Privacy Policy

This policy explains how Zunderdog LLP ("we" or "us"), of #120/A, Velsao, P.O. Cansaulim, Goa 403712, India, collects and uses personal data through zunderflow.com, its free tools, the ZunderFlow platform and our outreach to businesses. ZunderFlow is the dealer ordering app we run for manufacturers, distributors and wholesalers. It has three apps: the Partner App (the team app for a business's staff and sales agents), the Client App (the dealer app and web portal) and the Rider App (the delivery app).

Our Grievance Officer is Zubin Souza, Founder & CEO, at privacy@zunderflow.com.

We write this policy for Indian law: the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the SPDI Rules) and the Digital Personal Data Protection Act, 2023 (the DPDP Act) with its Rules, whose main duties start in 2027. What applies as well if you visit from the UK or the EU is in sections 6, 9, 16 and 19.

This policy isn't an agreement you accept by visiting the site. Where we need your consent we ask for it separately and you can say no. The terms of the paid service are in our Terms & Conditions and our Data Processing Addendum.

It depends on which of these four applies to you.

(a) This website and its free tools. If you browse zunderflow.com, send a demo or quote request, use the GST Invoice Generator or take the ERP Readiness Score, we decide why and how your data is used. We are the "data fiduciary" under the DPDP Act and the "controller" under UK and EU law. For a buyer named on someone else's invoice, the invoice maker chose to enter the details and we decide how long we store them and who can see them at the share link. Each of us is responsible for our part. This is covered mostly in section 3 and in sections 6 to 10.

(b) Your business's account with us. If you or your employer buy ZunderFlow, we also decide how to use the details needed to run the subscription: your name, work email, phone number, billing details and support requests. We are the data fiduciary for those.

(c) The ZunderFlow platform. A manufacturer, distributor or wholesaler (a "merchant") uses the platform to run its business with its own customers, riders, staff and sales agents. For their data the merchant decides why and how it is used and we process it only on the merchant's instructions under the Data Processing Addendum. The merchant is the data fiduciary or controller. We are its data processor. Section 4 describes this data.

(d) Our outreach to businesses. If we found your business's details in public and wrote to you about ZunderFlow, we decide how those details are used. We are the data fiduciary or controller. Section 5 describes this.

If you are a merchant's customer, rider, staff member or sales agent, contact the merchant first about your data: what it holds, how it uses it and any request to see, correct or delete it. If you write to us instead, we will pass your request to the merchant and help it answer you. We can't answer for the merchant. It holds the decision.

• Demo and quote requests. Your name, business email, phone number, company, business type and message. For a quote, also your number of dealers, number of products, accounting or ERP system and go-live timing. We also note the site that sent you to us and any campaign tags on the link.
• Booking a call. If you open the booking calendar after sending a request, Calendly loads and we pass it your name, email and company name to pre-fill the booking. What you enter there is also held by Calendly.
• GST Invoice Generator. A logo is uploaded to our image host when you press Save to Browser or Generate Invoice. Each invoice you generate: your business details (company name, GSTIN, address, phone, email and any logo you upload), your buyer's details (name, business name, GSTIN, address, phone) and the invoice details and line items. We save the invoice when you click Generate Invoice so that its share link works. Anyone who has the share link can see and download the invoice so share it only with people who should see it.
• ERP Readiness Score. Your email address, your answers as scores and whether you ticked the box for ERP insights and ZunderFlow updates.
• Email updates. Your email address and where you signed up.
• Messages to us. What you write if you email, call or message us on WhatsApp.
• Technical data. Our host keeps server logs (your IP address, the pages you ask for, the time and your browser type). Vercel Speed Insights measures how fast pages load and records the page address, device and browser type and load times, with no cookies. To block abuse we count requests per IP address in memory for short periods.
• Analytics, only if you accept. Google Analytics and Microsoft Clarity (heatmaps and session recordings) set cookies and record how you use the pages. See our Cookie Policy.

If you are a buyer named on someone else's invoice: the person who made the invoice decided to put your details on it and is responsible for having the right to do so. They gave us your details. We keep them only so the invoice can be shown at its share link. We don't contact buyers and we don't use buyers' details for marketing. To have an invoice deleted, write to privacy@zunderflow.com. The person who made it can ask us too. If you make invoices, enter a buyer's details only if you are entitled to share them with us for this.

