Privacy Policy — PayFlow

PayFlow App

# PayFlow Privacy Policy

**Effective date:** October 18, 2026
**Service operator:** PayFlow
**Country of incorporation:** India
**Privacy contact:** care@payflow.co.in

## 1. About this policy

This Privacy Policy explains how PayFlow (“PayFlow,” “we,” “us,” or “our”) collects, uses, stores, and shares personal information when you use the PayFlow mobile application, web application, or related services.

This policy applies to customers, shop owners, and other individuals who use PayFlow.

## 2. Information we collect and process

Depending on how you use PayFlow, we may collect or process the following categories of information:

**Account and contact information**
- Name, phone number, email address, and account role.
- Information used to register, sign in, authenticate, or verify an account.

**Shop and business information**
- Shop name, owner name, business type, city, postal code, and shop code.
- Information about linked shops, account approvals, and subscription status.

**Bills, rewards, and transaction information**
- Submitted bill details and amounts.
- Associations between customers, shops, and transactions.
- Bill review decisions, FlowCash balances and activity, reward redemptions, and related transaction history.

**Subscription and payment information**
- Subscription plan, subscription status, and payment status.
- Razorpay order IDs, payment reference IDs, and related transaction information when online payments are used.

When Razorpay processes an online payment, payment credentials are handled through its payment services. PayFlow records payment references and related status information required to administer subscriptions and reconcile transactions.

**Communications and support information**
- Information you provide when contacting support.
- Details needed to investigate account, bill, reward, subscription, or payment issues.

**Technical and service information**
- Information required for authentication, app functionality, security, troubleshooting, and service maintenance.
- Network, device, and other technical information that may be processed by our hosting, authentication, and other service providers.

Please do not send passwords, payment card details, or one-time verification codes to our support team.

## 3. How we use your information

We use personal information for the following purposes:

- To create, administer, and maintain customer and shop accounts.
- To authenticate users and verify accounts through phone or email verification.
- To connect customers with participating shops.
- To process and review bill submissions, cashback rewards, and redemptions.
- To manage shop subscriptions and related payment transactions.
- To communicate about account access, verification, transactions, support requests, and service changes.
- To detect and investigate suspected fraud, abuse, unauthorized activity, and violations of our terms.
- To maintain service reliability, troubleshoot technical problems, and protect the security of PayFlow.
- To maintain operational and transaction records.
- To comply with applicable laws, regulations, and lawful requests from competent authorities.

We process information for these purposes in accordance with applicable privacy and data protection laws.

## 4. How we share your information

We share personal information only where reasonably necessary to provide PayFlow, support transactions, protect the service, or comply with applicable legal requirements.

**Participating shops**

When you submit a bill, earn or redeem a reward, or otherwise interact with a participating shop, that shop may receive the information necessary to identify the relevant account and process, verify, or review the activity.

**Service providers**

We use third-party providers to support functions such as authentication, email delivery, application hosting, database storage, and payment processing. These providers may process personal information as necessary to provide their services to us.

**Legal, security, and compliance purposes**

We may disclose information when required by applicable law, in response to valid legal process, or where reasonably necessary to investigate fraud, protect users, safeguard PayFlow, or establish, exercise, or defend legal rights.

We do not authorize our service providers to use personal information obtained through PayFlow for purposes unrelated to the services they provide to us, subject to their applicable legal obligations and privacy policies.

## 5. Third-party service providers

PayFlow uses third-party services to support its functionality. The providers identified for the service include:

**Google Firebase Authentication**

Used for authentication and phone verification. Depending on the authentication method, Firebase may process phone numbers and authentication or technical information.

Privacy information: https://firebase.google.com/support/privacy

**Resend**

Used to deliver email verification codes and service-related emails. Resend may process recipient email addresses and message content necessary to deliver those emails.

**Replit and PostgreSQL hosting**

Used for application hosting and database storage. These services may store and process information submitted to or generated by PayFlow.

Replit privacy policy: https://replit.com/privacy-policy

**Razorpay**

Used for optional online subscription payments. Razorpay processes payment information through its payment services and provides PayFlow with payment references and related status information.

Third-party providers process information in accordance with their applicable terms, privacy policies, and service arrangements. Depending on their operations and infrastructure, information may be processed in countries other than the country in which you reside. Where required by applicable law, appropriate safeguards will be used for international transfers of personal information.

## 6. Data retention

We retain personal information for as long as reasonably necessary to provide PayFlow and fulfil the purposes described in this policy.

Retention periods may vary depending on the type of information and the reason it is held, including:

- Maintaining account and service functionality.
- Recording bills, rewards, redemptions, and subscription transactions.
- Resolving disputes and support requests.
- Detecting and preventing fraud or misuse.
- Meeting applicable legal, regulatory, accounting, or recordkeeping obligations.

When information is no longer required for these purposes, we will take appropriate steps to delete it, anonymise it, or otherwise dispose of it in accordance with applicable law, subject to lawful retention requirements and technical limitations.

You may contact us to request access to, correction of, or deletion of personal information associated with your account. We will review and respond to requests in accordance with applicable law. Certain information may need to be retained where legally required or permitted.

## 7. Your privacy rights and choices

Depending on your location and the laws applicable to your information, you may have the right to:

- Request access to personal information we hold about you.
- Request correction of inaccurate or incomplete information.
- Request deletion of personal information, subject to applicable exceptions.
- Request a copy of your personal information where such a right applies.
- Object to or request restriction of certain processing activities.
- Withdraw consent where processing is based on consent.
- Exercise any additional rights provided by applicable data protection laws.

To submit a privacy request, contact us at **care@payflow.co.in**.

We may request information to verify your identity and protect your account before processing a request. We will handle requests within the time limits and subject to the requirements established by applicable law.

## 8. Information security

We use reasonable safeguards intended to protect personal information against unauthorized access, disclosure, alteration, loss, or misuse.

However, no method of electronic transmission, internet communication, or data storage can be guaranteed to be completely secure.

You are responsible for protecting your sign-in credentials and keeping verification codes confidential. If you suspect unauthorized access to your account, please contact us promptly.

## 9. Children's privacy

PayFlow is intended for individuals aged 18 or older, in accordance with the service's eligibility requirements.

We do not knowingly seek to collect personal information from individuals under 18. If a parent or legal guardian believes that a minor has provided personal information to PayFlow, they may contact us at the privacy contact address below. We will review the request and take appropriate action in accordance with applicable law.

## 10. Local storage and web application use

When you access PayFlow through a web browser, your browser or device may store essential session, authentication, or application data required for the service to function correctly.

This policy covers essential storage associated with the service as described above. It does not, by itself, constitute consent to optional advertising, analytics, or tracking technologies. Any such technologies, if introduced, will be addressed in accordance with applicable legal requirements.

## 11. Changes to this policy

We may update this Privacy Policy to reflect changes to PayFlow, our information-handling practices, or applicable legal requirements.

When we make changes, we will update the effective date and provide notice through the service or by other appropriate means where required or appropriate.

The latest version of this policy will be made available wherever PayFlow publishes its Privacy Policy. Your continued use of PayFlow is subject to the applicable terms and legal requirements governing the service.

## 12. Contact us

For privacy questions, requests concerning personal information, or concerns about this policy, contact:

**PayFlow**
Privacy Contact
**Email:** care@payflow.co.in
**Country:** India