Privacy policy — MyFloww

This policy explains what personal data MyFloww collects, why we collect it, how we look after it, and what you can ask us to do with it. It is written against the principles of India’s Digital Personal Data Protection Act 2023 (the “DPDP Act”). If you connect a Google account to one of our SEO tools or to Ads Studio, section 4 sets out exactly what we do with the data Google gives us.

1. Who we are

MyFloww operates the website at myfloww.in, and publishes the Kinetiq application and Kinetiq Enterprise. Our address is 2nd Floor, Vinayaka Complex, Sharada Nagar, Near Konankunte Cross, Bengaluru, Karnataka 560062, India. You can reach us at info@myfloww.in or on 080 6218 2464.

For the purposes of the DPDP Act, MyFloww is the Data Fiduciary in respect of data we collect about you directly — for example when you use this website or subscribe to our services.

2. Two different relationships

It matters which of these describes you, because our role is different in each.

You are a visitor to this website, or you contact us: We are the Data Fiduciary. This policy describes what we do with your data.
You commission work from us and use the client portal: We are the Data Fiduciary for your account, your project and its payment records. Section 5 describes what the portal keeps and why.
You are a practitioner or clinic using Kinetiq: We are the Data Fiduciary for your account data, and a Data Processor acting on your instructions for the patient data you put into the system. Your patients’ data belongs to you and your patients, not to us.
You are a patient of a clinic that uses Kinetiq: Your relationship is with your clinic. They decide what is recorded about you and why. We hold that data on their behalf and act on their instructions. Please direct requests about your records to your clinic in the first instance.

3. What we collect

When you use this website

Anything you type into a form: your name, email address, phone number, practice name and your message.
Standard technical information your browser sends to any web server, such as your IP address and browser type, recorded in server logs.
If you pay us through the payment page: your name, email address, phone number, the amount, what you told us the payment is for, and the transaction reference and payment mode the payment gateway (Cashfree or PayU) reports back to us. Your card, UPI or bank details are entered on the gateway’s own pages and never reach us.
If you use Aria, the site’s AI assistant, by chat or by voice call: what you type or say to her. We do not record or keep the audio of a voice call. If you ask Aria to pass your details to us, your enquiry reaches us by email with a transcript of the conversation, and is kept like any other enquiry.

We advertise on Google, and this website runs the Google Ads tag. It sets Google’s advertising cookies so that we can see which ads lead people to contact us, and so that Google can show our ads to people who have visited the site. We do not send it your name, number or anything you type into a form. When you buy a keyword research report, it is told that an order was paid, its amount and its order reference, and nothing about who you are. Google uses what the tag collects under its own privacy policy: see how Google uses information from sites that use its services. You can turn off personalised ads from Google in My Ad Center.

Apart from Google’s, this website sets one functional cookie of its own for Aria’s voice calls, and, only if you sign in to the client portal or pay an invoice there, the portal cookies described in section 5. The voice-call cookie is set only if you start a voice call with Aria: a random identifier that lets us limit each visitor to two calls a day. It is sent only to the voice-call service, holds nothing about you, and expires after two days.

The home page remembers the business type you pick, and where your visit came from (such as the name of an ad campaign), in your own browser, so the page stays set up for your business and an enquiry you send can say which ad or link brought you. Neither is a cookie. Both stay in your browser unless you send us a form, which then includes them, and the business type is also recorded with your visit in Google Ads.

When you subscribe to Kinetiq

Account details: your name, email address, phone number and practice details.
The logins you create for your therapists and assistants.
Billing information necessary to take payment for your subscription.
The clinical and operational data you enter — patient records, case sheets, prescriptions, treatment plans and payment records.

When you buy a keyword research report

To prepare and deliver the report we keep your name, email address and mobile number (Cashfree’s checkout needs one), and your answers: the business, its products and services, its website and any competitors’ websites you name, the place and language you chose, and words to leave out. Marketing emails go to you only if you tick that box; it is unticked unless you tick it.

Cashfree Payments takes the payment: your name, email address and mobile number go to Cashfree with it, and your card, UPI or bank details never reach us.
DataForSEO supplies the search data. It receives the website addresses, products and services, place and language of the research, never your name, email address or phone number.
Resend delivers the report emails.
Where we use Anthropic’s Claude to name groups of keywords, it receives the keywords and your services only, never your contact details.

