Privacy Policy

FLICP TECHNOLOGIES PRIVATE LIMITED ("Flicp", "we", "us") is the Data Fiduciary under the DPDP Act, 2023 in respect of personal data processed through the Platform. Registered office: 4th Floor, Xeno Space, No. 28 & 50, Arunodaya Colony, Madhapur, Hyderabad, Telangana – 500081, India. CIN: U62011TS2026PTC214611.

Contact for privacy matters: help@flicp.com

From Consumers:

• Identity: name, email address, mobile number
• Account data: encrypted password hash, login timestamps, device identifiers
• Transaction data: coupons claimed, redeemed, Flicp Token and Sparks balances, redemption timestamps
• KYC data (where applicable): government-issued ID type and verification status (raw documents processed by DIDIT, not stored by Flicp beyond legal requirements)
• Usage data: pages visited, feature interactions, browser/device type, IP address
• Communications: support tickets, feedback, WhatsApp interaction logs (where WhatsApp is enabled)

From Brand Owners and Employees:

• Business identity: brand name, GSTIN, PAN, registered address, business category
• Contact details: name, work email, mobile number
• Financial data: billing details, payment method tokens (stored by Razorpay, not by Flicp), invoice history
• Operational data: campaigns created, coupon issuance and redemption records, employee role assignments, audit logs

Automatically collected: cookies, log files, session identifiers. See Section 10 (Cookies).

We do not collect: biometric data, financial account numbers, Aadhaar numbers (only KYC verification status is retained after DIDIT processing).

Where we rely on consent as the legal basis, we will obtain it through a clear, affirmative action (checkbox, button tap, or equivalent) at the point of collection. You may withdraw consent at any time by contacting help@flicp.com or adjusting your account settings. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

Consent records (timestamp, version of consent notice, data categories consented to) are logged and retained for a minimum of three years to demonstrate compliance.

Flicp shares personal data only as follows:

• Brands (for Consumer redemption data): Brands receive redemption event data for their own coupons only, limited to the minimum necessary for fulfilment and audit.
• DIDIT: Identity documents for KYC processing under DIDIT's privacy policy.
• Razorpay: Payment processing data under Razorpay's privacy policy. Flicp does not store card numbers or bank account details.
• WhatsApp / Meta: Message content and phone numbers where you have opted in to WhatsApp communications.
• Cloud / Infrastructure providers: Hosting providers operating under data processing agreements with adequate security controls. Data is hosted in Indian data centres.
• Legal authorities: Where required by a valid court order, law enforcement request, or statutory obligation under Indian law. Flicp will notify affected users where legally permissible.

Flicp does not sell, rent, or trade personal data to third parties for commercial purposes.

Under the DPDP Act, 2023, you have the following rights:

• Right to Access (§11): Request a summary of personal data we hold about you and how it is being processed.
• Right to Correction and Erasure (§12): Request correction of inaccurate data or erasure of data where processing is no longer necessary, subject to legal retention obligations.
• Right to Grievance Redressal (§13): Lodge a complaint with our Grievance Officer (Section 11 below). If unresolved within 30 days, escalate to the Data Protection Board of India.
• Right to Nominate (§14): Nominate an individual to exercise your rights on your behalf in the event of your death or incapacity.
• Right to Withdraw Consent: Withdraw consent at any time for processing based on consent, without affecting prior lawful processing.

To exercise any of these rights, email help@flicp.com with subject line "Data Principal Request — [Your Name]". We will acknowledge within 24 hours and respond within 30 days.

Flicp primarily stores and processes data in India. Where personal data is transferred to sub-processors outside India (for example, cloud infrastructure providers or DIDIT), Flicp ensures such transfers comply with applicable Indian law and that the recipient provides an equivalent level of data protection.

Flicp will update this section promptly if the Government of India notifies restrictions on cross-border data transfers under the DPDP Act.

Flicp implements the following security measures:

• Passwords hashed using bcrypt (minimum 12 rounds)
• Private keys encrypted at rest with AES-256
• TLS 1.2+ for all data in transit
• Role-based access controls across all internal systems
• Audit logging of all sensitive data access events
• Rate limiting and CSRF protection on all authenticated endpoints
• Regular security reviews and penetration testing (results available to Enterprise customers under NDA)

In the event of a personal data breach that is likely to result in high risk to Data Principals, Flicp will notify the Data Protection Board of India and affected users as required under the DPDP Act and SPDI Rules.

Flicp uses the following categories of cookies:

• Strictly necessary: Authentication tokens, CSRF protection, session management. Cannot be disabled.
• Analytics (opt-in): Cloudflare Web Analytics — privacy-first, no cross-site tracking, no fingerprinting. You may opt out via your browser's Do Not Track signal or by contacting us.
• Preference: Theme selection, language. First-party only.

Flicp does not use third-party advertising cookies or cross-site tracking pixels. Our cookie banner on first visit provides granular controls. Consent is stored in compliance with the DPDP Act.

Flicp does not knowingly collect personal data from children under 13 years of age. For users aged 13–17, verifiable parental consent is required before an account is activated. If you believe a child's data has been collected without proper consent, contact help@flicp.com and we will delete the data within 72 hours of verification.

In accordance with the DPDP Act, 2023 and the IT Act, 2000, Flicp's designated Grievance Officer / Data Protection Manager is:

If your complaint is not resolved to your satisfaction within 30 days, you may contact the Data Protection Board of India once it is constituted under the DPDP Act, 2023.

Flicp may update this Privacy Policy to reflect changes in law, technology, or business practices. Material changes will be notified via email and an in-platform notice at least 15 days before the new policy takes effect. The effective date at the top of this page will always reflect the most recent version.