KYFR Data & Safety

KYFR brand and logo are owned by Flowlabs Tech Private Limited (“Flowlabs Tech”). The brand is used by Flowlabs Tech Private Limited and by its subsidiary, Flowlabs Investment Advisors Private Limited (“Flowlabs Investment Advisors”), each for providing their respective services to customers. The services described in this document are provided by Flowlabs Investment Advisors Private Limited, an Investment Adviser registered with the Securities and Exchange Board of India (SEBI Registration No. INA000023320). Flowlabs Tech is not a SEBI-registered investment adviser and does not provide investment advice. Flowlabs Tech builds and maintains the KYFR technology platform and provides it to Flowlabs Investment Advisors as a technology service provider.

KYFR follows a progressive permission model. Users can experience the product before connecting financial data sources and no financial account access occurs at signup.

Users sign up with a mobile number verified by OTP and provide basic financial context, including income range, savings estimates and financial commitments. This information establishes an initial decision context without requiring access to bank accounts, credit information or email.

Users may connect bank accounts through the Reserve Bank of India-regulated Account Aggregator ecosystem. Flowlabs Investment Advisors receives read-only information necessary to generate financial insights and does not receive or store banking credentials.

Gmail access is optional and limited to financial transaction emails, including statements, subscriptions, EMI notifications, travel bookings and insurance reminders. Users may disconnect Gmail at any time.

Users may choose to check their credit score and report from CRIF High Mark Credit Information Services Private Limited, a credit information company. This requires separate, explicit consent and the user's PAN, name, mobile number and date of birth. Consent is valid for six months and may be withdrawn at any time. Credit information is deleted within 24 hours of consent expiring or being withdrawn, except where retention is required under applicable law.

Data remains in India and is stored on Amazon Web Services in the Mumbai region. Encryption standards include AES-256 for data at rest and TLS 1.2 or higher for data in transit. Administrative access is controlled through the principle of least privilege and monitored continuously.

Users may delete their account through self-service settings. Personal and financial data is removed within thirty days and backup copies are purged within ninety days unless legal or regulatory obligations, including record-keeping requirements under SEBI regulations, require otherwise.

KYFR services are provided by Flowlabs Investment Advisors, a SEBI-registered Investment Adviser, and are designed to align with the SEBI (Investment Advisers) Regulations, 2013, the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and principles applicable to the Account Aggregator framework. Data access remains purpose-specific, consent-based and revocable.

KYFR does not move money, execute transactions, store banking credentials, sell financial data, share information with advertisers or use user financial behaviour to train models licensed to third parties.