Privacy Policy

FLICP TECHNOLOGIES PRIVATE LIMITED ("Flicp", "we", "us") is the Data Fiduciary under the DPDP Act, 2023 in respect of personal data processed through the Platform. Registered office: 4th Floor, Xeno Space, No. 28 & 50, Arunodaya Colony, Madhapur, Hyderabad, Telangana – 500081, India. CIN: U62011TS2026PTC214611.

Contact for privacy matters: help@flicp.com

From Consumers:

• Identity: name, email address, mobile number
• Account data: encrypted password hash, login timestamps, device identifiers
• Transaction data: coupons claimed, redeemed, Sparks balances, redemption timestamps
• KYC data (where applicable): government-issued ID type and verification status (raw documents processed by DIDIT, not stored by Flicp beyond legal requirements)
• Usage data: pages visited, feature interactions, browser/device type, IP address
• Communications: support tickets, feedback, WhatsApp interaction logs (where WhatsApp is enabled)

From Brand Owners and Employees:

• Business identity: brand name, GSTIN, PAN, registered address, business category
• Contact details: name, work email, mobile number
• Financial data: billing details, payment method tokens (stored by payment gateway, not by Flicp), invoice history
• Operational data: campaigns created, coupon issuance and redemption records, employee role assignments, audit logs

Automatically collected: cookies, log files, session identifiers. See Section 10 (Cookies).

We do not collect: biometric data, financial account numbers, Aadhaar numbers (only KYC verification status is retained after DIDIT processing).

Where we rely on consent as the legal basis, we will obtain it through a clear, affirmative action (checkbox, button tap, or equivalent) at the point of collection. You may withdraw consent at any time by contacting help@flicp.com or adjusting your account settings. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

Consent records (timestamp, version of consent notice, data categories consented to) are logged and retained for a minimum of three years to demonstrate compliance.

Flicp shares personal data only as follows:

• Brands (for Consumer redemption data): Brands receive redemption event data for their own coupons only, limited to the minimum necessary for fulfilment and audit.
• DIDIT: Identity documents for KYC processing under DIDIT's privacy policy.
• Payment gateway: Payment processing data under the payment gateway's privacy policy. Flicp does not store card numbers or bank account details.
• WhatsApp / Meta: Message content and phone numbers where you have opted in to WhatsApp communications.
• Cloud / Infrastructure providers: Hosting providers operating under data processing agreements with adequate security controls. Data is hosted in Indian data centres.
• Legal authorities: Where required by a valid court order, law enforcement request, or statutory obligation under Indian law. Flicp will notify affected users where legally permissible.

Flicp does not sell, rent, or trade personal data to third parties for commercial purposes.

Under the DPDP Act, 2023, you have the following rights:

• Right to Access (§11): Request a summary of personal data we hold about you and how it is being processed.
• Right to Correction and Erasure (§12): Request correction of inaccurate data or erasure of data where processing is no longer necessary, subject to legal retention obligations.
• Right to Grievance Redressal (§13): Lodge a complaint with our Grievance Officer (Section 11 below). If unresolved within 7 days, escalate to the Data Protection Board of India.
• Right to Nominate (§14): Nominate an individual to exercise your rights on your behalf in the event of your death or incapacity.
• Right to Withdraw Consent: Withdraw consent at any time for processing based on consent, without affecting prior lawful processing.

To exercise any of these rights, email help@flicp.com with subject line "Data Principal Request — [Your Name]". We will acknowledge within 24 hours and respond within 15 days.

Flicp primarily stores and processes data in India. Where personal data is transferred to sub-processors outside India (for example, cloud infrastructure providers or DIDIT), Flicp ensures such transfers comply with applicable Indian law and that the recipient provides an equivalent level of data protection.

Flicp will update this section promptly if the Government of India notifies restrictions on cross-border data transfers under the DPDP Act.

Flicp implements the following security measures:

• Passwords hashed using bcrypt (minimum 12 rounds)
• Private keys encrypted at rest with AES-256
• TLS 1.2+ for all data in transit
• Role-based access controls across all internal systems
• Audit logging of all sensitive data access events
• Rate limiting and CSRF protection on all authenticated endpoints
• Regular security reviews and penetration testing (results available to Enterprise customers under NDA)

In the event of a personal data breach that is likely to result in high risk to Data Principals, Flicp will notify the Data Protection Board of India and affected users as required under the DPDP Act and SPDI Rules.

Flicp uses the following categories of cookies:

• Strictly necessary: Authentication tokens, CSRF protection, session management. Cannot be disabled.
• Optional usage and error reporting: Browser performance traces and error reports run only after you allow analytics in Privacy choices. You can withdraw that choice there at any time.
• Preference: Theme selection, language. First-party only.

Flicp does not use third-party advertising cookies or cross-site tracking pixels. You can reopen Privacy choices from the footer.

Flicp accounts are available only to people aged 18 or older. We do not knowingly open accounts for children or permit tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has an account, contact help@flicp.com so we can review it and handle the data under applicable law.

In accordance with the DPDP Act, 2023 and the IT Act, 2000, Flicp's designated Grievance Officer / Data Protection Manager is:

If your complaint is not resolved to your satisfaction within 7 days, you may contact the Data Protection Board of India once it is constituted under the DPDP Act, 2023.

Flicp may update this Privacy Policy to reflect changes in law, technology, or business practices. Material changes will be notified via email and an in-platform notice at least 15 days before the new policy takes effect. The effective date at the top of this page will always reflect the most recent version.