KYFR Trust Centre

KYFR brand and logo are owned by Flowlabs Tech Private Limited (“Flowlabs Tech”). The brand is used by Flowlabs Tech Private Limited and by its subsidiary, Flowlabs Investment Advisors Private Limited (“Flowlabs Investment Advisors”), each for providing their respective services to customers. The services described in this Trust Centre are provided by Flowlabs Investment Advisors Private Limited, an Investment Adviser registered with the Securities and Exchange Board of India (SEBI Registration No. INA000023320). Flowlabs Tech is not a SEBI-registered investment adviser and does not provide investment advice. Flowlabs Tech builds and maintains the KYFR technology platform and provides it to Flowlabs Investment Advisors as a technology service provider.

1. Consent comes first.

KYFR does not access financial information without an explicit action by the user. Every connection to a financial data source requires clear, purpose-specific consent.

You can use KYFR without connecting bank accounts or Gmail, or checking your credit report. Additional permissions are optional and intended to improve the quality and accuracy of decision insights.

2. We collect only what is necessary.

At account creation, KYFR requires only your mobile number, verified by OTP. Any other information, such as your email address, income range, estimated savings, recurring commitments and financial goals, is provided by you during onboarding.

KYFR does not access bank accounts, your credit report, or Gmail at signup.

3. You control your connections.

KYFR follows a progressive permission model.

Stage One
Mobile number login and manual financial onboarding.

Stage Two
Optional connection to bank accounts through India's Account Aggregator framework.

Stage Three
Optional connection to Gmail for financial transaction emails.

Stage Four
Optional access to your credit report and score from CRIF High Mark.

You may connect, disconnect, or revoke access at any time.

Manual Onboarding

Information that you provide directly may include:

• Email address
• Optional name
• Income range
• Estimated savings
• Recurring commitments
• Financial goals
• Decision scenarios submitted to KYFR

This information helps establish an initial financial context.

Account Aggregator (AA)

If you choose to connect bank accounts through the Account Aggregator ecosystem, KYFR may receive read-only access to:

• Transaction history
• Account balances
• Existing liabilities and EMIs, where available
• Cash flow information derived from these records

KYFR does not receive, store, or process your banking credentials.

Your consent is digital, purpose-specific, and revocable.

Gmail (Optional)

If you connect Gmail, KYFR accesses financial transaction emails only, including:

• Credit card statements
• EMI notifications
• Subscription renewals
• Travel bookings
• Insurance reminders
• Other transaction-related financial communications

KYFR does not intentionally process personal correspondence or non-financial content.

Credit Report (Optional)

If you choose to check your credit score, KYFR collects your PAN, name, date of birth and mobile number to obtain your credit report and score from CRIF High Mark Credit Information Services Private Limited, a credit information company. This requires your separate, explicit consent on the credit report screen.

KYFR uses your credit information to:

• Show you your credit report and credit score
• Explain them in plain language
• Highlight accounts you may not recognise
• Support your financial planning, where you consent

Checking your score through KYFR is a soft enquiry and does not affect your credit score. Your consent is valid for six months and can be withdrawn at any time in Settings. Your credit information is deleted within 24 hours of your consent expiring or being withdrawn, except where retention is required under applicable law.

KYFR will never:

• Move money
• Execute financial transactions
• Make payments
• Modify financial accounts

KYFR will also never:

• Store banking passwords
• Store Google passwords
• Sell personal or financial information
• Share financial information with advertisers
• Display third-party advertising inside the application

KYFR uses information that you choose to provide in order to generate pre-decision financial insights.

The system analyses information such as:

• Financial commitments
• Spending patterns
• Available balances
• Cash flow information
• Upcoming obligations
• User-provided financial context

KYFR then generates informational insights intended to help users understand the potential consequences of a financial decision.

The insights generated by KYFR are probabilistic and informational in nature. They are not personalised investment advice, legal advice, tax advice, or lending recommendations. Investment advice, wherever applicable, is provided by Flowlabs Investment Advisors Private Limited, an Investment Adviser registered with the Securities and Exchange Board of India (SEBI Registration No. INA000023320). Investment advice is only provided to users who choose to become its advisory clients, after completing risk profiling and signing a separate investment advisory agreement. Human judgment remains essential in all significant financial decisions. Flowlabs Investment Advisors Private Limited remains solely responsible for the output of the artificial intelligence tools used in KYFR, for the privacy and security of the data those tools process and for compliance with applicable law. The extent to which AI tools are used in advisory services is disclosed to advisory clients.

KYFR stores data within India.

Current infrastructure standards include:

• Amazon Web Services (AWS), Mumbai region
• AES-256 encryption at rest
• TLS 1.2 or higher encryption in transit
• Role-based access controls
• Continuous security monitoring and logging
• Restricted administrative access under the principle of least privilege

Bank authentication credentials are never stored by KYFR.

User information is stored and processed within India.

If cross-border processing is introduced in the future, KYFR will implement appropriate legal and technical safeguards and will update this Trust Centre and related policies accordingly.

You can delete your account directly from Settings.

Upon deletion:

• Personal and financial information is removed within 30 days.
• Backup copies are purged within 90 days unless retention is required by law.
• Connected data sources are disconnected immediately.

Where information must be retained under applicable law, including SEBI record-keeping requirements, it is retained solely for compliance purposes.

You may:

• Access your personal information
• Correct inaccurate information
• Export your information
• Delete your account
• Withdraw consent
• Disconnect Account Aggregator connections
• Disconnect Gmail connections
• Withdraw credit report consent
• Object to certain forms of processing where permitted by law

Requests may be submitted through the application or by contacting KYFR.

KYFR commits to the following principles:

Transparency

We explain what information we access and why.

User Control

You decide what information to connect and can revoke permissions at any time.

Data Minimisation

We collect only information necessary to provide the service.

Security

We apply technical and organisational safeguards to protect information.

Human Decision-Making

General KYFR features provide informational insights. Investment advice, wherever applicable, is provided only to advisory clients under a separate agreement. Final financial decisions remain with the user.

No Advertising-Based Monetisation

Financial information is not used for advertising purposes.

Registered Office: WeWork, Vaishnavi Signature, No 78/9, Bellandur, Bengaluru – 560103

Privacy: privacy@kyfr.ai
Security: security@kyfr.ai
General: info@kyfr.ai
Grievance: grievance@kyfr.ai

We aim to respond to privacy and security requests within five business days.

KYFR Trust Centre | Version 1.0 | August 2026