The report is opened with a private link: a cookie on the browser you ordered from (__Host-mf_report), and the link in each email. We keep the order and payment record for eight years, as accounting records must be kept. The report’s keyword data and files are deleted 90 days after its access ends. Ask at info@myfloww.in and we will erase your name, email address and phone number from an order sooner; the payment record itself stays.

When you create an account or buy a website SEO audit

Your MyFloww account holds your name, email address, mobile number (Cashfree’s checkout needs one), whether you asked for marketing emails (only if you ticked the box), and when you confirmed your address and last signed in. An account nobody confirms with the emailed code is deleted after seven days. For each audit we keep the website, the business details and pages you gave us, and what the audit found: the crawled pages’ addresses, status codes, titles, descriptions and headings, the speed results, and your own notes on the fix list. If you used the same address to buy a keyword research report, that report appears in your account once your address is confirmed.

DataForSEO crawls the public pages of the website you name, on our behalf. It receives the website’s address and the pages you marked as important, never your name, email address or phone number.
Google PageSpeed Insights tests the pages you chose for speed. Google receives those pages’ addresses. The free homepage preview sends Google your homepage’s address the same way, and our server fetches your homepage, robots.txt and sitemap once.
Cashfree Payments takes the payment, as above, and Resend delivers the emails.
Where we use Anthropic’s Claude to draft Pro titles and descriptions, it receives the chosen pages’ current titles, descriptions and headings and your business details, never your contact details.

Your reports open only when you’re signed in; emails carry a link to your account, not to the report itself. Orders, payments and receipts are kept for eight years, as accounting records must be. An audit’s crawl data, speed details, drafts and files are deleted 90 days after its report access ends; its summary stays in your history. You can ask us to close your account at info@myfloww.in; the payment records stay.

When you subscribe to SEO Monitoring

For a subscription we keep your plan and the price you subscribed at, how you chose to pay, the mandate’s status as Cashfree reports it (when you pay on one), every payment with its receipt and the dates it covers, and the website, search location, device, keywords and competitor websites you give us. We never see your UPI ID’s PIN or your card number: Cashfree handles the payment and holds any mandate.

Google Search Console: when you connect it, you sign in with Google and allow read-only access to Search Console. Google gives us a token, which we store encrypted and use only to read the search performance of the property you choose: the searches, pages, clicks, impressions, CTR and positions, by day. We don’t ask for your email address, your other Google data or any right to change anything. Disconnecting from your account deletes the token, so we can no longer read your Search Console. The permission itself stays in your Google account until you remove MyFloww from its third-party connections, which you can do at any time, or use “Revoke all Google access” (see below). We don’t revoke it at Google on a disconnect, because Google would then end that Google account’s permission everywhere, including your Google Analytics connection and any other MyFloww account that uses the same Google account. MyFloww’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
DataForSEO runs the weekly keyword checks. It receives your keywords, the location, language and device, never your name or contact details.
Cashfree Payments sets up and charges the mandate, or takes the payment for a month or a year you pay by hand, and receives your name, email address and mobile number for it. Resend delivers the emails.
Where we use Anthropic’s Claude to write the short summary at the top of a monthly report, it receives that month’s figures (Search Console totals, top searches and pages, keyword movements and the action plan), never your contact details or your token. Section 4 covers everything we do with data from Google.

Subscriptions, payments and receipts are kept for eight years, as accounting records must be. Search Console figures are kept for up to 13 months, and weekly keyword checks and monthly reports for as long as your account exists, so your history stays comparable; ask us at info@myfloww.in to delete them sooner.

When you use Page Optimisation & Website Analytics

We keep the business details you confirm (your business’s name, website, services, customers and location), the pages you choose with what each is for, what we read from each page (its title, description, headings, main text, links and images’ alt text, never your visitors’ data), the checks and suggestions, your decisions and edits, and the drafts you save. We read a page as a visitor’s browser would, only on the website you confirm, and never change it.

