. We process your UPI ID only for the purpose of generating payment links for your invoices.
When you connect your Razorpay account to FLOW via OAuth, we store your Razorpay OAuth access token, refresh token, and your Razorpay account identifier. These tokens are used solely to call the Razorpay API on your behalf — for invoice import and, where applicable, Razorpay Payment Link creation. OAuth tokens are encrypted at rest and in transit. We do not store your Razorpay login credentials, password, or API secret key. Your Razorpay OAuth token data is deleted upon disconnection of the integration. FLOW's use of data accessed via Razorpay OAuth is also subject to Razorpay's developer terms and privacy policy in addition to this Privacy Notice.
If you access FLOW through a Partner integration, your account data is shared with the Partner only to the extent necessary to provision and manage your account. Partners are contractually bound to process your data in accordance with this Privacy Notice. You may request details of partner data access by contacting us at privacy@flowdso.com.
When you configure outbound webhooks, FLOW transmits event payloads to an HTTPS endpoint URL specified by you. Webhook payloads may contain personal data including invoice details, buyer information, payment amounts, and event metadata (event type, timestamp, delivery ID).
Once a webhook payload is delivered to your endpoint, the data is under your control and subject to your own data protection obligations. FLOW is not responsible for how you process, store, or share data received via webhooks. You must ensure that your webhook endpoint complies with applicable data protection laws, including the DPDP Act 2023.
FLOW retains webhook delivery logs (endpoint URL, delivery status, HTTP response code, timestamp) for 90 days for debugging and audit purposes. Webhook payload contents are not retained after successful delivery.
Yes, we will update this notice as necessary to stay compliant with relevant laws. We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification.
New Roshanpura, Najafgarh, New Delhi 110043
Delhi 110043, India
Email: privacy@flowdso.com
Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. To request to review, update, or delete your personal information, please contact us at privacy@flowdso.com.
In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, FLOW has designated a Grievance Officer to address complaints and queries relating to personal data processing and platform conduct.
Email: privacy@flowdso.com
Address: New Roshanpura, Najafgarh, New Delhi 110043, Delhi, India
Acknowledgement: Within 24 hours of receipt
Resolution target: Within 30 days of receipt
The Grievance Officer will acknowledge receipt of any complaint within 24 hours and endeavour to resolve it within 30 days. If you are dissatisfied with the resolution provided by the Grievance Officer, you may escalate your complaint to the Data Protection Board of India once it becomes operational for public complaints under the DPDP Act, 2023, or to any other competent authority under applicable Indian law.
Complaints may relate to: (a) alleged violations of this Privacy Notice; (b) refusal or failure to honour data principal rights under the DPDP Act; (c) objections to automated processing decisions; or (d) any other matter relating to the processing of your personal data by FLOW. FLOW will not charge any fee for raising a grievance.
In the event of a personal data breach that is reasonably likely to result in harm to any Data Principal, FLOW will notify the Data Protection Board of India within 72 hours of becoming aware of the breach, in accordance with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
Affected Data Principals will be notified of the breach in a timely manner. The notification will include, to the extent known at the time: (a) the nature and categories of personal data affected; (b) an estimated number of affected individuals; (c) the likely consequences of the breach; (d) the measures FLOW has taken or proposes to take to address the breach; and (e) the contact details of the Grievance Officer for further enquiries.
FLOW maintains a documented incident response plan and conducts periodic security assessments of its infrastructure and sub-processors. Nonetheless, no method of electronic storage or transmission is 100% secure. FLOW does not guarantee that a data breach will never occur. In the event of a suspected breach affecting your account, please contact privacy@flowdso.com immediately so that we may investigate promptly.
FLOW's obligation to notify you of a breach is limited to breaches involving personal data processed by FLOW. FLOW is not responsible for notifying you of breaches occurring within your own systems, third-party integrations you manage, or systems operated by your buyers.
Legal
FLOW
The information provided by FLOW ("we," "us," or "our") on our website and mobile application is for general informational purposes only.
All information on the Site and our mobile application is provided in good faith, however we make no representation or warranty of any kind, express or implied, regarding the accuracy, adequacy, validity, reliability, availability, or completeness of any information on the Site or our mobile application.
FLOW is a technology software platform and is not a bank, NBFC, payment aggregator, payment gateway, factoring company, or any regulated financial entity. FLOW does not hold any licence from the Reserve Bank of India, SEBI, TRAI, or any other financial sector or telecommunications regulator. Nothing on this platform constitutes financial advice, investment advice, credit assessment, or a regulated financial service. Users should obtain independent professional advice before relying on platform outputs for any financial, legal, or compliance decision. The availability of any feature on the platform does not imply regulatory approval of its use for any particular purpose.
