Privacy Policy

1. Introduction & Commitment

At FeeFlow Technologies Pvt. Ltd. ("FeeFlow", "we", "us", "our"), we take your privacy and the privacy of your enrolled members, students, and patients with the utmost seriousness. This Privacy Policy details our policies regarding the collection, use, disclosure, and protection of personal data when you use our multi-tenant SaaS application.

2. Roles Under Data Protection Laws

In accordance with modern privacy standards:

• Tenant as Data Fiduciary / Controller: The Tenant (your business, gym, school, or clinic) is the Data Fiduciary regarding the member data uploaded to FeeFlow. You determine the purpose of fee collection reminders.
• FeeFlow as Data Processor: FeeFlow acts solely as a Data Processor, executing automated message dispatch, balance tracking, and receipt delivery on behalf of the Tenant.

3. Information We Collect

We collect and process the following categories of data:

• Tenant Account Data: Business name, business category, administrator name, email address, password hash (salted using bcrypt), phone number, and billing details.
• Member Data (Provided by Tenant): Member/student full name, guardian/father name, WhatsApp phone number, residential address, email, outstanding fee amount, due dates, and notes.
• WhatsApp Communication Data: Meta Message IDs, dispatch timestamps, delivery status (sent, delivered, read), error codes, and incoming member replies.
• Technical & Usage Data: IP addresses, browser types, audit logs, and authentication tokens stored in secure, encrypted httpOnly cookies.

4. Strict Multi-Tenant Isolation & Zero Cross-Access

Every database record in FeeFlow contains a mandatory tenantId foreign key constraint. Our API architecture enforces tenant scoping at both the routing and database query layer:

• No tenant can query, view, or modify records belonging to another tenant.
• Webhook event processing maps incoming Meta notifications strictly to the specific Tenant's registered WhatsApp phone number ID.
• Member data is never pooled, cross-analyzed, or shared among different tenants.

5. How We Use Your Data

We process information strictly for legitimate business purposes:

• To deliver automated and personalized WhatsApp fee notifications.
• To reconcile payments and maintain transparent fee collection records.
• To authenticate user logins and protect against brute-force attacks via sliding-window rate limiting.
• To provide live analytics (read rates, delivery rates, overdue totals) on your dashboard.
• To comply with regulatory obligations under Indian law.

6. WhatsApp Cloud API & Third-Party Services

FeeFlow integrates with Meta's official WhatsApp Business Cloud API. When reminders are dispatched, message text and recipient numbers are transmitted to Meta Graph API endpoints under TLS 1.3 encryption.

We do not sell, rent, or trade your data to third-party advertisers, data brokers, or marketing networks.

7. Data Security Measures

We implement industry-grade technical and organizational security safeguards:

• Encryption in Transit: All HTTP traffic is protected by HTTPS / TLS with strict security headers (Content-Security-Policy, HSTS, X-Content-Type-Options: nosniff).
• Token Security: Session authentication uses short-lived JWT access tokens (15-minute validity) paired with cryptographically secure, httpOnly, SameSite refresh tokens.
• Password Protection: Passwords are never stored in plaintext and are salted and hashed using bcrypt (12 rounds).

8. Data Retention & Right to Erasure

Retention: We retain tenant and member records for as long as your tenant account remains active and in good standing.

Right to Erasure (Right to be Forgotten): Tenants may delete individual member records at any time from the dashboard, which cascades and deletes all associated message logs and payments. Upon tenant account termination, all tenant data is scheduled for complete permanent deletion within 30 days.

9. User Rights (Access, Rectification, Portability)

Under the DPDP Act 2023 and GDPR, you have the right to:

• Access all personal and tenant data stored in your account.
• Rectify inaccurate or outdated member balances and phone numbers.
• Export your members directory at any time in Excel/CSV format.
• Withdraw consent and request account deletion.

10. Data Protection Officer (DPO) Contact

For questions regarding this Privacy Policy or to exercise your data protection rights, please contact our Data Protection Officer:

Data Protection Officer (DPO)
FeeFlow Technologies Pvt. Ltd.
Email: privacy@feeflow.in | dpo@feeflow.in
Indiranagar, Bengaluru, Karnataka 560038, India