Digital Personal Data Protection (DPDP) Compliance Framework

Version 1.0 August 2026
Prepared by: Flowlabs Investment Advisors Private Limited, Bengaluru, India

1. Purpose

This document sets out the framework adopted by Flowlabs Investment Advisors Private Limited, which provides services under the KYFR brand (“KYFR”), to comply with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), applicable rules, and associated regulatory guidance.

The framework establishes the principles, governance mechanisms, operational controls, and user rights procedures that govern the collection, processing, storage, use, disclosure, and deletion of personal data within the KYFR platform.

This document applies to all employees, contractors, service providers, and technology partners engaged in the processing of personal data on behalf of KYFR.

KYFR brand and logo are owned by Flowlabs Tech Private Limited (“Flowlabs Tech”). The brand is used by Flowlabs Tech Private Limited and by its subsidiary, Flowlabs Investment Advisors Private Limited (“Flowlabs Investment Advisors”), each for providing their respective services to customers. The services described in this framework are provided by Flowlabs Investment Advisors Private Limited, an Investment Adviser registered with the Securities and Exchange Board of India (SEBI Registration No. INA000023320). Flowlabs Tech is not a SEBI-registered investment adviser and does not provide investment advice. Flowlabs Tech builds and maintains the KYFR technology platform and provides it to Flowlabs Investment Advisors as a technology service provider.

2. Scope

This framework applies to:

The KYFR mobile application
The KYFR website
Account onboarding processes
Account Aggregator integrations
Gmail integrations
Credit Bureau integrations
Customer support processes
Product analytics and telemetry
Internal administrative systems
Third-party service providers processing information on behalf of KYFR

3. Data Fiduciary

For the purposes of the DPDP Act, Flowlabs Investment Advisors Private Limited acts as the Data Fiduciary for personal data processed through the KYFR platform.

Flowlabs Tech Private Limited, the parent company and owner of the KYFR brand, provides technology services to Flowlabs Investment Advisors and processes personal data on its behalf as a Data Processor under a written contract.

Company: Flowlabs Investment Advisors Private Limited

SEBI Registration No: INA000023320

Registered Office: WeWork, Vaishnavi Signature, No 78/9, Bellandur, Bengaluru - 560103

Email: privacy@kyfr.ai

4. Categories of Personal Data Processed

KYFR processes only information necessary for providing pre-decision financial insights, credit insights and investment advisory services, where applicable.

Categories of information processed may include:

Identity Information

Email address
Optional name
Account identifiers
Mobile number

Financial Context Information

Income range
Estimated savings
Recurring commitments
Financial goals
User-submitted decision scenarios

Account Aggregator Information

Where consent has been provided:

Transaction history
Account balances
Existing liabilities
Cash-flow information

Credit Information

Where consent has been provided:

PAN, name, mobile number and date of birth, used to obtain the credit report
Credit and loan account information
Repayment history
Other information contained in the credit report

Gmail Information

Where consent has been provided. Gmail access is provided only after explicit authorization through Google's OAuth mechanism. KYFR never receives or stores Google passwords.

Financial transaction emails
Credit card statements
EMI notifications
Subscription reminders
Travel bookings
Insurance reminders

Technical Information

Device type
Operating system
Application version
Diagnostic logs
Usage analytics

KYFR does not intentionally process personal correspondence, biometric information, passwords or payment credentials except where necessary to provide the Services with appropriate authorization.

5. Purposes of Processing

Personal data is processed only for lawful purposes, including:

Providing pre-decision financial insights
Generating personalised financial context
Maintaining user accounts
Authenticating access
Preventing fraud and abuse
Maintaining security
Responding to support requests
Complying with legal obligations
Improving product performance through aggregated and anonymised analytics
Providing credit report and score
Providing investment advisory services to advisory clients

KYFR does not process personal data for behavioural advertising.

KYFR does not sell personal information.

7. Notice Requirements

Before processing personal data, KYFR provides notice describing:

Categories of information collected
Purpose of processing
Rights available to the user
Method for withdrawal of consent
Contact information
Data retention periods

Privacy notices are made available through:

Privacy Policy
Data & Safety page
Trust Centre
In-app permission screens

8. Rights of Data Principals

Users may exercise the following rights:

Right to Access Personal Information

Request a copy of personal information held by KYFR.

Right to Correction

Request correction of inaccurate or incomplete information.

Right to Erasure

Request deletion of personal information.

Right to Withdraw Consent

Disconnect Account Aggregator, Credit Bureau and Gmail permissions.

Right to Grievance Redressal

Raise complaints concerning personal data processing.

Right to Nominate

Nominate another individual to exercise rights in accordance with the DPDP Act.

Requests may be submitted through the application or by email to: privacy@kyfr.ai

9. Grievance Redressal Mechanism

KYFR has established and maintains an internal grievance mechanism.

Privacy complaints shall be acknowledged promptly and resolved within reasonable timelines prescribed under applicable law.

Grievance Officer:

Viswanathan Raju
Email: grievance@kyfr.ai

10. Data Minimisation

KYFR collects only information reasonably necessary for providing the service.

At signup, KYFR does not require:

Bank account access
Gmail access
Government identification documents
Banking credentials

Additional information is requested only where users voluntarily provide consent.

11. Data Retention

Active account information is retained while the account remains open.

Upon account deletion:

Personal and financial information is removed within thirty days.

Backup copies are purged within ninety days unless retention is required by law.

Credit information is deleted within 24 hours of consent expiring or being withdrawn, except as set out in the Privacy Policy. Information retained under statutory or regulatory obligations, including SEBI record-keeping requirements, shall be used solely for compliance purposes.

12. Security Measures

KYFR maintains appropriate technical and organisational safeguards, including:

Primary production systems hosted within India
AES-256 encryption at rest
TLS 1.2 or higher encryption in transit
Role-based access controls
Multi-factor administrative authentication
Continuous logging and monitoring
Incident response procedures
Vendor risk management procedures

Bank authentication credentials are never stored by KYFR.

13. Cross-Border Transfers

As of Version 1.0, KYFR intends to store and process user information within India.

Should cross-border transfers become necessary, such transfers shall be conducted only in accordance with applicable law and government notifications issued under the DPDP Act.

14. Personal Data Breach Management

KYFR maintains procedures for:

Detection
Containment
Investigation
Remediation
Regulatory notification
User communication
Root cause analysis

Personal data breaches shall be handled in accordance with applicable legal requirements and regulatory timelines.

15. Governance and Accountability

The Board and management of Flowlabs Investment Advisors Private Limited are responsible for maintaining appropriate governance controls over personal data processing activities.

Periodic reviews of:

Data inventory
Vendor access
Retention controls
Consent management
Security controls
Incident response procedures

shall be undertaken to maintain compliance with applicable law. These reviews shall be documented and appropriate remediation actions tracked until closure.

16. Responsible AI Principles

KYFR commits to:

Transparency

Explain what information is accessed and why.

User Control

Allow users to revoke permissions at any time.

Data Minimisation

Collect only information necessary for the stated purpose.

Security

Protect personal information through appropriate safeguards.

Human Decision-Making

KYFR does not autonomously execute financial transactions or take financial actions. Informational insights are intended to support—not replace—human judgment.

Final financial decisions remain with the user.

17. Contact Information

Flowlabs Investment Advisors Private Limited

Registered Office: WeWork, Vaishnavi Signature, No 78/9, Bellandur, Bengaluru – 560103

Privacy: privacy@kyfr.ai
Grievance: grievance@kyfr.ai
Security: security@kyfr.ai
General: info@kyfr.ai

Version 1.0 August 2026 KYFR – Digital Personal Data Protection Compliance Framework