KYFR Privacy Policy

KYFR is an AI-powered pre-decision financial clarity tool provided by Flowlabs Investment Advisors Private Limited, a SEBI-registered Investment Adviser (Registration No. INA000023320). This Privacy Policy explains how personal information is collected, used, disclosed, retained and protected when users access the KYFR application, website and related services.

This policy has been prepared with reference to the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, the SEBI (Investment Advisers) Regulations, 2013, applicable rules and principles relevant to the Account Aggregator ecosystem in India.

Flowlabs Investment Advisors Private Limited (“Flowlabs Investment Advisors”) provides the KYFR application, website and related services and is the Data Fiduciary for personal data processed through them. References to KYFR, we, us and our mean Flowlabs Investment Advisors. References to you and your mean any individual who accesses or uses the service.

KYFR is a brand owned by Flowlabs Tech Private Limited (“Flowlabs Tech”), the parent company of Flowlabs Investment Advisors, and is used by both companies to provide their respective services to customers. Flowlabs Tech builds and maintains the KYFR technology platform and provides it to Flowlabs Investment Advisors as a technology service provider. Flowlabs Tech is not a SEBI-registered investment adviser and does not provide investment advice.

At onboarding, KYFR collects your mobile number, verified by OTP, and information you provide directly, including email address, optional name, income range, estimated savings, recurring commitments, financial goals and decision scenarios submitted through the application. If you choose to check your credit score, KYFR also collects your PAN and date of birth (see Credit Information).

Where users provide consent through the Account Aggregator framework, Flowlabs Investment Advisors may receive read-only access to transaction history, balances, liabilities and cash-flow information. Gmail connectivity, where enabled by the user, is limited to financial transaction emails and related metadata required to generate financial insights.

KYFR also collects device information, application logs, diagnostic information and usage analytics necessary for security, fraud prevention, service improvement and support.

Personal information is processed to provide pre-decision financial insights, provide credit report and score services, provide investment advisory services to advisory clients, personalise the user experience, authenticate accounts, comply with legal obligations, respond to support requests, maintain platform security and improve product performance.

KYFR processes information only for specified and lawful purposes and does not use financial data for advertising or unrelated commercial activities.

Account Aggregator, Gmail and credit report access are consent-driven and optional. Consent may be withdrawn at any time through KYFR settings or, for Account Aggregator, the relevant Account Aggregator application. Withdrawal of consent does not affect processing carried out before the withdrawal became effective.

Where you choose to check your credit score, Flowlabs Investment Advisors, acting as your authorised representative under its arrangement with CRIF High Mark, collects your PAN, name, date of birth and mobile number to obtain your credit report and credit score from CRIF High Mark Credit Information Services Private Limited, a credit information company. We do this only with your separate, explicit consent, given on the credit report screen.

We use your credit information only to show you your credit report and credit score, explain them in plain language, highlight accounts you may not recognise, update them monthly while your consent is valid and, where you consent, use them for your financial planning.

Your credit information is not shared with, sold or disclosed to any other person, other than Flowlabs Tech and our infrastructure providers, which process it solely on our behalf to provide the service. It is not used for advertising, lending decisions or any other purpose.

Your consent is valid for six months from the date you give it. Your credit information is deleted, including from backups, within 24 hours of your consent expiring or of you withdrawing it in Settings → Manage Consents, except where you are an advisory client and the information has been used in providing investment advice, in which case it is retained as required under the SEBI (Investment Advisers) Regulations, 2013 and used solely for compliance purposes. We keep a record of your consent and its withdrawal as required by law. Credit information is stored in India and encrypted in transit and at rest.

Flowlabs Investment Advisors may share information with Flowlabs Tech, as its technology service provider, and with infrastructure providers, security vendors, analytics providers and other processors acting on documented instructions and subject to contractual confidentiality obligations. This does not apply to credit information, which is handled only as set out in Credit Information.

Information may also be disclosed where required by law, court order, regulatory directive or in connection with a corporate restructuring transaction.

Data is stored within India using Amazon Web Services in the Mumbai region. Information is encrypted at rest using AES-256 and protected in transit using TLS 1.2 or higher. Administrative access is restricted through role-based controls, logging and continuous monitoring.

Active account information is retained while an account remains open. Following an account deletion request, personal and financial data is removed within thirty days and backup copies are purged within ninety days unless a longer retention period is required by law, including record-keeping requirements applicable to Flowlabs Investment Advisors under SEBI regulations.

Credit information is retained and deleted as set out in the Credit Information section, and the periods above do not apply to it.

Users may request access to personal information, correction of inaccurate information, deletion, portability and withdrawal of consent, and may nominate another individual to exercise these rights on their behalf in the event of death or incapacity, subject to applicable law and technical feasibility.

KYFR is not intended for individuals under eighteen years of age. Any future cross-border transfer of information will be undertaken only in accordance with applicable law and documented safeguards.

If you have a concern about how we handle your personal or credit information, contact our

Grievance Officer:

We acknowledge complaints within 48 hours and aim to resolve them within 15 days. Grievances relating to investment advisory services are handled as set out on the Grievance Redressal page. For other privacy requests, write to privacy@kyfr.ai. Material changes to this policy will be communicated through the application and by email.