A merchant decides what goes into its platform. Typically that is the data below. The merchant is responsible for having the right to enter it (see section 2).

• The merchant and its staff. Business name, owner or operator name, email address, phone number, business address, GST and tax numbers, bank or payment details the merchant enters, branding (logos, colours, themes) and staff and sales agent accounts with their roles.
• The merchant's customers. Name, email address, phone number, delivery address, order history, product preferences and the customer group the merchant puts them in.
• Riders. Name, email address, phone number, vehicle details, delivery history and, during active deliveries, live location. A merchant may also ask for an identity document to verify a rider (for example a driving licence). It is the merchant's choice what it asks for.
• Field sales staff. If the merchant uses visit plans and attendance, the location at check-in and the visits recorded.
• Orders and products. Items, variants, quantities, prices (including group-based prices), discounts, GST, payment status, order history, product catalogues, stock levels and product descriptions.
• Messages. Broadcast notifications, back-in-stock alerts, orders received over WhatsApp or email, support tickets and issue reports raised from the Client App and proof-of-delivery images.
• Connected services. Data the merchant syncs with Zoho Inventory (items, customers, price lists and sales orders) or any other service it connects.
• Technical data. Device type, operating system, browser, IP address, timestamps, pages and features used and crash logs.

Some of this counts as "sensitive personal data or information" under the SPDI Rules, such as bank or payment details. We ask for it only where the service needs it and we use it for nothing else. Where a merchant connects a payment gateway such as Razorpay, the gateway handles the payment under its own terms.

We also write to some businesses before they contact us, to offer them ZunderFlow. This is what we note about them and how we contact them.

• Business contacts from public sources. We may note a business's public details: its name, what it sells, how it takes orders, its website and a business email address, phone number or contact name that the business published itself, for example on its website or in a business listing. We don't buy contact lists.
• How we contact a business. By email or by a message on LinkedIn, where the law allows it. We call or message on WhatsApp only a business that has replied to us or asked us to.
• Our limits. We send no more than three messages. A person reviews each one before it goes. Every email says how to stop them.
• How to stop us. Reply "stop" or write to support@zunderflow.com. We stop and keep only your email address or phone number on a do-not-contact list so that we never contact you again.

We do this on the basis of our legitimate interest in offering ZunderFlow to businesses that may need it. How long we keep these details is in section 15. You can object at any time (section 16).

In India, we use the personal data you give us either with your consent or for the purposes the DPDP Act calls legitimate uses. Examples are data you gave us voluntarily for a purpose you asked for and data we must keep to meet a legal obligation. We don't use it for anything beyond the purpose we told you. Business details we find in public for our outreach are covered in section 5.

If you are in the UK or the EU, these are our purposes for the website, the free tools and our outreach and the legal basis for each under the UK GDPR and the EU GDPR:

For the platform, we process merchants' customer, rider and staff data only to provide the service the merchant has asked for, on its instructions (section 2). We don't use that data for our own marketing and we don't sell it.

We don't make decisions about people by automated means that have legal or similarly significant effects on them.

We ask separately, in plain words, each time. Nothing is pre-ticked. What you enter in our forms and tools is your choice. We need an email address to send a score report and a way to reach you to answer a request.

• Analytics cookies: the cookie banner. Reject is as easy as Accept. Until you choose and after a Reject, we set no analytics cookies and load no Google or Clarity script.
• ERP insights and ZunderFlow updates: the box on the ERP Readiness Score form or the subscribe link in your score email. Without either we use your email only to send your score report. If you unsubscribed before, ticking the box again doesn't subscribe you again: use the subscribe link in your score email.
• Sales follow-up from the GST Invoice Generator: the box above the Generate Invoice button. Without the tick we don't contact you about ZunderFlow using the details you entered.

When you send a demo or quote request you ask us to contact you about it and we may call, email or message you on WhatsApp about that request.

You can withdraw a consent at any time. For cookies use "Cookie settings" at the foot of any page. For emails use the unsubscribe link in any of them. To stop sales follow-up from the GST Invoice Generator, untick the box if the generator page is still open. If you have left the page, write to privacy@zunderflow.com and we stop within 7 days. Any message we send you about ZunderFlow says how to stop. Withdrawing doesn't affect what we did lawfully before. The tools and your demo request still work if you say no.

We don't sell your personal data. We share it only in these ways.

Service providers for the website and free tools. Most of them act on our instructions and use the data only to give us their service. Google and Microsoft also use analytics data as their own privacy policies say (see the Cookie Policy):

Service providers for the platform. The platform uses cloud hosting, message delivery providers (for sign-in codes by SMS, push notifications, emails and the WhatsApp order channel) and, when a merchant uses an AI feature, AI model providers acting on our instructions. They are listed in the Data Processing Addendum.

For our outreach to businesses. Anthropic's Claude AI sees a business's public details when it helps us draft a message (section 13). Our email provider sends our emails. Messages on LinkedIn or WhatsApp go through those services under their own terms.

Services a merchant connects. If a merchant switches on Zoho Inventory, Tally, Razorpay or another payment gateway, Google Maps or a similar service, data goes to it only because the merchant chose that. Those are the merchant's own accounts and each service's own privacy policy applies.

Between people using the same platform. A merchant sees its customers' orders and its riders' delivery status. A customer sees order status and the rider's location during delivery. A rider sees the pickup and delivery addresses for their assignments.

The law. We disclose data when a court, regulator or government agency lawfully requires it or to protect the rights, safety or property of ZunderFlow, its users or the public.

A sale of the business. If we merge with or sell the business to another company, the data may pass to it and it must keep to this policy or ask you again.

We send data outside India only where it is needed to give you the service and each provider is bound to protect it. Some of our providers process data outside India, including in the United States: for example Vercel, Google, Microsoft, Cloudinary and Anthropic. The DPDP Act allows this unless the Government of India restricts a country and we will follow any such restriction.

If you are in the UK or the EU and we send your data to a country without an adequacy decision, we rely on the safeguards our providers offer, such as the standard contractual clauses or the UK's addendum to them. Ask us at privacy@zunderflow.com if you want details.

We follow reasonable security practices and procedures, as the SPDI Rules and the DPDP Act ask. These are the main measures:

• Encryption in transit. Our websites and apps use HTTPS (TLS) and our connections to the website's database are encrypted and verified.
• Access controls. Role-based access in the platform so each role sees only what it needs. Merchants set staff and sales agent permissions in the Partner App. Sign-in uses a one-time code sent to the user's phone number and an account locks after repeated failed attempts.
• Separation. Each merchant's data is kept apart from other merchants' data.
• Limited staff access. Only authorised people who need production data to do their work can reach it.
• Backups and logs. We take regular automated backups and the platform keeps logs of key actions such as sign-ins, setting changes and orders.

Our Security page describes our approach in general terms. We don't claim a security certification. No system is completely secure so please keep your phone and your sign-in codes private and tell us at support@zunderflow.com if you suspect someone else is using your account.

Merchants using the Partner App control the data in their own ecosystem:

• Customer access. Merchants can approve, freeze or block customers. Only customers a merchant adds can sign in to the Client App.
• Product visibility. Merchants decide which products are active or inactive and whether product structured data is published for AI-SEO.
• Pricing and groups. Merchants manage price lists, customer groups and discounts.
• Branding. App templates, colours, themes and landing page content are the merchant's to set.
• Connected services. Merchants choose which integrations and order channels to switch on.

Merchants are responsible for telling their own customers, riders and staff how their data is used and for having a lawful basis, including any consent, for entering it. See the Terms & Conditions.

• Rider location. The Rider App shares live location during an active delivery. The merchant and the customer for that order can see it, to provide live tracking.
• Route navigation. Location lets riders find pickup and delivery addresses.
• Delivery verification. Location at the time of delivery helps confirm that a delivery was made, alongside proof-of-delivery images.
• Field sales check-ins. If a merchant uses visit plans and attendance, the Partner App can record location when a staff member or sales agent checks in.

Delivery tracking runs only while a rider is on an active delivery. A merchant that uses location for its staff must tell them and that is its duty as the data fiduciary.

• AI chatbot. Analyses a merchant's business data to give insights on sales, orders and operations.
• Product descriptions. AI drafts descriptions for the merchant to edit and approve before they are published.
• AI-SEO. Builds JSON-LD structured data (Organization, Business, Product) from merchant data. Merchants can switch product-level structured data on or off.
• Automated order collection. Reads orders that arrive over WhatsApp, email and other channels and turns them into structured orders in ZunderFlow.

To do this, the data needed for the request (for example product details or the text of an order message) is sent to AI model providers that process it on our instructions. AI output is a suggestion. The merchant checks and approves AI-written content before it is published. Orders read from WhatsApp, email and other channels are created automatically and the merchant checks them.