Google Analytics: when you connect it, you sign in with Google and allow read-only access (analytics.readonly). Google gives us a token, which we store encrypted and use only to list the properties you can read and to read reports for the one you choose and confirm: sessions, users, engagement, channels, devices, landing pages and the events you choose as outcomes, as totals by day, page or channel. We can’t change your property, install tags or edit events, and we never receive individual visitors’ data. Reports are kept for a few hours to a week, then fetched again. “Disconnect Google Analytics” deletes the token, the property and its reports; “Revoke all Google access” also revokes the permission at Google, which disconnects Search Console too, and ends MyFloww’s access for that Google account everywhere, including any other MyFloww account that uses the same Google account. MyFloww’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Where you ask for AI suggestions, Anthropic’s Claude receives what the suggestions are built from: what we read from the page, the page’s purpose and your business details, the checks, and the page’s Search Console figures (including up to 30 of its search queries) and Google Analytics figures. Never your contact details or a token. Section 4 covers everything we do with data from Google.

Your pages, suggestions and drafts are kept for as long as your account exists, so you can come back to them; ask us at info@myfloww.in to delete them sooner.

When you subscribe to Local Maps Tracker

For each subscription we keep the same subscription, payment and receipt records as for SEO Monitoring (above), and the business listing you choose (its name, address and the identifiers Google gives it), your keywords, your grid’s centre, spacing and nine points, and each scan’s results: the position found at each point, the other listings seen there, and when each check ran.

DataForSEO runs the Google Maps searches. It receives the keyword, the coordinates of each grid point and the language, and the searches you make while finding your listing; never your name or contact details.

Scans and monthly reports are kept for as long as your account exists, so your history stays comparable, including after a subscription lapses; the searches you make while finding your listing are deleted after 90 days. Ask us at info@myfloww.in to delete your scans sooner.

When you subscribe to Backlink Monitor

We keep the subscription, payment and receipt records as above, the website and competitor domains you give us, and each month’s results: the totals, the detail rows the provider returned (linking pages and the pages they link to, anchor text, link attributes and the dates a link was first and last seen), the opportunities, and the monthly report. This is data about public web pages, not about people.

DataForSEO provides the backlink data. It receives the domains you give us, never your name or contact details.

Each month’s totals, new and lost counts and reports are kept for as long as your account exists; the detail rows of a refresh are deleted 400 days after it finished. Ask us at info@myfloww.in to delete them sooner.

When you use Business Profile Insights

Business Profile Insights isn’t open yet. If you join its interest list, we keep your name, email address, business name and area, when you agreed to be emailed, and a scrambled form of your IP address (to stop the list being filled by a script), and use them only to email you when it opens. Ask us at info@myfloww.in to be removed at any time.

When it opens, a subscription also involves:

Google Business Profile: you sign in with Google and allow Google’s Business Profile permission (business.manage), the only permission Google offers for its Business Profile APIs. It isn’t read-only: Google lets it manage a profile as well as read it. We use it only to read: the locations your Google account can access (so you can choose one), that location’s name and address, and its performance figures and search terms as Google reports them. We never edit your profile, reply to reviews or post updates. Google gives us a token, which we store encrypted. It is a separate permission from Search Console and Google Analytics.
What we keep, and for how long: Google’s policy lets us keep Business Profile figures for no more than 30 days, so the figures, search terms and location details are deleted when they are 30 days old and fetched from Google again when they are needed. Disconnecting from your account deletes the token and everything we hold from your profile. “Revoke all Google access” also revokes the permission at Google, which ends MyFloww’s access for that Google account everywhere, including Search Console, Google Analytics and any other MyFloww account that uses the same Google account. You can also remove MyFloww from your Google account’s third-party connections at any time. MyFloww’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

4. Data from your Google account

This section applies when you connect a Google account to one of our SEO tools or to MyFloww Ads Studio. It covers everything we do with the data Google gives us about you and your account (“Google user data”), and where it is more specific than the rest of this policy, it is what applies.

MyFloww’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we ask Google for, and what we read

We never use Google to sign you in, and we never see your Google password. We don’t ask for your contacts, Gmail, Drive or any other Google service: only for the permission the tool you connect needs, and only when you connect it. Only Ads Studio also asks for your Google account’s email address, for the reason given below.

