LoginBook a demo
Legal

FlowMitra Privacy Policy

Last updated: 19 October 2026

This policy explains how The Mastermind Inc ("FlowMitra", "we"), handles personal data in FlowMitra. It is written to follow India's Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Who is responsible

  • Businesses that use FlowMitra ("Customers") decide whose data goes into their FlowMitra copy and why. For their staff's data, the Customer is the Data Fiduciary, and FlowMitra processes that data on the Customer's behalf as a Data Processor.
  • For the details of the Customer's own contact person and billing, FlowMitra is the Data Fiduciary.
  • If you are a staff member of a Customer, please contact your employer first about your data. We will help them respond.

2. What we collect

Inside a Customer's FlowMitra copy (entered by the Customer and its staff): - Name, mobile number, department, role, optional email address, optional WhatsApp group ID, optional birthday and profile photo. - A PIN for login — stored only in scrambled (hashed) form; we cannot read it. - Work records: tasks, flow steps, entries typed into forms, photos and files uploaded as proof, deadlines, times of completion, leave requests (dates, reason, backup), requests for more time, and the resulting scores. - Alert records: which WhatsApp or email alerts were sent and whether they were delivered. - Questions typed into the in-app help. - Technical data: a login cookie (to keep you signed in), and server logs such as time and type of request. We do not use advertising or tracking cookies.

About Customers: business name, contact person, phone, email, city, plan, billing and payment records, and app usage counts (number of active users, tasks and jobs) used to manage the subscription.

3. Why we use it

  • To run FlowMitra for the Customer: show work to the right person, send WhatsApp and email alerts, calculate scores, manage leave, and produce reports.
  • To provide support, fix problems and keep the service secure.
  • To manage subscriptions: user limits, renewals, invoices.
  • To improve FlowMitra using usage counts and feedback — not by reading your photos or entries. We do not sell personal data, and we do not use Customer Data for advertising.

4. Who we share it with

We share data only with service providers who help run FlowMitra, and only as needed: - Hosting: our servers are hosted by Hostinger (data centre in India). - WhatsApp sending: the WhatsApp provider the Customer chooses (for example BotMaster) receives the recipient number and alert text. - Email sending: the Customer's own email provider (for example Google Gmail) receives the recipient address and alert text. - Help assistant: the question typed into help, and whether the person is an admin or staff member, are sent to Anthropic (an AI provider in the USA) to generate an answer. No other Customer Data is sent. Do not type personal information into help. - Holiday list reading: if an admin uploads a holiday list (sheet, PDF or photo) and asks FlowMitra to read it, that file is sent to Google's Gemini AI service to extract the dates. - Authorities: when required by law or a valid order. Some providers may process data outside India, as permitted under the DPDP Act.

5. How long we keep it

  • Photos, files and form entries of finished work are deleted automatically after the number of days set by the Customer (default 90). A one-line summary and the scores are kept while the subscription is active.
  • Running work is kept until it is finished or cancelled.
  • When a subscription ends, Customer Data is kept for 30 days (to allow renewal or export) and then permanently deleted.
  • Help questions and alert logs are kept for up to 12 months for support and abuse prevention.
  • Billing records are kept as long as tax law requires.

6. How we protect it

  • Each Customer has a separate copy and separate database; one Customer cannot see another's data.
  • All connections use HTTPS encryption. PINs are hashed. Access to servers is limited to authorised people.
  • Customers control who has access, can switch users off, and can delete old data from the Admin page. No system is perfectly secure. If a personal data breach occurs, we will inform the affected Customer without delay and support them in informing the Data Protection Board and affected people as the DPDP Act requires.

7. Your rights

Under the DPDP Act you may ask to: - know what personal data is held about you and how it is used; - correct or update inaccurate data; - erase data that is no longer needed, subject to legal requirements; - withdraw consent where processing is based on consent; - nominate another person to exercise your rights in case of death or incapacity; - raise a grievance. Staff members should first contact their employer (the Customer). You may also contact our Grievance Officer below; we respond within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.

8. Children

FlowMitra is for businesses and their adult staff. It is not meant for people under 18, and Customers must not add them as users.

9. Changes

We may update this policy. The date at the top shows the latest version. Significant changes will be told to Customers in advance.

10. Grievance Officer and contact

Mohit Anand, Grievance Officer · The Mastermind Inc, Mayapuri, New Delhi · WhatsApp 99660 16016 · hello@flowmitra.in