Privacy Policy

1. Who we are

Nirmaan Flow (also written NirmaanFlow) is a brand name used by Vaibhav Sharma, an individual based in India, for the Shopify apps he builds and operates. Nirmaan Flow is not a registered company, LLP or partnership. Vaibhav Sharma is personally responsible for this website and for the personal data described in this policy. In this policy, “we”, “us” and “our” mean Vaibhav Sharma, operating as Nirmaan Flow.

If Nirmaan Flow is later registered as a business, that business may take over these responsibilities. We will update this policy and tell you before that happens, and the change won't reduce your rights.

For the personal data described in this policy, we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the controller under the EU and UK General Data Protection Regulation (“GDPR”) where it applies.

2. What this policy covers

This policy covers:

• visits to our website, nirmaanflow.com, and its pages;
• emails and messages you send us, including support requests, feature ideas and early-access requests for apps we're building.

3. Data we collect

We collect as little as we can. This website has no account sign-up, no advertising and no analytics or tracking scripts. The only form is the contact form.

Information you choose to send us

When you email us or send the contact form, we receive:

• your name and email address;
• your Shopify store address, if you include it;
• the topic, the content of your message and any attachments;
• anything else you decide to include.

The contact form sends your message from our website's server to our support inbox, using our email delivery provider. To stop spam, the form also checks how quickly it was filled in and limits how many messages can be sent from one connection. For that limit we store a one-way scrambled code (a salted hash) made from your IP address, with the times you sent messages, for no more than 24 hours. The code can't be turned back into your IP address.

Please don't send us your customers' personal details, passwords, bank details or other sensitive information by email. We don't need them to help you.

Information collected automatically

• Server logs. The service that hosts this website records standard technical details of each request: IP address, browser and device type, the page requested, the referring page, and the date and time. These logs are used only to run and secure the website.
• Fonts. This website loads typefaces from Google Fonts. To deliver them, your browser connects to Google's servers, which receive your IP address and browser details. See Google's Privacy Policy.

We do not collect sensitive personal data or information (such as passwords, financial information or health data, as defined in the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011) through this website.

4. How we use data

• To reply to your message and provide the support you ask for.
• To handle early-access requests, and to tell you when an app you asked about is ready.
• To consider your feature requests and ideas when planning what to build.
• To keep the website available and secure, and to detect and prevent abuse.
• To meet our legal obligations, and to establish, exercise or defend legal claims.

We never sell personal data, and we don't use it for advertising or profiling. We will only send you marketing emails if you ask us to, and every such email will let you opt out.

5. Legal basis

Under the DPDP Act (India)

• When you write to us, you share your details voluntarily for a specific purpose, such as getting a reply. We process them for that purpose as a legitimate use under section 7(a) of the DPDP Act. If you tell us you don't want your data used, we will stop, except where the law requires us to keep it.
• Where we ask for your consent, for example to add you to an early-access list, we rely on that consent. You can withdraw it at any time, as easily as you gave it.
• Where the law requires us to process or keep data, we do so to comply with it.

Under the GDPR (EU and UK visitors)

• Replying to you and providing support: our legitimate interest in answering enquiries, or steps you ask us to take before entering into a contract (Article 6(1)(f) and 6(1)(b)).
• Early-access emails: your consent (Article 6(1)(a)).
• Website security logs: our legitimate interest in keeping the website secure (Article 6(1)(f)).
• Legal obligations: Article 6(1)(c).

6. Who we share data with

We share personal data only with service providers that help us run the website and handle email. They act on our instructions and must protect the data.

We may also disclose personal data:

• if the law requires it, for example in response to a valid order from a court, tax authority, CERT-In or another government agency;
• to protect the rights, safety or property of Nirmaan Flow, our users or others;
• to a business that takes over Nirmaan Flow or one of its apps, including a company formed to run Nirmaan Flow. We will tell you before your data becomes subject to a different privacy policy.

7. International transfers

Some of our service providers process data outside India, including in the United States. Where data leaves India, we rely on providers that encrypt data in transit and give contractual commitments to protect it. We will not transfer personal data to any country the Government of India restricts under section 16 of the DPDP Act. For visitors from the EU or UK, transfers rely on adequacy decisions or the standard contractual clauses our providers offer.

8. How long we keep data

• Emails and support conversations: up to 24 months after our last exchange, then deleted, unless we need them longer to resolve a dispute or meet a legal obligation.
• Early-access requests: until the app launches and we've told you, or until you ask us to remove you, whichever is first, and no longer than 24 months.
• GST Point store data after uninstalling: about 48 hours after a merchant uninstalls GST Point, Shopify asks us to delete the store's data, and we delete all of it. If the merchant reinstalls GST Point before that request arrives, the store is using the app again, so its data is kept; it is deleted after any later uninstall in the same way. The GST Point Privacy Policy has the details.
• One exception: whether a store has used its free trial. So that the 7-day free trial of GST Point is given once per store, we keep a scrambled, one-way code made from the store's myshopify.com address, with the dates of its trial. The code can't be turned back into the address, and nothing else about the store, its customers or its staff is kept. It is used only to decide whether a reinstalled store gets a new trial.
• Spam-protection records: the scrambled connection code and send times described in section 3, deleted after 24 hours.
• Server logs: kept for as long as needed for security. Where Indian cyber-security directions (CERT-In) require logs to be kept for 180 days, we keep them for that period, and for no longer than 365 days.

When data is no longer needed, we delete it or make it anonymous.

9. Security

We follow reasonable security practices, as required by section 43A of the Information Technology Act, 2000 and the DPDP Act. These include serving the website only over HTTPS, using providers that encrypt data at rest, limiting access to personal data to people who need it, and using strong authentication on our accounts.

No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires, and report cyber-security incidents to CERT-In within the time its directions set.

10. Your rights

Depending on where you live, you have the right to:

• access a summary of the personal data we hold about you and how we use it;
• correct, complete or update inaccurate or incomplete data;
• erase data we no longer need, or that you no longer want us to hold, unless the law requires us to keep it;
• withdraw consent at any time, without affecting what we did before;
• nominate someone to exercise your rights if you die or become incapacitated (section 14 of the DPDP Act);
• have a grievance resolved by our Grievance Officer, and, if you're not satisfied, complain to the Data Protection Board of India;
• if the GDPR applies: object to processing, restrict it, receive your data in a portable format, and complain to your local data protection authority.

To use any of these rights, email support@nirmaanflow.com. We may ask you to confirm your identity before acting. We don't charge for reasonable requests.

If you're a customer of a Shopify store that uses one of our apps, please contact that store first. The store decides how your data is used in the app, and can pass your request to us through Shopify.

11. Cookies

This website does not set cookies and does not use analytics, advertising or tracking technologies. If we add analytics in future, we will update this policy first and, where the law requires, ask for your consent.

12. Children

Our website and apps are for businesses and are not intended for anyone under 18. We don't knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.

13. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects how we use your data, we will say so on this page before it takes effect, and email you if we have your address and the change affects you.

14. Contact and Grievance Officer

For questions, requests or complaints about privacy, contact our Grievance Officer. We acknowledge grievances promptly and resolve them within 30 days.