This page explains what the FinFlot mobile apps collect, why, who else sees it, how long it is kept and how to have it deleted. The apps are work tools for the staff of firms that use FinFlot. FinFlot is not a bank or NBFC and does not lend. For this website and our enquiry service, see the main Privacy Policy.
01 Who this policy is for
FinFlot publishes two mobile apps:
- FinFlot (
com.finflot.crm) — used by staff and partners of a loan distribution firm to work their leads, log visits, mark attendance and collect documents. - FinFlot Legal (
io.finflot.legal) — used by staff of a legal or valuation firm to carry out property title and technical diligence.
Both are business tools used by the staff of a subscribing firm. They are not consumer apps. You cannot create an account inside either app — accounts are issued to you by the firm you work for, or by FinFlot on that firm's instruction. No one applies for, receives or repays a loan in either app.
This matters for who is responsible for what:
- Your employer or the firm that issued your login is the data controller for the customer, borrower and property information handled in the app. They decide what is collected and why.
- Ayantra Technologies Private Limited operates the FinFlot platform as a processor on that firm's behalf, and is the controller only of your own account and device information.
If you are a borrower, a property owner, or another person whose information appears in FinFlot, your relationship is with the firm that entered it. Contact them first; Section 10 explains how to reach us if you cannot.
02 What the apps collect
Both apps
| What | Why | Leaves the device? |
|---|---|---|
| Your name, email address, role and firm code | To sign you in and decide what you are allowed to see | Yes — to the FinFlot server |
| A device identifier the app generates on first launch | Sent with each request so a session can be tied to a device and a lost or stolen device can be cut off | Yes |
| App version and platform (Android or iOS) | Support and compatibility | Yes |
| Fingerprint or face unlock | To lock the app after you have signed in | No. The check is performed by your phone's own operating system, which tells the app only whether it succeeded. The app never sees, receives or stores biometric data. |
FinFlot (the loan distribution app) only
| What | Why | Leaves the device? |
|---|---|---|
| Approximate location | Recorded only when you tap check-in or check-out on the attendance screen, so your employer has a record of roughly where the working day started and ended. The app can only ask your phone for an approximate position — about which part of town, not which building — and never for a precise one. It does not track you in the background and does not record your position at any other moment. | Yes — stored with the attendance record |
| Camera and photographs | Pages you photograph are combined into a single PDF on the phone and attached to the loan file | Yes — the finished PDF is uploaded |
| Notification token | To deliver alerts about your leads and leave requests | Yes |
| Customer information you enter | Names, mobile numbers, email addresses, city and state, loan product, amount and your notes — the substance of the work | Yes |
FinFlot Legal only
| What | Why | Leaves the device? |
|---|---|---|
| Camera and photographs | Scanning title deeds and property documents. Scanning uses Google Play Services on your own device to detect page edges. | Yes — the finished PDF is uploaded |
| Precise location | Captured when you scan and printed onto each page of the PDF, so a site visit carries a record of where it happened. If you decline the permission, scanning still works and the pages simply carry no position. | Yes — as part of the uploaded document |
| Case information you enter | Client, buyer and seller names, property address, ownership and transaction details | Yes |
What the apps do not collect
Neither app contains any analytics, advertising or tracking software. Neither reads your contacts, your calendar, your messages, your call history or your photo library. Neither collects an advertising identifier. Neither profiles you or makes automated decisions about you.
03 App permissions, and what happens if you refuse
Every permission is asked for at the moment it is first needed, and you can refuse any of them.
| Permission | Used for | If you refuse |
|---|---|---|
| Camera | Photographing documents | You cannot capture documents in the app; everything else works |
| Location | Attendance check-in (FinFlot) / stamping a scan (FinFlot Legal) | FinFlot: attendance is still recorded, with no location. FinFlot Legal: scanning works, pages carry no position |
| Notifications | Alerts about your work | You get no alerts; nothing else changes |
| Biometrics | Locking the app | The app is not locked behind a fingerprint; your password still protects it |
You can withdraw any of these at any time in your phone's settings.
05 How we protect information
Data is held on the platform's servers, in one database shared by every firm on the platform. Each firm's records are kept separate from every other firm's by the platform itself, and a person signed in to one firm cannot see another's. Every connection between the apps and the servers uses HTTPS. Your sign-in session is stored on your phone in the app's own private storage, which other apps cannot read. If you sign out, it is removed.
No method of transmission or storage is completely secure, but we work to protect your information and to respond appropriately if an issue arises. We tell affected firms promptly if we become aware of a breach that affects them.
06 How long we keep it
Account and device records are kept while your login is active and for 8 years after that, to meet the record-keeping obligations that apply to books of account under the Companies Act, 2013. Loan, disbursement and commission records are financial records and may be audited long after an account is closed. Business records — leads, loan files, documents, legal cases — belong to the firm and are kept for as long as that firm requires, including any period their own regulator obliges them to keep them for. When a firm leaves the platform, its data is dealt with as set out in its contract.
07 Your rights, and deleting your account
Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may ask us to show you the personal information we hold about your account, correct it, or delete it. The data deletion page at finflot.com/data-deletion explains how, or you can write to connect@finflot.com. We answer within 30 days.
For customer, borrower and property information in the app, the firm that entered it decides — send that request to them, and they can act on it inside FinFlot or ask us to.
Because accounts are issued by firms rather than created by individuals, there is no delete-my-account button inside the apps. To have your account and its associated personal data deleted, email connect@finflot.com from the address on the account, or ask your firm's administrator. We action verified requests within 30 days and confirm in writing when it is done.
08 Children
The apps are work tools for adults who work for, or partner with, a firm that uses FinFlot. They are not meant for children, and we do not knowingly collect personal information from children. If you believe a child has shared information with us, please contact us and we will take appropriate steps.
09 Changes to this policy
We may update this policy from time to time to reflect changes in the apps or the law. When we do, we will revise the "Last updated" date at the top of this page. Significant changes will be highlighted where appropriate.
10 Contact and grievances
If you have a question about this policy, want to exercise your rights, or wish to raise a concern about how your information has been handled, please contact our Grievance Officer:
We aim to acknowledge grievances promptly and to resolve them within the timelines required under applicable law. If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it is operational under the Digital Personal Data Protection Act, 2023.