Privacy Policy.

Qfloww ("Qfloww", "we", "us", "our") is a Software-as-a-Service booking and queue management platform operated by Pride Marketing, having its principal place of business at Bhopal, Madhya Pradesh, India. For the purposes of the DPDP Act, Pride Marketing is the Data Fiduciary in respect of personal data collected through our marketing website and administrative surfaces, and a Data Processor in respect of personal data uploaded, submitted, or received by our business customers ("Businesses") through the Qfloww platform.

This Policy applies to (a) visitors to qfloww.tech and any other domain we operate for Qfloww, (b) end-customers who book an appointment through a Business's public booking page (/book/<business-slug>), and (c) staff and owners of Businesses who hold a Qfloww account.

Where a Business uses Qfloww to collect personal data from its end-customers, that Business is the Data Fiduciary for such data and is independently responsible for its own privacy notice, lawful basis, and retention. We act on that Business's instructions.

We collect the categories of personal data described below.

• Account data (business owners and staff): name, email address, hashed password, business name, business slug, business type, role, and login timestamps.
• Booking data (end-customers of a Business): name, phone number, email address (optional), selected service, selected slot, and booking date.
• Communication data: emails we send you (transactional and authentication), delivery status, and any correspondence you send to us.
• Technical data: IP address, user-agent, and standard server logs, retained for security and abuse-prevention purposes.
• Cookies: strictly-necessary cookies for authentication and session management. We do not use advertising or cross-site tracking cookies.

We do not knowingly collect sensitive personal data or information as defined under Rule 3 of the SPDI Rules, 2011, and we do not require passwords, financial account details, or biometric data to use Qfloww's booking flow.

We process personal data for the following purposes, on the lawful bases set out in Section 4 of the DPDP Act, 2023:

• Providing the Service — creating accounts, activating businesses, showing bookings, running the reception queue, and sending confirmation emails. Basis: performance of the contract with the Business, and consent of end-customers who submit a booking.
• Security and abuse prevention — rate-limiting, RLS-based access control, and investigating incidents. Basis: legitimate use under Section 7(a).
• Legal compliance — responding to lawful requests from courts, regulators, and government agencies under Section 7(c) of the DPDP Act and applicable Indian law.
• Service communications — password resets, account verification, activation notices, and transactional booking confirmations.

We do not sell personal data. We do not use personal data for behavioural advertising or profiling.

Personal data is stored on managed infrastructure hosted within data centres operated by our cloud providers. We rely on Row-Level Security ("RLS"), least-privilege access, encrypted transport (HTTPS/TLS), and encrypted-at-rest storage. Passwords are stored only as salted hashes; we never see or log them in plaintext.

We follow reasonable security practices and procedures within the meaning of Section 43A of the Information Technology Act, 2000 and Rule 8 of the SPDI Rules, 2011, and implement the organisational and technical safeguards required under Section 8 of the DPDP Act, 2023.

We retain personal data only for as long as it is required for the purpose for which it was collected, or for the period required by law.

• Booking records are retained for the operational lifetime of the Business's account.
• Account records are retained for the duration of the subscription and up to 12 months after termination for billing, audit, and dispute-resolution purposes.
• Server and security logs are retained for up to 12 months.
• Email delivery logs are retained for up to 6 months.

When retention periods expire, data is deleted or irreversibly anonymised.

We do not sell personal data. We share personal data only with a limited set of processors that help us operate Qfloww under written contracts and confidentiality obligations:

• Our managed database, authentication, and email delivery providers.
• Our hosting and edge-runtime provider.
• Law-enforcement or government authorities, where disclosure is required by a lawful order under Indian law.

Some processors may store data outside India. Any cross-border transfer is carried out in accordance with Section 16 of the DPDP Act and applicable notifications issued by the Central Government.

If you are an identified natural person whose personal data we process, you have the following rights under Chapter III of the DPDP Act, 2023:

• The right to obtain a summary of the personal data we hold about you and the processing activities we carry out.
• The right to correction, completion, updating, and erasure of your personal data.
• The right to grievance redressal in respect of any act or omission by us.
• The right to nominate another individual to exercise these rights in the event of your death or incapacity.
• The right to withdraw consent at any time, on the same footing on which it was given.

To exercise any of these rights, write to our Grievance Officer at contact@qfloww.tech. We will respond within the timelines prescribed under the DPDP Act and the SPDI Rules.

In accordance with Rule 5(9) of the SPDI Rules, 2011 and Section 8(9) of the DPDP Act, 2023, the details of our Grievance Officer are as follows:

• Name: Grievance Officer, Pride Marketing
• Email: contact@qfloww.tech
• Phone: +91 8349021100
• Address: Bhopal, Madhya Pradesh, India
• Hours: Monday to Saturday, 10:00 – 19:00 IST

Complaints are acknowledged within forty-eight (48) hours and, where possible, resolved within thirty (30) days from the date of receipt.

Qfloww is a business-to-business platform. We do not knowingly collect personal data of children under the age of eighteen (18) years without verifiable parental consent, as required by Section 9 of the DPDP Act, 2023. If you believe a child's data has been collected in error, please contact us so it can be deleted.

We may update this Policy from time to time to reflect changes in law, in our practices, or in the Qfloww service. The "Effective" date at the top of this page will always reflect the most recent version. Material changes will be highlighted through the platform or via email.

Questions about this Policy or our privacy practices can be sent to contact@qfloww.tech or by phone / WhatsApp at +91 8349021100.