Google Search Console, for SEO Monitoring and Page Optimisation & Website Analytics: read-only access to Search Console (webmasters.readonly). We read the list of properties you can access, so that you can choose your website’s, and, for that property only, its search performance by day: the search queries, pages, clicks, impressions, click-through rate and average position. We can’t change any setting.
Google Analytics, for Page Optimisation & Website Analytics: read-only access to Google Analytics (analytics.readonly). We read the list of properties you can access and, for the one you choose, report totals by day, page or channel: sessions, users, engagement, channels, devices, landing pages and the events you choose as outcomes. We never receive data about individual visitors, and we can’t change your property, tags or events.
Google Business Profile, for Business Profile Insights once it opens: Google’s Business Profile permission (business.manage), the only one Google offers for these APIs. We use it only to read: the locations your Google account can access, the name and address of the one you choose, and its performance figures and search terms as Google reports them. We never edit a profile, reply to reviews or post updates.
Google Ads, for MyFloww Ads Studio: Google’s Google Ads permission (adwords), the only one Google offers for its Google Ads API, which allows both reading and changing an account; and your Google account’s email address (openid and email), so that your account page can show which Google account is connected and we can read the access level that Google user has. We read the list of Google Ads accounts you can access, so that you can choose which to link, and, for the accounts you link only, their settings, campaigns, ad groups, ads, keywords, budgets, targeting, Google’s recommendations and performance figures (impressions, clicks, cost, conversions and search terms) as Google reports them. We change an account only to apply a change you have reviewed and approved in Ads Studio, or to pause the campaigns named in a spend rule you have switched on. We don’t read or change your Google Ads billing or payment details, and we can’t create or close Google Ads accounts.

How we use it

Only to provide the tool you connected, to you: the dashboards, monthly reports, alerts and suggestions in your account for the website or location you chose, and the downloads you ask for. We don’t use Google user data for anything else. In particular, we never:

use it to show, target or personalise advertising, ours or anyone else’s, including retargeted or interest-based advertising (Ads Studio changes your own Google Ads campaigns only as you direct);
sell it, or pass it to data brokers or information resellers;
use it to decide anyone’s creditworthiness, or for lending;
build databases or datasets from it for any purpose other than showing you your own data;
use it to develop, improve or train artificial intelligence or machine learning models, ours or anyone else’s.

Who else handles it, and why

Hostinger hosts our servers and the database where it is stored.
Anthropic, whose Claude writes two features for you, and only when they run. For the short summary at the top of an SEO Monitoring monthly report, it receives that month’s Search Console figures (totals, top searches and top pages) and keyword checks. For AI page suggestions, it receives the page’s Search Console figures, including up to 30 of its search queries, and its Google Analytics figures. For Ads Studio’s assistant, it receives the request you type and, for the account you’re asking about, its campaigns’ names, types, statuses and daily budgets and its ad groups’ names; to draft an ad, it receives the business details and keywords you entered in the campaign builder. It never receives your tokens, your contact details, your Google Ads performance figures or anything from Business Profile. Under Anthropic’s commercial terms it may not use what we send to train its models, and keeps it only for a limited period for safety and abuse monitoring.
Resend delivers our emails. Reports stay in your account, but the alert we email when your clicks drop sharply in a week includes your Search Console click totals for that week and the week before. Ads Studio’s emails name the Google Ads account they are about, and its spending alerts and spend-rule notices include the spending line or the campaigns concerned; its monthly report email carries a short summary.

They handle it only to do that work for us, and may not use it for their own purposes. Google user data is never sent to DataForSEO, Cashfree, PayU or any advertising or analytics tag. We disclose it otherwise only where the law requires us to, or, if MyFloww’s business were ever merged or sold, to the new owner under this same policy and only after telling you.

Who at MyFloww can see it

Nobody reads your Google user data as a matter of course. Our admin screens show which property or location is connected and whether it is syncing, never your figures. For Ads Studio, they show whether your Google connection works and how many changes are waiting, have failed or need checking, never your campaigns, ads, keywords or figures. A person at MyFloww looks at your data only if you ask us to (for example, to answer a question about a figure in your report), where it is needed to investigate abuse or a security problem, or where the law requires it.

