Privacy Policy

1. Data Fiduciary & Overview

This Privacy Policy applies to the personal information collected, processed, and safeguarded by Flovo (“Flovo”, “we”, “us”, or “our”), acting as a Data Fiduciary under the Digital Personal Data Protection Act (DPDPA 2023) of India and as a Data Controller under applicable international privacy regulations.

Flovo operates the website https://flovo.in and provides technology engineering, cloud solutions, and automation services. For any questions regarding our privacy standards, you can contact our designated privacy team at [email protected].

2. Information We Collect

We adhere strictly to the principle of data minimization, collecting only information necessary for legitimate operational and engineering purposes:

A. Information You Provide Directly

• Project Inquiries & Consultations: When you submit our contact form, request an architectural review, or communicate via email, we collect your name, business email address, phone/WhatsApp number, organization name, role, and the technical details of your project requirements.
• Client Engagements & Invoicing: In the course of executing an agreement, we collect billing contact details, company registration or GSTIN numbers, authorized signatory information, and bank wire/payment remittance records.
• Career & Recruitment Applications: If you apply for a role with Flovo, we collect your resume, portfolio links, GitHub username, work history, and any supporting documentation you submit voluntarily.

B. Automated Technical Telemetry

• Diagnostic Server Metadata: When you browse flovo.in, our servers automatically log non-identifying technical metadata including your browser type, device operating system, referring URL, pages viewed, and anonymized IP address (truncated to country/region level for routing optimization).
• Application Performance: We collect aggregated diagnostic traces to detect broken routes, optimize page rendering speeds, and defend against automated brute-force or denial-of-service attempts.

C. Information We Do NOT Collect

We firmly avoid intrusive surveillance:

• We never collect sensitive biometric, religious, philosophical, or health data;
• We never collect or store payment card numbers on our servers;
• We do not purchase or enrich user profiles from third-party data broker networks.

3. Legal Grounds & Purposes of Processing

Flovo processes personal data only where a recognized lawful basis exists:

• Contractual Necessity: To scope project proposals, prepare Statements of Work, configure cloud environments, communicate during engineering sprints, and deliver software deliverables.
• Legitimate Business Interests: To maintain the security and integrity of our systems, prevent fraudulent activity, improve our web performance, and document commercial agreements.
• Consent: Where you have explicitly opted in to receive technical updates, open-source releases, or direct advisory communications. You may withdraw consent at any time.
• Statutory Compliance: To comply with mandatory taxation, financial auditing, and statutory record-keeping obligations under applicable Indian law.

4. Cookies & Local Storage

Flovo maintains an ultra-clean, privacy-respecting web experience:

• Essential Local Storage: We use browser localStorage solely to persist your visual theme preference (dark mode vs. light mode) across browsing sessions.
• Zero Third-Party Advertising Trackers: We do not deploy Facebook Pixels, Google Remarketing, LinkedIn Insight Tags, or cross-site tracking scripts.
• Self-Hosted Assets: All typography (such as Inter and DM Mono) and icons are bundled directly within our Next.js application, preventing third-party ad networks from monitoring your font requests.

5. Data Sharing & Technical Subprocessors

We do not sell, rent, or monetize your information. We share personal data only with vetted technical subprocessors strictly required to operate our digital infrastructure:

• Hosting & Edge Infrastructure: Vercel Inc. and Amazon Web Services (AWS) for secure application hosting, edge routing, and cloud database persistence, operating under enterprise Data Protection Agreements (DPAs).
• Transactional Email & Communications: Secure email infrastructure providers supporting end-to-end transport layer security (TLS 1.3) for delivering proposals, project updates, and support responses.
• Statutory Disclosures: We disclose personal data only when strictly compelled by a valid court order, government warrant, or regulatory requirement under Indian law.

6. International Data Transfers

While Flovo is headquartered in Bengaluru, India, certain technical services (such as distributed edge CDNs or version control repositories) may process encrypted data across geographic boundaries. Where international transfers occur, we ensure robust safeguards including Standard Contractual Clauses (SCCs), industry-standard encryption, and zero-knowledge architecture controls.

7. Data Retention & Erasure Schedule

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected:

• Prospective Project Inquiries: Inactive technical inquiries and project briefs that do not lead to an engagement are systematically reviewed and purged after twenty-four (24) months.
• Active Client Records: Client contracts, engineering specifications, and deployment documentation are retained for the duration of the commercial relationship plus applicable statutory limitation periods.
• Financial & Tax Records: Invoices and transaction logs are retained for seven (7) years to comply with statutory accounting and Goods and Services Tax (GST) obligations.
• Job Applications: Candidate resumes are retained for up to twelve (12) months for recruitment opportunities, unless earlier erasure is requested.

8. Technical & Organizational Security Standards

Security is an integral part of our software engineering culture:

• Transport Encryption: All web traffic is strictly served over HTTPS utilizing TLS 1.3 encryption, HTTP Strict Transport Security (HSTS), and secure modern ciphers.
• Access Controls & MFA: Production environments, client staging servers, and internal tools enforce the Principle of Least Privilege, role-based access control (RBAC), and hardware-backed multi-factor authentication (MFA).
• Dependency & Vulnerability Scanning: Continuous automated audits monitor codebases for common vulnerabilities, package deprecations, and infrastructure misconfigurations.

9. Your Legal Rights (DPDPA 2023 & Global Standards)

Under India's Digital Personal Data Protection Act (DPDPA 2023) and international privacy frameworks, you enjoy defined statutory rights regarding your personal data:

• Right to Access & Summary: You may request confirmation of whether we process your data and receive a clear summary of what information is held.
• Right to Correction & Updating: You may request the rectification of inaccurate, incomplete, or outdated personal information.
• Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data where continuing to retain it is no longer justified by contractual necessity or statutory compliance.
• Right to Withdraw Consent: You may revoke consent for optional communications at any time with immediate effect.
• Right to Nominate: Under DPDPA 2023, you have the right to nominate an individual to exercise your privacy rights in the event of death or incapacity.

To exercise any of these rights, email us directly at [email protected]. We verify requests promptly and respond within thirty (30) days without charge.

10. Revisions & Notifications

We may update this Privacy Policy periodically to reflect enhancements in our digital infrastructure, new engineering offerings, or statutory updates. When revisions occur, the updated version will be published on this page with a revised effective date.