Drafting our outreach. To prepare the messages in section 5, we use Anthropic's Claude AI to read a business's public website and listing and to draft a message. A person reviews every message before it is sent. No decision with legal or similarly significant effect is made about anyone this way.

On this website, Google Analytics and Microsoft Clarity set cookies only if you accept them in the cookie banner. Until you choose and after a Reject, neither loads and neither sets a cookie. The site itself sets a small number of cookies and browser-storage items to remember your choice and to make the tools work. We set no advertising cookies ourselves. Microsoft Clarity can bring cookies of Microsoft's own, which the Cookie Policy lists.

The Cookie Policy lists each cookie, what it does, who sets it and how long it lasts. You can change your mind at any time with "Cookie settings" at the foot of any page. Google also offers an opt-out add-on for Google Analytics at tools.google.com/dlpage/gaoptout.

We aim to keep personal data only as long as the purpose needs it. The periods below are when a record becomes due for deletion. We delete the records we hold ourselves in a review each January. A record can therefore stay up to a year after its period ends. A share link stops working when its period ends. Server logs, backups and analytics data follow the rules of the provider that holds them.

When data is no longer needed it is deleted or made anonymous. We keep a record you asked us to delete only as far as the law requires.

Wherever you are you can already ask us what personal data we hold about you and ask us to correct or delete it. You can also withdraw a consent you gave. Write to privacy@zunderflow.com.

You can also tell us at any time to stop using your data for direct marketing, including the outreach in section 5. We always honour it.

From 2027 the DPDP Act also gives you the right to:

• know what personal data we process about you, why we process it and who we share it with;
• have inaccurate or incomplete data corrected and ask us to erase your data unless we need it for the purpose you gave it for or the law requires us to keep it;
• withdraw consent at any time;
• have your grievance dealt with (section 19);
• name a nominee to exercise these rights for you if you die or can't act for yourself. Tell us in writing who they are and how to reach them.

If you are in the UK or the EU you also have the right to have your data corrected or erased, to ask for a copy of it, to ask us to restrict how we use it, to receive it in a portable format and to object to processing that rests on our legitimate interests or to direct marketing.

How to use them. Write to privacy@zunderflow.com. We may ask you to prove who you are first. We reply within 30 days and we don't charge for it. For data a merchant holds on the platform, contact the merchant first (section 2) and we will help it answer.

ZunderFlow is a business platform and isn't designed for or directed at children under 18. Our website and free tools are for businesses. We don't knowingly collect personal data from anyone under 18. If you think a child has given us data, write to privacy@zunderflow.com and we will delete it promptly.

If a personal data breach affects data we are responsible for we do three things. We report the cyber security incident to CERT-In within the time the law sets. We tell the Data Protection Board of India and the people affected as the DPDP Act requires. For UK and EU data we also tell the data protection authority within 72 hours where the law requires it.

If a breach affects data we process for a merchant, we tell the merchant without undue delay so it can meet its own duties (see the Data Processing Addendum).

1. Write to our Grievance Officer first. Zubin Souza, Founder & CEO, Zunderdog LLP, #120/A, Velsao, P.O. Cansaulim, Goa 403712, India. Email: privacy@zunderflow.com. We reply within 30 days and settle the grievance within one month of receiving it.
2. If you aren't satisfied, you can complain to the Data Protection Board of India once it is able to receive complaints under the DPDP Act. The Act asks you to use our grievance route first.
3. In the UK you can complain to the Information Commissioner's Office (ico.org.uk). In the EU you can complain to the data protection authority where you live or work.

If the data is a merchant's, please start with the merchant (section 2).

Our site and platform link to other services (for example Zoho Inventory, payment gateways and WhatsApp). We aren't responsible for how they handle data so please read their privacy policies.

We may update this policy when our practices, our providers or the law change. When we do, we change the "Last updated" date above and post the new version here. For a significant change we also email registered merchants. If a change means we need your consent for something new, we ask you again and don't treat your continued use as consent.

• Privacy requests and complaints: Zubin Souza, Founder & CEO, at privacy@zunderflow.com
• General questions: support@zunderflow.com
• Phone: +91-9940285902
• Post: Zunderdog LLP, #120/A, Velsao, P.O. Cansaulim, Goa 403712, India