How we protect it

It travels only over encrypted connections (HTTPS), between Google, our servers and your browser.
The long-lived token Google gives us is encrypted with AES-256-GCM before it is stored, and is tied to the account it belongs to. The short-lived tokens are held only in our server’s memory. No token is ever sent to your browser or included in an email.
Your figures are shown only when you are signed in to your account.

How long we keep it, and how to delete it

Search Console figures are kept for up to 13 months. Disconnecting Search Console deletes the token, so we read nothing more; the figures already read stay for the reports you have paid for until they are 13 months old, unless you ask us to delete them sooner.
Google Analytics reports are kept for a few hours to a week, then fetched again. Disconnecting Google Analytics deletes the token, the property and its reports at once.
Business Profile figures, search terms and location details are deleted when they are 30 days old, as Google’s Business Profile policies require, including from reports. Disconnecting deletes the token and everything read from the profile at once.
Monthly SEO Monitoring reports and page analyses keep the Search Console and Google Analytics figures they were built from, for as long as your account exists, so you can look back at them.
Google Ads figures and settings that Ads Studio shows on your dashboard are read from Google by a background job, about once an hour, and stored, so your pages show the stored copy rather than asking Google each time. What nobody has looked at for three days is no longer read, and it is deleted after 14 days. Unlinking a Google Ads account deletes them at once. The list of Google Ads accounts your Google user can reach is stored when you connect and when you ask us to look again. The changes you approve, with what each one changed, your spend plans and rules, and your monthly Ads Studio reports are kept for as long as your account exists, as your record of what was done. Keyword files you upload are deleted after 30 days.

You can remove our access at any time: “Revoke all Google access” in your account revokes the permission at Google, which ends MyFloww’s access for that Google account everywhere, Ads Studio included. Disconnecting Google in Ads Studio deletes its token so we read nothing more, without revoking the permission, so that your SEO tools keep working. Or you can remove MyFloww from your Google account’s third-party connections. To have the Google user data we hold deleted, all of it or any part, write to info@myfloww.in from your account’s email address; we delete it within 30 days and tell you when it is done. Closing your account deletes it too.

If this changes

Before we use Google user data in any new way, we will update this section and tell you, and where Google requires it we will ask for your permission again first.

5. The client portal

When we build something for you, we may give you a sign-in to the client portal at myfloww.in/portal/, where you can follow your project, see its payment schedule, read and pay your invoices, and open the documents we share with you. Anyone who receives one of our invoices by email can also pay it through the payment page it links to, without signing in.

What the portal keeps, and why

The name, email address and mobile number you give us. Your email address is how you sign in and how the portal writes to you.
Your project’s details: what we are building, its stages and its payment schedule, and a link to a preview of the work.
Invoices and payment records: what was invoiced, what was paid, when and how, and the reference the bank or payment gateway gave it.
Agreements and other documents we upload for you.
Sign-in records: when you signed in and how, and when your password was set or changed, with a scrambled form of the IP address the request came from rather than the address itself. Your password is stored only as a one-way hash, so nobody at MyFloww can read it.

We use this to deliver and bill your project, and for nothing else. It is not used for marketing, and it is not shared with anyone except the service providers below, or where the law requires it (section 7).

Cookies the portal sets

These are strictly necessary for the portal to work, and are set only when you use it:

a client sign-in cookie, which lasts up to 24 hours;
an admin sign-in cookie, for MyFloww’s own use, which lasts up to 12 hours;
a 15-minute cookie that ties a sign-in code to the browser that asked for it, so a code is no use in anyone else’s;
a 2-hour cookie that lets the payment result page show your payment after you pay an invoice;
a 180-day cookie that remembers a browser you have signed in from, used only to protect your account from being locked out by someone else’s failed attempts. It is never a substitute for your password or code.

None of them is used for analytics or advertising, and the portal’s pages load no analytics, advertising or chat code at all.

Who else handles it

Resend delivers the portal’s emails: sign-in codes, invoices and payment confirmations.
Cashfree Payments takes online payments of invoices. Your name, email address and mobile number go to Cashfree with the payment; your card, UPI or bank details are entered on Cashfree’s own checkout and never reach us.
Hostinger hosts the website and the portal’s database.

