Privacy policy
Last updated: 26 Sep, 2026
This Privacy Policy explains what personal data Flowlyf collects, why, who we share it with, how long we keep it, and the rights you have over it. It applies to www.flowlyf.com (the "Website") and to your conversations with us on WhatsApp, email and phone. Please read it together with our Terms of Service.
We handle personal data in line with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it.
1. Who we are
The Website is operated by Flowlyf India Private Limited ("Flowlyf", "we", "us", "our"), 2, Shambhu Dayal Marg, Kalkaji Road, New Delhi – 110020. For personal data you share with us, Flowlyf is the "Data Fiduciary" under the DPDP Act. If you have questions about your data, contact our Grievance Officer (Section 13).
2. What we collect
Information you give us
- Order and account details: name, phone number, email address, billing and delivery address, and GSTIN if you want a business invoice.
- Support and claims: messages, photos and videos you send us on WhatsApp, email or phone. This includes photos of a damaged delivery or a warranty issue.
- Reviews and content: ratings, reviews, photos or videos you choose to share about our products.
- Marketing preferences: whether you have opted in to marketing messages.
Information collected automatically
- Device and usage data: IP address, browser and device type, pages viewed, products added to cart, and how you arrived at the Website.
- This data is collected through cookies and similar technologies (see Section 6).
Payment information
Payments are processed by our payment partner, Razorpay, including through Razorpay Magic Checkout. We do not receive or store your full card number, CVV, UPI PIN or net-banking password. Razorpay may pre-fill your saved phone number and address at checkout under its own privacy policy and your consent to it.
We do not ask for, and you should not send us, sensitive information such as passwords, government ID numbers or health information.
3. Why we use it
| Purpose | Data used | Basis |
|---|---|---|
| Process, deliver and invoice your order | Order and account details | You provide it to buy from us (DPDP Act, s.7(a)) |
| Order updates, delivery coordination, returns, refunds and warranty claims | Contact details, order details, support messages and media | You provide it for this purpose (s.7(a)) |
| Keep tax and accounting records | Order, invoice and payment records | Required by law, including GST law |
| Prevent fraud and misuse; keep the Website secure | Order details, device and usage data | Legitimate use and legal obligations |
| Send offers and product news by email, SMS or WhatsApp | Contact details, purchase history | Your consent, which you can withdraw at any time |
| Measure and improve our advertising on Google and Meta, and understand how the Website is used | Device and usage data, hashed contact details where applicable | Your consent, where required by law |
| Publish your review | Review content, first name and city | Your consent when you submit it |
We do not sell your personal data.
4. Who we share it with
We share personal data only with service providers that help us run the business. They process it on our behalf and only for the purposes above.
| Provider | What they do | Location of processing |
|---|---|---|
| Shopify | Hosts the Website, orders and customer records | United States and other countries |
| Razorpay | Payments and checkout | India |
| Gati | Shipping and delivery | India |
| Interakt (on the WhatsApp Business Platform by Meta) | WhatsApp order updates and customer support | India and other countries |
| Advertising, shopping listings and website analytics | United States and other countries | |
| Meta (Facebook and Instagram) | Advertising and ad measurement | United States and other countries |
We may also share personal data:
- with a technician or installation partner, where we arrange a repair or installation for you;
- with our professional advisers, such as auditors and lawyers;
- with government authorities or courts, when the law requires it; and
- with a buyer or successor, if Flowlyf's business is merged or sold. This Policy will continue to protect your data, and we will tell you before your data becomes subject to a different policy.
5. Data stored outside India
Some of our providers, including Shopify, Google and Meta, store or process data outside India. The DPDP Act permits such transfers except to countries the Government of India restricts. We use only established providers bound by contractual data-protection commitments.
6. Cookies and similar technologies
We use cookies and similar technologies for these purposes:
- Essential: keep your cart and checkout working, and keep the Website secure.
- Analytics: understand which pages are useful and where the Website can improve.
- Advertising: Google and Meta tags help us measure whether our ads work and show relevant ads to people who have visited the Website.
You can block or delete cookies in your browser settings. Blocking essential cookies may stop the cart or checkout from working. You can also manage ad personalisation in your Google Ad Settings and Meta Ad Preferences. Where the law requires your consent for non-essential cookies, we will ask for it before they are set.
7. Marketing messages
- We send marketing by email, SMS or WhatsApp only if you have opted in, for example by ticking the box at checkout. The box is never pre-ticked.
- You can opt out at any time. Use the unsubscribe link in any email, reply STOP on WhatsApp, or write to hi@flowlyf.com. Opting out is as easy as opting in.
- Even after you opt out, we will still send messages about your orders, deliveries, returns and warranty claims.
- We do not make promotional calls or send promotional SMS to numbers on the National Do Not Call registry unless you have specifically asked us to.
8. How long we keep it
- Orders, invoices and payment records: for as long as tax and accounting laws require. Under GST law, this is currently 72 months from the due date of the annual return for the relevant year.
- Warranty and support records: for the warranty period of your product, plus [CONFIRM: e.g. 1 year] to handle any follow-up claims.
- Marketing consent and preferences: until you withdraw consent, plus the period needed to show that consent was given.
- Website analytics and advertising data: for the retention periods set in the relevant Google and Meta tools.
When data is no longer needed, we delete or anonymise it, unless the law requires us to keep it longer.
9. Your rights
Under the DPDP Act, you have the right to:
- Access: a summary of the personal data we hold about you and how we use it, and the names of the providers we have shared it with;
- Correction: correct, complete or update inaccurate or incomplete data;
- Erasure: have your data deleted, unless we must keep it by law (for example, invoices);
- Withdraw consent: for marketing or any other use based on consent, at any time. Withdrawing does not affect use before withdrawal;
- Grievance redressal: raise a complaint with our Grievance Officer (Section 13); and
- Nomination: nominate another person to exercise these rights if you die or become unable to act.
To use any of these rights, write to vb@flowlyf.com. We may ask you to verify your identity, for example with your order number and the phone number on the order. We will respond within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
10. Children
The Website is meant for adults. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or guardian. We do not track, or target ads at, children. If you believe a child has given us personal data, contact us and we will delete it.
11. Security
We take reasonable security safeguards to protect personal data. These include:
- encrypted (HTTPS) connections across the Website;
- payment handling by a PCI-DSS compliant payment partner;
- limiting access to people who need it; and
- working only with providers that keep data secure.
No system is completely secure. If a personal data breach occurs, we will inform you and the Data Protection Board of India as the law requires.
12. Links to other websites
The Website may link to other sites, such as marketplaces, social media or payment pages. Their own privacy policies apply, and we are not responsible for how they handle your data.
13. Grievance Officer and contact
For any question, request or complaint about your personal data, contact:
- Name: Vaibhav Bhalla
- Designation: Chief Executive Officer and Grievance Officer
- Email: vb@flowlyf.com
- Phone: +91 98108 19723
- Address: Flowlyf India Private Limited, 2, Shambhu Dayal Marg, Kalkaji Road, New Delhi – 110020
- Hours: Mon–Sat, 10:00–18:00 IST
We will acknowledge your complaint within 48 hours and resolve it within one month.
14. Changes to this Policy
We may update this Policy when our practices or the law change. The updated version will be posted on this page with a new "Last updated" date. If we make a significant change to how we use your personal data, we will also tell you by email or WhatsApp before it takes effect.
15. Governing law
This Policy is governed by the laws of India. Subject to your rights under consumer and data-protection law, the courts at New Delhi have jurisdiction.