All payout disbursements are executed through Razorpay (Razorpay Software Private Limited), an RBI-regulated payment aggregator. FLOW does not hold, intermediate, or disburse funds directly. FLOW does not guarantee the timing, success, or completeness of any payout — processing is subject to Razorpay's settlement cycles, fraud review queues, bank infrastructure availability, and regulatory holds, all of which are beyond FLOW's direct control. FLOW is not liable for any financial loss, interest cost, or business disruption caused by delayed, failed, or held payouts attributable to Razorpay's processing or bank-side failures. Failed payouts resulting from incorrect bank details provided by the user are not FLOW's liability. FLOW does not advance, lend, or guarantee funds against any invoice and is not a party to any financing arrangement between the user and their buyer or financier.
Marshal is FLOW's automated collections communication agent. Marshal-generated communications (WhatsApp messages, SMS, emails, and legal demand letters) are sent on behalf of the user and represent the user's collections instructions — not FLOW's independent legal action. The legal demand letter generated by Marshal is a standardised formal notice and is not reviewed by a licensed advocate before dispatch. It does not constitute a court filing, legal proceedings, or a demand under any specific statute. FLOW makes no warranty that Marshal's communications will result in payment recovery. FLOW is not liable for WhatsApp, SMS, or email delivery failures caused by carrier restrictions, DND registrations, Meta policy enforcement, or any cause beyond FLOW's reasonable control.
The multi-user team access feature is provided as a convenience to facilitate collaborative use of the platform. FLOW does not guarantee uninterrupted team access and is not responsible for any losses, data exposure, or operational disruptions arising from the actions of Team Members, incorrect role assignments, or the Team Owner's failure to manage access permissions. The Team Owner assumes full responsibility for the conduct and access of all Team Members invited to their account. FLOW does not verify the identity, authority, or employment status of Team Members and shall not be held liable for any unauthorised access resulting from compromised Team Member credentials.
FLOW's Doc Cloud is provided for document storage and retrieval convenience only. While we employ industry-standard security measures, we do not guarantee the perpetual availability, integrity, or recoverability of uploaded documents. FLOW is not a certified document archival service and does not replace the need for independent backup and record-keeping practices. FLOW shall not be liable for any document loss, corruption, or inaccessibility arising from infrastructure failures, third-party service disruptions, cyberattacks, or any other cause. Users are strongly advised to maintain independent copies of all critical business documents at all times.
The GST reconciliation feature is an automated data-matching tool provided for informational and operational convenience only. It does not constitute tax advice, legal advice, or a certified audit. FLOW does not warrant the accuracy, completeness, or timeliness of reconciliation outputs. Reconciliation results may be affected by data quality issues, timing discrepancies, third-party API limitations, or changes in GST portal data formats. Users are solely responsible for independently verifying all reconciliation outputs before relying on them for tax compliance, financial reporting, or any regulatory filings. FLOW shall not be held liable for any penalties, interest, fines, tax assessments, or financial losses arising from the use of or reliance upon reconciliation outputs generated by the platform.
The FLOW SDK and API are provided for integration convenience only. FLOW does not guarantee any uptime, latency, throughput, or availability service level for API endpoints. API endpoints, fields, request formats, and response structures may change at any time with or without notice. FLOW shall not be liable for any business disruption, data loss, or financial losses arising from: (a) API downtime or degraded performance; (b) breaking changes to API endpoints or response formats; (c) rate limiting or throttling of API requests; (d) revocation or suspension of API access; or (e) unauthorised use of API keys resulting from your failure to secure your credentials. You are solely responsible for implementing appropriate error handling, retry logic, and fallback mechanisms in your API integrations.
FLOW connectors for third-party applications (including but not limited to Zoho Books, Tally Prime, SAP, Oracle NetSuite, Busy, HostBooks, MARG, Shopify, Razorpay, MyBillBook, and Vyapar) are provided as integration tools to facilitate data import. FLOW does not warrant the accuracy, completeness, or reliability of data imported from any third-party application. Connectors may become temporarily or permanently unavailable due to changes in third-party APIs, export formats, or authentication requirements. FLOW is not affiliated with, endorsed by, or partnered with any third-party application provider unless explicitly stated. All third-party product names and logos are the property of their respective owners. FLOW shall not be held liable for any errors, omissions, incorrect dunning communications, or financial losses arising from data imported via connectors.
Outbound webhooks are delivered on a best-effort basis. FLOW does not guarantee the delivery, timeliness, ordering, or deduplication of webhook events. You are responsible for implementing idempotent event handling and using the FLOW API as a reconciliation fallback. FLOW shall not be liable for any missed, delayed, duplicate, or out-of-order webhook events, or for any business consequences resulting from webhook delivery failures.
FLOW desktop applications (.exe) and CLI scripts (.py) are provided for local file-based invoice import convenience. While FLOW warrants that these applications are free of known malware at the time of distribution, FLOW does not guarantee compatibility with all operating systems, hardware configurations, or security software. Antivirus false positives may occur. FLOW shall not be liable for any data loss, system damage, or security incidents arising from the installation or use of these applications on your local systems. Users are responsible for maintaining adequate system security and backups.
