Privacy Policy
This policy explains what information FancyFlow collects when shop owners and their staff use it, why we collect it, where it is kept, who can see it and the choices you have. FancyFlow is billing, inventory and credit software for fancy, cosmetics, gift and general stores, built and operated by Celonix ("we", "us"). Please read it together with our Terms & Conditions.
In short: your shop's data is stored in India on Celonix servers, is walled off from every other shop, is never sold, and stays under your control — you can see it, export it, correct it and ask us to delete it.
1. Who is responsible for what
For the details you give us to open and run your account (your name, email, mobile number and shop details), Celonix decides how they are used and is responsible for them.
For the records your shop keeps in FancyFlow — your customers, staff, suppliers, sales and stock — the shop owner decides what is recorded and why. We store and process those records only on the shop's behalf and only to provide the service, never for our own purposes.
2. Information we collect
- Account details: name, email address, mobile number, role (owner or staff) and the shop you belong to, plus the shop name and details given at registration. Passwords are never stored as typed — only as a salted one-way hash.
- Business records you enter: products, variants, barcodes and racks, stock movements, purchase bills, sales and returns, cash entries, warranties, customers and their credit (udhaar) balances, suppliers and their ledgers, staff, attendance, wallets and incentives, expenses and shop settings. These can include personal data of your own customers and staff, such as names and phone numbers.
- Subscription and support: your plan, its dates, payments we record for it, and the messages you send our support team.
- Usage and security data: server logs (IP address, browser type, the page requested and the time), sign-in and security events, an audit trail of changes made in your shop, and a short-lived "online now" signal used to show which members are active.
We do not use advertising trackers or third-party analytics scripts on FancyFlow.
3. How we use it
- To provide the service: billing, stock, credit, warranty, staff, reports and everything else you use in FancyFlow.
- To sign you in and keep each shop's data separate from every other shop's.
- To keep the service secure: rate limits, sign-in codes, abuse prevention, the audit trail, and the History page that lets you restore a record deleted by mistake.
- To manage your plan and payments, and to answer support requests.
- To send the emails the service needs — email verification, password resets, sign-in codes and important account notices. We do not send marketing email without your consent.
- To understand, in aggregate, how the service is used so we can fix problems and improve it.
4. The AI assistant
Plans that include the AI assistant let the shop owner ask questions about the shop's own figures. When you ask, your question and the shop figures needed to answer it are sent from our server to an AI model provider engaged by Celonix, and the answer is shown to you. Nothing is sent unless you ask, provider keys never reach your browser, and the assistant only sees your own shop's data.
5. Where it is stored and how it is protected
- FancyFlow runs on servers operated by Celonix in India. Your data is kept in our database (MongoDB), and short-lived data such as sign-in sessions and rate limits in Redis.
- Every record carries its shop's identity, and every request is checked on the server, so a member of one shop can never read or change another shop's records. Staff see only what the owner's settings allow.
- Access to the FancyFlow console is limited to named Celonix team members with defined roles, and every change made there is recorded in an audit log.
- All traffic is encrypted with HTTPS, passwords are hashed, sign-in sessions expire, and the database is backed up every night.
No system is perfectly secure. If a personal data breach affects you, we will inform you and the authorities as the law requires.
6. Who we share it with
We do not sell, rent or trade personal data, and we do not share it for advertising. We share it only:
- with service providers that help us run FancyFlow — such as email delivery for our service emails and the AI model provider when you use the assistant — who may use it only to provide that service to us;
- when the law, a court or a government authority requires it, or to protect the rights, safety or property of our users, the public or Celonix;
- with a successor if Celonix's business is reorganised or transferred, in which case this policy continues to apply and we will tell you.
When you send a bill, warranty details or a reminder on WhatsApp, FancyFlow only prepares the message; it is sent from your own WhatsApp app, and WhatsApp's own terms and policy apply to it.
7. Your customers' and staff's data
As the shop owner, you choose what to record about your customers and staff. Please collect only what you need, tell them why you keep it, and act on their requests to see, correct or delete it. We will help you do so — you can edit or delete records in the app, and you can ask us for an export.
8. Cookies and local storage
- Essential cookies keep you signed in and protect forms against cross-site request forgery. A device cookie lets your shop see which devices are signed in.
- Local storage in your browser remembers preferences such as light or dark theme.
These are needed for the service to work, so there is no opt-out other than not signing in; FancyFlow sets no advertising cookies.
9. How long we keep it
- Your account and shop records are kept while your account is open. A lapsed plan does not delete anything — your shop moves to the Free plan and every record stays visible.
- Records you delete in the app first go to the History page, where you can restore them, until you delete them permanently there.
- If you ask us to close your shop, we delete or anonymise its records after confirming the request, except anything the law requires us to keep, such as payment records.
- Server and security logs are kept only as long as needed for security and troubleshooting.
10. Your rights under the DPDP Act
Under India's Digital Personal Data Protection Act, 2023, you have the right to:
- get a summary of the personal data we process about you and how we process it;
- have inaccurate or incomplete data corrected and completed, and data you no longer want us to keep erased;
- withdraw consent you have given, as easily as you gave it (this may mean closing your account);
- nominate another person to exercise your rights if you die or become unable to; and
- have a grievance about our handling of your data resolved by us, and then, if you are not satisfied, approach the Data Protection Board of India.
Most of your details can be corrected directly in the app. For anything else, write to us using the contact details below; we will reply within the time the law allows. If you are a customer or staff member of a shop that uses FancyFlow, please contact that shop first — it decides what it records — and we will help it respond.
11. Children
FancyFlow is a business tool for people aged 18 and over. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy as FancyFlow or the law changes. The "Last updated" date at the top always shows the current version, and we will tell signed-in owners about any significant change before it takes effect.
13. Contact and grievance officer
For questions, requests under this policy or a grievance, contact the FancyFlow team at Celonix — our grievance officer handles every privacy request:
- Email: support@celonix.in
- Website: FancyFlow (a Celonix product)