Privacy Policy

01. Corporate Identity & Scope

This Privacy Policy applies to the software platform, website (flenbox.in), web applications, and services operated by Flenbox Technologies Private Limited ("Flenbox", "Company", "We", "Us", or "Our"), a private limited company incorporated under the Companies Act, 2013, with Corporate Identity Number (CIN) U62099MH2026PTC465568, headquartered in Mumbai, Maharashtra, India.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), Flenbox functions as a Data Fiduciary with respect to the personal data provided by users ("Data Principals") during registration, verification, and cohort participation.

02. Non-Custodial Architecture & Financial Data Immunity

Flenbox operates purely as a Technology Service Provider (TSP). All fund commitments and milestone disbursements execute via programmatic instructions between your bank wallet and peer bank wallets. We do not maintain user balances on our balance sheet, nor do we commingle customer capital.

03. Categories of Data Collected

We collect only the minimum necessary personal data required for identity verification, regulatory compliance, and platform trust scoring:

• Identity & Contact Data: Full legal name, mobile telephone number, email address, date of birth, and postal address.
• Statutory Verification Data: Permanent Account Number (PAN) for statutory TDS reporting under Section 194R of the Income Tax Act, 1961, and Aadhaar verification completed via bank partner e-KYC APIs. (Note: Aadhaar numbers are never stored in plain text by Flenbox; only masked tokens/hashes are retained).
• Financial Identifier Data: Your linked RBI Digital Rupee (e₹) wallet identifier and virtual payment address (VPA) for smart-lock coordination.
• Behavioral Telemetry & Cohort History: Onboarding timestamps, cycle payment punctuality, milestone draw selections, and behavioral trust scores calculated by our proprietary AI matrix.
• Technical & Log Data: IP address, device operating system, browser user-agent, session identifiers, and anti-fraud velocity timestamps.

04. Purpose & Lawful Basis of Processing

Your digital personal data is processed strictly for specified, lawful purposes with your explicit consent:

• Peer Cohort Matching: Grouping users with compatible savings amounts, risk profiles, and behavioral trust tiers.
• Smart-Lock Instruction Generation: Instructing partner bank APIs to execute non-custodial disbursements upon verified milestone conditions.
• Fraud Mitigation & AML Compliance: Detecting suspicious activity, account takeovers, and complying with the Prevention of Money Laundering Act, 2002 (PMLA).
• Statutory Reporting: Computing and deducting mandatory Tax Deducted at Source (TDS) on milestone surplus allocations exceeding ₹5,000 annually.
• Service Communications: Sending milestone reminders, cohort cycle confirmations, and security alerts via SMS, WhatsApp, and email.

05. Zero Commercialization & Data Sharing Restrictions

Personal data is disclosed only in the following strictly limited circumstances:

• Partner Commercial Banks & RBI CBDC Infrastructure: To facilitate bank e-KYC validation and smart-lock escrow execution.
• Wholesale Retail Voucher Partners: Only upon your explicit milestone draw request, to issue brand vouchers (e.g., Croma, Amazon, Flipkart) at discounted wholesale rates.
• Law Enforcement & Regulatory Authorities: When legally mandated under valid Indian court orders, summons, or statutory directions from the Reserve Bank of India or Financial Intelligence Unit (FIU-IND).

06. Sovereign Data Localization & Cryptographic Storage

In accordance with the DPDP Act 2023 and RBI data localization directives:

• All primary relational data, audit ledgers, and telemetry are stored exclusively on secure servers located physically within the territory of India (Mumbai region).
• Double-entry transactions are Merkle-root anchored on our sovereign private EVM cryptographic audit trail, ensuring tamper-evident mathematical immutability without exposing identifiable personal data to public blockchains.
• All data in transit is protected using TLS 1.3 encryption with forward secrecy. All sensitive data at rest is encrypted using AES-256.

07. Your Rights as a Data Principal

Under the DPDP Act 2023, you hold the following statutory rights regarding your personal data:

• Right to Access: You may request a summary of the personal data being processed and the identities of third-party bank partners with whom it has been shared.
• Right to Correction & Erasure: You may request the correction of inaccurate or misleading data, and the deletion of personal data that is no longer necessary for statutory or cycle completion purposes.
• Right of Grievance Redressal: You may file a grievance with our designated Data Protection Officer if you believe your privacy rights have been infringed.
• Right to Nominate: You may designate another individual to exercise your privacy rights in the event of death or incapacity.

08. Cookies & Anti-Bot Protection

Our website uses strictly necessary technical cookies and session storage to maintain authentication state, preserve language preferences, and enforce anti-bot velocity defenses. We do not use intrusive third-party cross-site behavioral tracking cookies.

09. Grievance Redressal & Data Protection Officer

If you have any questions, concerns, or grievances regarding the processing of your personal data or wish to exercise your statutory rights under the DPDP Act 2023, you may contact our designated Data Protection Officer: