Privacy Policy

FlowKartAI is a WhatsApp ordering platform for B2B distributors and wholesalers, operated by Grentholix (“FlowKartAI”, “we”, “us”). We are the data fiduciary (controller) for personal data you give us directly, such as your account details.

For the order and conversation data that flows through the platform from your own retailers, you are the fiduciary and we act as a data processor on your instructions. In plain terms: your customer list is yours, not ours.

FlowKartAI has not launched. Today the only personal data we process is what you type into the waitlist or contact form on this website. The sections below describe the full platform so you can see what you would be agreeing to at sign-up, but the product sections do not apply to anyone yet.

We never receive or store full card numbers, CVVs or UPI credentials. Those go directly from you to our payment processors.

• To provide, operate, secure and improve the service.
• To take payment and issue GST-compliant invoices.
• To send service messages — security alerts, billing notices, outage and maintenance notifications. You cannot opt out of these while you hold an account, because they are part of the service.
• To send launch and product updates, if you asked for them. Every one of these has an unsubscribe link, and using it does not affect your account.
• To detect and prevent fraud, spam and abuse of the platform.
• To meet legal, tax and accounting obligations.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (running your account); legitimate interests (security, fraud prevention, aggregate analytics); consent (marketing email, and processing of voice notes); and legal obligation (tax records).

Under India's Digital Personal Data Protection Act 2023 we rely on your consent, and on the “legitimate uses” provision for the data needed to deliver a service you asked for.

We do not sell personal data, and we do not share it for anyone else's advertising. We use the service providers below to run the platform. Each is bound by a data processing agreement.

We will also disclose data where we are legally required to, and to an acquirer if the business is sold — in which case we will tell you before your data moves.

Some providers above operate outside your country. Where personal data leaves the EEA or UK, we rely on Standard Contractual Clauses or an adequacy decision. Indian customer data is hosted in an Indian region where the provider offers one.

• All traffic is encrypted in transit with TLS.
• Credentials and access tokens are encrypted at rest with AES-256.
• Passwords are stored using a one-way hash. Nobody at FlowKartAI can read your password.
• Access to production data is restricted to the engineers who need it, and is logged.
• Public endpoints are rate limited to blunt automated abuse.

If we discover a personal data breach, we will notify the Data Protection Board of India and affected users without undue delay, as the DPDP Act requires.

We use Vercel Web Analytics, which is cookieless: it records page views and approximate country without setting a tracking cookie or building a cross-site profile of you. We do not run advertising pixels or third-party trackers on this site.

The only cookies we set are strictly necessary ones — a session cookie once you log in, and a CSRF token. These do not require consent, which is why you are not being shown a cookie banner.

• Access — get a copy of what we hold about you.
• Correction — fix anything inaccurate or incomplete.
• Erasure — have it deleted, except where we must keep it by law.
• Withdraw consent — at any time, including for voice note processing and marketing.
• Portability — receive your data in a machine-readable format.
• Grievance redressal — escalate to our Grievance Officer, and then to the Data Protection Board of India if you are not satisfied.

Write to privacy@flowkartai.com. We will respond within 30 days. We do not charge for this, and we will not treat you differently for asking.

FlowKartAI is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to privacy@flowkartai.com and we will delete it.

If we make a material change we will email account holders at least 14 days before it takes effect, and update the date at the top of this page. Continuing to use the service after that date means you accept the revised policy.

Grentholix — operator of FlowKartAI

• Privacy and data rights: privacy@flowkartai.com
• Legal notices: legal@flowkartai.com
• Grievance Officer (DPDP Act 2023): privacy@flowkartai.com

A registered business address will be published here once the entity is incorporated. Until then, email reaches us fastest.