How We Handle Your Data

1. Introduction and Corporate Scope

Clearflow Digital Private Limited ("Clearflow", "we", "us", or "our"), incorporated under the laws of India, operates various technology products and services, including the flagship application Spendly.

We are committed to processing your digitised personal data in accordance with the Digital Personal Data Protection (DPDP) Act 2023 of India and other applicable global standards for transparency and security.

2. Data Processing Principles

Clearflow adheres to the following principles for all data processing activities:

• Lawfulness and Fairness: Data is only processed for legitimate purposes defined at the time of collection.
• Transparency: We maintain clear channels for users to understand how their data is being handled.
• Data Minimization: Our products, particularly Spendly, are designed with a "minimal server-side footprint" philosophy.
• Purpose Limitation: Data collected for one product (e.g., support) is not misused for unrelated corporate purposes.
• Integrity: We use robust technical measures to prevent unauthorized access or loss.

3. Categories of Personal Data Collected

3.1. Contact and Inquiry Information

We collect your name, email address, and any professional details you provide when using our corporate contact forms or seeking support for our products.

3.2. Spend Signal Data Handling - Transactional UPI Messages Only

Spendly operates by reading UPI transaction confirmations sent to your device by your bank or payment processor. The app requests the Android READ_SMS permission solely to identify and parse inbound UPI payment confirmation messages.

Spendly only reads messages that match transactional UPI patterns. Messages containing standard bank notification keywords ("debited", "credited", "UPI", "IMPS", "NEFT") from bank spend signal sender IDs. It never reads:

• Personal conversations or chat messages
• OTPs (one-time passwords) of any kind
• Non-financial messages, promotional messages, or spam
• Messages from unknown or non-bank senders

On-device processing: All spend signal parsing and transaction categorisation happens locally on your device. Raw spend signal text is never transmitted to our servers. Only structured, anonymised metadata - transaction amount, inferred merchant category, date, and UPI app used - is optionally backed up to our secure Firebase / Firestore cloud infrastructure, and only when you have explicitly opted in to Cloud Backup.

No raw spend signal content is ever stored on Clearflow Digital's servers. You may revoke the Spend Signal permission at any time through your device settings.

3.3. Usage and Technical Intelligence

To secure our backend infrastructure, we collect technical metadata, including hashed IP addresses, device identifiers, and operational logs. This data is used to prevent DDoS attacks, fraud, and service interruptions.

4. Legal Grounds for Processing

In alignment with the DPDP Act 2023, Clearflow processes data based on:

• Specified Consent: Explicit permission granted by users for product features.
• Legitimate Interests: Necessary processing for system security and operational integrity.
• Legal Obligations: Compliance with statutory requirements in India.

5. Why We Process Your Data

• Service Delivery: To operate our software-as-a-service platforms and provide user-requested insights.
• Research and Development: To improve our proprietary algorithms and user interface designs.
• Security and Fraud Prevention: Protecting our infrastructure and users from cyber threats.
• Customer Relations: Responding to support tickets and business inquiries.

6. Data Storage, Retention, and Deletion

Your data is stored securely in encrypted cloud environments provided by Google Cloud Platform (Cloud Firestore, Firebase Authentication). We retain your information only as long as necessary to fulfill the purposes for which it was collected.

Account Deletion: You may delete your account and all associated data at any time through your account settings page. Deletion is immediate and irreversible. Backup data is purged within 30 days.

Data Portability: You may request a machine-readable export of your processed data (spend patterns, categories, and metadata) by contacting us. We will fulfil export requests within 14 calendar days of identity verification.

7. Third-Party Partners and Transfers

Clearflow does not sell user data. We engage third-party processors only for essential operations:

• Infrastructure: Firebase (Google LLC).
• Payments: Google Play Billing for Spendly in-app subscriptions.
• AI Services: Google Gemini API for customer support chatbot.

8. Your Rights Under DPDP Act 2023

As a Data Principal under Indian law, you have the right to:

• Access a summary of your personal data being processed.
• Correct or update inaccurate or incomplete data.
• Withdraw consent for future processing.
• Request erasure of your personal data.
• Nominate a person to exercise your rights in the event of death or incapacity.
• Lodge a grievance with our designated officer.

9. Grievance Redressal

In compliance with Section 10 of the DPDP Act, we have designated a Grievance Officer to address your concerns:

Grievance Officer: Samar Pratap Singh Sisodia
Entity: Clearflow Digital Private Limited
Email: support@clearflowdigital.in

10. Children's Privacy

Our products are not directed at children under 18. In compliance with the DPDP Act 2023, we do not knowingly collect or process personal data of children without verifiable parental consent. If we become aware that data from a child has been collected without such consent, we will delete it promptly. Guardians may contact our Grievance Officer to report any concerns.

11. Updates to this Policy

We may modify this Policy as our services evolve. The "Effective" date at the top indicates the latest version. We encourage you to review this page periodically. Material changes will be communicated via email or through our services.