Privacy Policy
Your privacy and data security are fundamental to how we build OptiFlow. This policy explains what data we collect, how we use it, and how we protect it.
Introduction
This Privacy Policy describes how OptiFlow ("we", "us", or "our") collects, uses, stores, and protects information when you access our website (optiflow.in) or use the OptiFlow OS platform ("the Platform").
This policy applies to:
- Business customers — MSME owners, founders, and authorised administrators who create an OptiFlow account and use the Platform to manage their business operations.
- End users — employees, managers, and other personnel who access the Platform under a business customer's account.
- Website visitors — anyone who browses optiflow.in, submits a contact form, or books a demo.
By using OptiFlow, you agree to the practices described in this policy. If you do not agree, please discontinue use of the Platform and contact us to delete your data.
Our commitment
We do not sell personal data. We do not use your business operational data for advertising, competitor analysis, or any purpose beyond delivering and improving the OptiFlow Platform. Your business data is your business data.
Information We Collect
We collect only the information necessary to operate the Platform, provide support, and improve our services. Here is what we collect and why:
Account information
When you register, we collect your full name, company name, email address, phone number, and industry type. This is required to set up your account, verify your identity, and provide relevant onboarding.
Business operational data
As you use the Platform, we store the data you enter: tasks, checklists, attendance records, leave requests, SOP documents, reports, and team member details. This data is stored so you and your authorised users can access, search, and report on it. We do not access or use this data for any purpose other than providing the Platform to you.
Employee information
When a business customer adds team members, we store names, employee IDs, department assignments, attendance records, and task activity. This data belongs to the business customer, who acts as the data controller.
Technical information
We automatically collect device type, browser type, IP address, login timestamps, and Platform usage patterns (pages viewed, features used). This helps us monitor Platform health, troubleshoot issues, and improve the user experience.
Communication information
When you contact us via email, phone, demo booking form, or support channels, we store the communication content and metadata to resolve your query and improve our support quality.
How We Use Your Information
Every use of your data serves a specific, legitimate purpose tied directly to operating and improving the Platform:
- Platform operations — storing and displaying your tasks, attendance, checklists, SOPs, reports, and team data so the Platform functions correctly for you.
- Authentication and security — verifying user identity during login, enforcing role-based access controls, and monitoring for unauthorised access attempts.
- Reporting and analytics — generating the reports, dashboards, and analytics that you see inside the Platform. This uses only your own data.
- Customer support — accessing relevant account information when you contact us for help, so we can resolve issues efficiently.
- Product improvement — analysing aggregated, anonymised usage patterns (e.g., "60% of users use the mobile attendance feature") to guide product development. We never inspect individual business data for this purpose.
- Compliance and legal obligations — responding to lawful requests from government or law enforcement, enforcing our Terms of Service, and preventing fraud or abuse.
Data Storage and Retention
We take infrastructure, backup, and retention seriously because your business depends on reliable access to your operational data.
Infrastructure
OptiFlow is hosted on secure cloud infrastructure located in India. All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Our hosting provider maintains SOC 2 Type II and ISO 27001 certifications.
Automated backups
Your data is backed up every 6 hours with 30-day retention. In the unlikely event of a system failure, we can restore your data to a point no more than 6 hours old. We test backup restoration monthly.
Retention periods
Active account data is retained as long as your account is active. When you close your account, we retain your data for 90 days (so you can export or reactivate), after which it is permanently deleted from all systems, including backups.
Business continuity
We maintain a disaster recovery plan with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 6 hours. Our infrastructure is designed for 99.9% uptime.
Third-Party Services
We use a small number of trusted service providers to operate the Platform. Each provider is carefully vetted for security and data handling practices. Your business operational data is never shared with third parties for their own purposes.
Cloud hosting
Platform infrastructure and data storage. Location: India. SOC 2 Type II and ISO 27001 certified.
Email delivery
Notification emails (task assignments, leave approvals, reports) and system communications. Only email addresses and notification content are transmitted.
Analytics
Anonymous website and Platform usage analytics. IP addresses are anonymised before processing. No business operational data is shared.
Payment processing
Subscription payments are processed through a PCI-DSS compliant provider. OptiFlow does not store your full credit card or bank account details.
Your Rights
You have the following rights regarding your personal data. For employee data held under a business customer's account, please contact your employer (the data controller) first — we can assist them in fulfilling your request.
Access your data
Request a copy of the personal data we hold about you.
Correct or update
Ask us to fix inaccurate or incomplete information.
Request deletion
Request that we delete your personal data, subject to legal obligations.
Export your data
Request a portable copy of your data in a standard format (CSV, JSON).
Withdraw consent
Withdraw consent for non-essential data processing at any time.
Communication preferences
Opt out of non-essential emails while keeping Platform notifications active.
How We Protect Your Information
Security is not an add-on — it's built into every layer of the OptiFlow Platform. Here's how we protect your data:
Role-based access
Every user sees only what their role permits. Admin, Manager, and Employee roles have distinct access levels.
Encryption
All data is encrypted at rest (AES-256) and in transit (TLS 1.3). No unencrypted data transmission.
Audit logs
Every action — login, task update, report generation, permission change — is logged with timestamp and user identity.
Monitoring
24/7 automated monitoring for suspicious activity, with alerts to our security team and the account administrator.
Regular backups
Automated backups every 6 hours with 30-day retention. Monthly restoration tests.
Access restrictions
Only essential OptiFlow personnel have access to production systems, and all access is logged and reviewed.
Questions About Privacy?
If you have questions about this Privacy Policy, want to exercise your data rights, or need to report a privacy concern, please contact us:
Response expectations
We aim to acknowledge all privacy-related inquiries within 1 business day and provide a substantive response within 5 business days. For urgent data access or deletion requests, we prioritise resolution within 48 hours.