FLOW generates UPI payment links and hosted pay pages as a convenience feature to help your buyers pay outstanding invoices. We do our best to generate accurate, functional links — however, UPI payment infrastructure is operated by the National Payments Corporation of India (NPCI) and participating banks, systems entirely outside FLOW's control. FLOW does not guarantee that UPI payment links will open correctly on all devices or UPI applications, that QR codes will be scannable by all UPI apps, that transactions initiated will succeed or settle within any specific timeframe, that the buyer will make payment through the link, or that your bank or the buyer's bank will not impose additional transaction limits or security holds. FLOW is not a party to the UPI payment transaction and does not receive, process, or hold any funds transferred via UPI payment links. The accuracy of your UPI ID (VPA) as saved in your FLOW profile is your sole responsibility — FLOW shall not be liable for payments misdirected due to an incorrect or outdated UPI ID.
The Razorpay OAuth integration is provided as a convenience for invoice import and Razorpay Payment Link generation. We try our best to keep this integration working reliably — but Razorpay is an independent third-party payment service regulated by the Reserve Bank of India, and FLOW has no control over Razorpay's API availability, settlement timelines, transaction limits, KYC requirements, account restrictions, or changes to Razorpay's platform terms or OAuth specifications. Invoice data imported from Razorpay may be incomplete, inaccurate, or delayed — you are responsible for independently verifying all imported data before initiating any dunning or collection action. Razorpay Payment Links created via a connected Razorpay account are subject to Razorpay's own processing and may fail or be declined independently of FLOW. FLOW bears no liability for any transaction, settlement, chargeback, dispute, or loss arising from Razorpay-processed payments or from the unavailability of the Razorpay OAuth integration.
Legal
Version 1.0 | Effective June 27, 2026 | FLOW, New Delhi | Issued under Section 5 & Rule 3, DPDP Act 2023
This DPDP Consent Notice is issued by FLOW ("Data Fiduciary") in accordance with Section 5 and Rule 3 of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is provided to you — the Data Principal — before we collect your personal data, or at the time of seeking consent.
This notice is written in plain, clear language. It tells you exactly: what personal data we collect, why we collect it, who we share it with, how long we keep it, and how to exercise your rights. Please read each Notice block that applies to your interaction with the platform.
This notice is standalone and independently understandable. It is not a replacement for our Privacy Policy (which provides further detail) but is the primary consent document under the DPDP Act. It is available as a standalone page at flowdsoo.com/dpdp-notice.
Under the DPDP Act, 2023, you have the following rights over your personal data processed by FLOW. To exercise any right, contact privacy@flowdso.com. We respond within 30 days.
Note: The right to erasure is subject to mandatory statutory retention periods. KYC and GST-related data must be retained for a minimum of 7 years under applicable Indian law regardless of a deletion request.
This notice applies when you create a FLOW account. Processing is based on your consent, given by clicking "Create Account." You may withdraw this consent at any time (see below).
We do not sell, rent, or trade your registration data. We do not use it for third-party advertising or behavioural profiling.
For the duration of your active account. Upon account closure: 3 years for operational records, after which permanently deleted. Activity and audit logs may be retained up to 7 years where required under GST Act or PMLA.
This notice applies when you complete KYC and link your bank account. Most of this data is collected under legal obligation (PMLA / GST Act) — you cannot request deletion during the 7-year statutory retention period.
Minimum 7 years from the date of your last transaction, as required under PMLA, 2002 and the GST Act. You cannot request deletion of KYC and financial data during this statutory retention period.
This notice is addressed to you, the FLOW user. When you upload your buyers' personal data to FLOW, you are the Data Fiduciary for that data under the DPDP Act. FLOW is your Data Processor. You hold the legal responsibility for having a lawful basis to provide that data to FLOW.
Audit logs of all buyer communications are retained for 7 years for statutory compliance. Buyer contact data is retained for the active life of the relevant invoice plus the statutory retention period. Upon account closure, buyer data not subject to statutory retention is deleted within 90 days.
The DPDP Act requires that withdrawing consent must be as easy as giving it. You gave consent by clicking "Create Account" — you can withdraw it in one step:
Withdrawal of consent does not affect the lawfulness of processing already completed before the withdrawal date.
If you believe FLOW has violated your rights under the DPDP Act and you are unsatisfied with our Grievance Officer's response, you may file a complaint with the Data Protection Board of India (DPBI) — the statutory authority established under Section 18 of the DPDP Act.
The DPBI's public complaint portal will be operational once notified by the Government of India under DPDP Rules, 2025. Until operational, grievances may be directed to the Ministry of Electronics & Information Technology (MeitY). FLOW will update this notice with the DPBI portal link once it is live.
This notice was last updated on June 27, 2026. Material changes to this notice will be communicated to you by email at least 15 days before they take effect.