Privacy Policy

1. Introduction & Commitment

MerchFlow Technologies ("MerchFlow", "we", "our", "us") respects your privacy and is committed to protecting the personal data of our merchants, creators, buyers, and platform visitors.

This Privacy Policy explains how we collect, process, store, and safeguard your personal data in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection (DPDP) Act, 2023.

2. Information We Collect

Depending on your interaction with MerchFlow, we collect:

• Customer / Buyer Data: Full Name, Email Address, Phone/WhatsApp Number, Billing Details, IP Address, Device Fingerprint, and Transaction Order History.
• Merchant Account & KYC Data: Legal Name, Business Entity Name, Permanent Account Number (PAN), Aadhaar verification metadata, Bank Account Number, IFSC Code, and GSTIN (where applicable).
• Technical & Log Data: Browser user-agent, operating system, network timestamps, referral URLs, and session activity logs.
• Payment Credentials: All credit/debit card numbers, CVVs, and UPI pins are processed directly by RBI-licensed PCI-DSS Level 1 compliant payment gateways (Cashfree, Razorpay, Easebuzz, Instamojo). MerchFlow never captures, sees, or stores sensitive cardholder PINs or card numbers on our servers.

3. Purpose of Data Processing

We use collected information solely for legitimate operational purposes:

• Facilitating digital checkout transactions and delivering download links and invoices.
• Processing merchant bank settlements, payouts, and ledger maintenance.
• Complying with statutory KYC, anti-money laundering (AML), and regulatory audit requirements.
• Preventing payment fraud, unauthorized access, and automated bot attacks.
• Providing customer support and communicating critical transactional alerts.

4. Data Sharing & Third-Party Disclosure

We do not sell, rent, or trade your personal information. Data is shared strictly on a need-to-know basis with:

• Acquiring Banking & Payment Gateway Partners: To authorize and settle payments securely (Cashfree Payments India Pvt Ltd, Razorpay Software Pvt Ltd, Easebuzz Pvt Ltd, Instamojo Technologies Pvt Ltd).
• Infrastructure Providers: Encrypted cloud database and hosting providers adhering to ISO 27001 security standards.
• Law Enforcement & Regulatory Authorities: When required under valid court orders, subpoenas, or statutory compliance obligations under Indian law.

5. Data Security & Encryption Standards

We implement multi-layered administrative, technical, and physical safeguards:

• 256-bit SSL / TLS Encryption: All data transmitted between your browser and our servers is encrypted using modern cryptographic protocols.
• Database Encryption: Sensitive merchant banking records are encrypted at rest using AES-256 standard encryption.
• Access Control: Strict role-based access control (RBAC) and mandatory 2-Factor Authentication (2FA) for administrative operations.

6. Cookies & Tracking Pixels

We use essential session cookies necessary for user authentication and CSRF security. Merchants can optionally configure tracking pixels (Meta Pixel / Google Analytics) on their respective product links. Buyers can manage cookie preferences via their browser settings.

7. User Rights & Data Retention

Under applicable privacy laws, you have the right to request access to, correction of, or deletion of your personal data. We retain transactional and invoice data for the statutory period mandated by tax and financial regulations (minimum 5 to 8 years).

8. Data Protection & Grievance Officer

In accordance with the Information Technology Act 2000 and the DPDP Act 2023, our grievance escalation contact details are provided below: