Privacy Policy

1. Who we are

InstiFlow ("we", "us") is a fee management platform built for Indian coaching institutes. This policy explains what personal data we collect, why, and what rights you have. It is written in plain language and reflects our obligations under India's Information Technology Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDPA).

2. Information we collect

We collect three categories of data:

a. Account information

When you create an account: your name, email address, institute name, phone number, and password (stored hashed). When you join a waitlist: your email address only.

b. Institute & student data

When you use the Service: student names, parent contact details, batches, fee amounts, payment records, attendance markers (if used), and reminder logs. This data is uploaded by you on behalf of your institute.

c. Usage & device data

Standard logs: IP address, browser type, pages visited, timestamps. We use this for security, debugging, and improving the Service.

3. How we use this data

• To provide the Service (display your dashboard, send reminders, generate receipts);
• To process subscription payments and issue invoices;
• To send service-related emails (account, billing, security);
• To improve the Service and diagnose issues;
• To comply with legal obligations.

We do not sell, rent, or share your data with advertisers. We do not use student/parent data for marketing.

4. Third parties we work with

To run the Service we use specialised vendors who process data on our behalf:

• Payment processing: Razorpay (for paid subscriptions)
• WhatsApp delivery: licensed WhatsApp Business API providers
• Cloud hosting: Vercel (frontend) and AWS Mumbai region (backend & database)
• Transactional email: a third-party email delivery service for account and billing notifications

These vendors are contractually bound to use your data only to provide their service to us, and to apply reasonable security measures. We may add or change vendors as the Service evolves; this policy will be updated accordingly.

5. Data storage & security

Data is stored on encrypted servers in India (AWS Mumbai region). We use TLS/HTTPS for all data in transit, hashed passwords, and access controls. No system is perfectly secure, but we apply industry-standard practices.

6. Data retention

We keep your data for as long as your account is active. If you cancel your subscription, you may export your data for 30 days; after that, we may delete it. Backups are retained for a further 90 days then purged.

7. Your rights

Under the DPDPA, you may:

• request access to the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data (subject to legal/tax-record exceptions);
• withdraw consent for processing (this will limit what the Service can do);
• file a grievance with our Grievance Officer or escalate to the Data Protection Board of India.

8. Students & minors

The Service is used by institute administrators to manage student records. Students themselves do not have accounts. Where student data involves minors, the institute (as the data fiduciary in that relationship) is responsible for obtaining parental consent. We process this data only as instructed by the institute and in line with the consent provisions of the Digital Personal Data Protection Act, 2023.

9. Cookies

We use only essential cookies — for session authentication and CSRF protection. We do not use third-party advertising or tracking cookies.

10. Grievance Officer

In line with the Information Technology Rules, 2011, and DPDPA 2023, concerns about data handling can be raised with:

Name: Kashyap
Designation: Founder & Grievance Officer
Email: hello@instiflow.in
Response time: within 30 days of a written complaint.

11. Changes to this policy

We may update this policy as the Service evolves or as the law changes. Material changes will be emailed to account holders and shown on this page with a new "Last updated" date.

12. Contact

For privacy questions: hello@instiflow.in.