How long it is kept

Your account and project details: for as long as you are a client, and afterwards for as long as the law requires.
Invoices and payment records: eight years, the period Indian accounting records must be kept for.
Sign-in codes: each works for 10 minutes, and the record of it is deleted after 24 hours.
Sign-in records: eight years, as part of the record of who did what to your account and its payments.

Your rights

You can ask to see the data the portal holds about you, to have it corrected, and to have it erased where the law allows: payment and invoice records have to be kept for the period above. Write to info@myfloww.in. Section 10 sets out your rights under the DPDP Act in full.

6. Why we collect it, and on what basis

We process personal data for specified, lawful purposes, and only for as long as those purposes require. Specifically:

To provide the service you asked for. Running your account, storing your records, taking payment for your subscription.
To reply to you. If you send us a message, we use your contact details to answer it.
To keep the service secure and working. Detecting abuse, diagnosing faults, maintaining backups.
To meet legal obligations. Where the law requires us to keep or produce records.

We do not sell personal data. We do not use your patient data, or any data from your Google account, to train machine-learning models. We do not send marketing to people who have not asked for it.

7. Who we share it with

We share personal data only with service providers who need it to deliver the service — for example hosting and infrastructure providers, payment processors and email delivery services — and only to the extent necessary for them to perform that function. They are bound to protect it and may not use it for their own purposes.

Online payments are processed by Cashfree Payments or PayU, whichever you choose on the payment page. The details you enter on its checkout are collected by that gateway under its own privacy policy; what it returns to us is the outcome of the payment, the amount, a transaction reference and the contact details you gave us.

The Google Ads tag described in section 3 is different: Google uses what it collects for its own purposes as well, under its own privacy policy.

Aria’s replies are written by Anthropic’s Claude, and on a voice call her voice and hearing are provided by OpenAI. What you say to her is sent to them to produce each reply, under their commercial API terms, which allow them to keep it only for a limited period for safety and abuse monitoring. Both are based in the United States, so this part of the conversation is processed outside India.

Data from a Google account you connect is handled only as section 4 describes, including who else receives it.

We will disclose data where we are legally required to do so, and we will tell you when we are permitted to.

8. Where it is stored, and how it is protected

Patient data in Kinetiq is hosted in India, encrypted in transit and at rest, and access is controlled by role so that staff accounts can only reach what their role requires.

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss and misuse. No system can be guaranteed absolutely secure, and we would rather say that plainly than imply otherwise.

MyFloww does not currently hold HIPAA, ISO 27001 or SOC 2 certification, and does not claim to. HIPAA is a United States healthcare regulation and does not apply to an Indian practice.

9. How long we keep it

Enquiries: kept for as long as needed to deal with the enquiry and a reasonable period afterwards.
Account and clinical data: kept for as long as your subscription is active. On closure, we will return or delete it in accordance with your instructions and any legal retention requirement that applies to clinical records.
Financial records: kept for the period Indian law requires.

10. Your rights under the DPDP Act

As a Data Principal under the DPDP Act 2023, you have the right to:

Access a summary of the personal data we hold about you and how it is being processed.
Correct or complete data that is inaccurate or out of date, and to have it updated.
Erasure of your personal data, where we are not required by law to keep it.
Grievance redressal — to complain to us and receive a response, and to escalate to the Data Protection Board of India if you are not satisfied.
Nominate another person to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these, write to info@myfloww.in. We will respond within a reasonable period. If you are a patient of a clinic that usesKinetiq, please contact your clinic first, as they control your record.

11. Grievance officer

Complaints about how we handle personal data should be sent to info@myfloww.in, marked for the attention of the Grievance Officer, or by post to 2nd Floor, Vinayaka Complex, Sharada Nagar, Near Konankunte Cross, Bengaluru, Karnataka 560062, India.

12. Children

This website is not directed at children. Where a clinic records data about a patient under eighteen in Kinetiq, the clinic is responsible for obtaining verifiable consent from a parent or lawful guardian, as the DPDP Act requires.

13. Changes to this policy

If we change this policy we will update the date at the top of the page. Where a change materially affects how we use your data, we will tell you directly rather than rely on you noticing.

14. Governing law

This policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka.