Privacy Policy

Tanflow Ventures Private Limited ("Tanflow", "we", "us") decides how the personal data described here is used and is responsible for looking after it. This is the notice we give you before we use anything you send us through www.tanflow.com, as India's Digital Personal Data Protection Act, 2023 requires.

It is written to be read. Each section says what we collect, the purpose we collect it for, who else sees it, how long we keep it, and what you can ask us to do about it. Where we say we do something, the code on this site does it.

1. What this notice covers

This notice covers the personal data we handle through this website: the contact form, the demo request form, the resource download form, and cookies.

It does not cover data we handle under a separate written agreement with a customer. Where our software runs inside a customer's environment, or where we operate a system on their instructions, that customer decides how the data in it is used and their own notice governs it rather than this one.

It also does not cover the Tanflow Authenticator mobile application, which has its own privacy policy.

2. The personal data we collect

We collect only what the specific interaction needs. Nothing on this site asks you to create an account, we do not buy personal data from third parties, and we do not build profiles of visitors.

• What you type into a form: your name, work email, phone number, company, product interest and message, depending on which form you are on. Which of those are required differs by form and is marked on the form itself.
• What the request itself carries: your IP address, the identification your browser sends about itself, and the page the form was submitted from. These are recorded with the submission so that abuse can be traced and so that a consent can be evidenced.
• What your browser reports to the consent notice: when you tick a consent box, the page sends a short block of context with it. Section 3 lists it item by item.
• Cookies: a session cookie that carries the token protecting the forms, and a cookie recording your cookie choice. Both are strictly necessary. Optional categories set nothing unless you turn them on. The Cookie Policy names every cookie in a table generated from the same list the site enforces.
• Administrative activity: when a member of our team signs in to the admin console or acts on a record, we log the action, the time, the IP address and the browser. That log is not public and is used to hold our own staff accountable.

3. Our forms: what they collect, and on what basis

Nothing on this site is collected on consent implied from a submission. Each form carries its own notice beside the submit button, with unticked boxes you have to tick yourself, and the required box is checked again on the server so that disabling a script cannot get past it. That notice is reproduced below, word for word. The current form notice version is 2026-08-1.

Contact enquiry form

What we collect

The name, work email, phone number, company and message you enter above.

Why

We use these details to read your enquiry and reply to it. If you tick the optional box, also to email you about our products.

How long

While your agreement stands, and until you ask us to remove it.

Who sees it

Our team, plus the email and hosting providers that run this site for us. We do not sell it and we do not share it for anyone else's marketing.

Where it is

On infrastructure we control. This site does not send your form details to any third-party marketing or CRM service.

What we log

To show that this agreement was given, we record the date and time, the boxes you tick, your IP address and browser details, and the version of this notice you were shown.

Your choices

You can ask us what we hold, have it corrected or deleted, or change your mind about any of this. Email contact@tanflow.com with "Data protection" in the subject, quoting the reference we send you. If we do not resolve it you may complain to the Data Protection Board of India.

What you are asked to agree to:

• I agree to Tanflow using these details to answer my enquiry. (required - without it there is nothing we can do with the form)
• Optional: send me occasional email about Tanflow products and releases. (optional - refusing it changes nothing else about your submission)

Demo request form

What we collect

The name, work email, phone number, company and product interest you enter above.

Why

We use these details to arrange your demo and talk to you about it. If you tick the optional box, also to email you about our products.

How long

While your agreement stands, and until you ask us to remove it.

Who sees it

Our team, plus the email and hosting providers that run this site for us. We do not sell it and we do not share it for anyone else's marketing.

Where it is

On infrastructure we control. This site does not send your form details to any third-party marketing or CRM service.

What we log

To show that this agreement was given, we record the date and time, the boxes you tick, your IP address and browser details, and the version of this notice you were shown.

Your choices

You can ask us what we hold, have it corrected or deleted, or change your mind about any of this. Email contact@tanflow.com with "Data protection" in the subject, quoting the reference we send you. If we do not resolve it you may complain to the Data Protection Board of India.

What you are asked to agree to:

• I agree to Tanflow using these details to arrange and run this demo. (required - without it there is nothing we can do with the form)
• Optional: send me occasional email about Tanflow products and releases. (optional - refusing it changes nothing else about your submission)

Resource download form

What we collect

The name, work email, phone number and company you enter above, and which resource you asked for.

Why

We use these details to send you the resource you asked for and to answer questions about it. If you tick the optional box, also to email you about our products.

How long

While your agreement stands, and until you ask us to remove it.

Who sees it

Our team, plus the email and hosting providers that run this site for us. We do not sell it and we do not share it for anyone else's marketing.

Where it is

On infrastructure we control. This site does not send your form details to any third-party marketing or CRM service.

What we log

To show that this agreement was given, we record the date and time, the boxes you tick, your IP address and browser details, and the version of this notice you were shown.

Your choices

You can ask us what we hold, have it corrected or deleted, or change your mind about any of this. Email contact@tanflow.com with "Data protection" in the subject, quoting the reference we send you. If we do not resolve it you may complain to the Data Protection Board of India.

What you are asked to agree to:

• I agree to Tanflow using these details to send me this resource and answer questions about it. (required - without it there is nothing we can do with the form)
• Optional: send me occasional email about Tanflow products and releases. (optional - refusing it changes nothing else about your submission)

What we record when you agree

The record exists to show what you agreed to, for what, and when. This is the whole of it:

• The reference we show you when the form is sent. It begins TF-C-.
• Which form it was, and the version of the notice you were shown.
• The date and time.
• The purposes you granted, and the ones you were offered and left unticked. The declines are kept on purpose: a log holding nothing but agreements cannot be told apart from a form that ticked itself.
• The email address you entered, which is how we find your records again if you ask us to.
• Your IP address and the identification your browser sends about itself.
• The context your browser reports: time zone and offset, language, screen and window size, pixel ratio, platform, whether the device is touch, the page you were on, the language header and referring page your browser sent, how long the notice was open before you ticked, and whether it was scrolled to the end.
• A keyed hash over the whole record, so that we can tell later whether the record has been altered since it was written.

If your browser sends none of that context - because scripting is off, for example - the record says so rather than inventing it. The record is consent evidence and is used for nothing else. It is not marketed to, not fed into analytics, and not matched against anything else we hold.

You can quote your reference to us to have your record found without answering questions about yourself first.

4. Why we process it, and on what basis

We use each item for a stated purpose and no other. Where we rely on your agreement, you gave it by ticking a box on the form or turning on a category in the cookie panel, and you can withdraw it at any time.

• To read and answer your enquiry, arrange your demo, or send you the resource you asked for - the form data. Basis: the consent you give on the form, which is also necessary to do the thing you asked for.
• To email you about our products and releases - your name and email address. Basis: the separate optional box on the form. It is unticked, it is not a condition of sending the form, and leaving it alone changes nothing about the reply you get.
• To evidence the consent you gave - the record described in section 3. Basis: necessary so that we can meet our own obligation to show that consent was given, for what, and when.
• To keep the site and its forms secure - the session cookie carrying the anti-forgery token, the rate-limit counters, and the IP address and browser recorded with a submission. Basis: necessary to provide the service safely.
• To hold our own staff accountable for what they do with your record - the administrative audit log. Basis: necessary to run the service responsibly.
• To count visits, if analytics is ever switched on - see section 6. Basis: your consent, given through the cookie notice. Off unless you turn it on.
• To evidence your cookie choice - the record described in the Cookie Policy. Basis: necessary so that we can show that a choice was made and what it was.

5. Who else sees your data

We do not sell personal data, and we do not share it for anyone else's marketing. When you send a form, two things happen and nothing else: the details are written to our own database, and one notification email is sent to contact@tanflow.com. That notification states which boxes you ticked and which you did not, so the person who picks it up knows whether your address may go on a mailing list.

This site does not send your form details to any customer relationship management system, any marketing platform, any advertising network, or any sales partner. There is no such integration in it.

• Our own team, being the people who answer enquiries and arrange demos.
• The hosting provider that runs this site and the mail provider that carries the notification, each handling it on our instructions and for nothing of their own.
• Professional advisers, auditors, or a government agency or court, where we are required by law to disclose it.

6. Analytics, and what is not running today

The cookie notice offers an analytics category, and the Cookie Policy names the cookies it would set. It is disclosed there so that it can never be switched on without having been disclosed first.

No analytics is loaded on this site today. The measurement identifier the site would need is empty, so the tag is never injected, and turning the category on right now grants permission for something that does not yet run. The same is true of the marketing measurement category: nothing is running behind it.

If either is switched on, the notice version is raised, everyone is asked again rather than inheriting an old decision, and this page is updated to say so.

7. Transfers outside India

The forms on this site do not require any transfer outside India. What you send is stored on infrastructure we control and delivered by ordinary email to an address we control.

If the analytics category is switched on and you turn it on, the data it collects would be processed by Google on infrastructure outside India. Such transfers are permitted to any country the Central Government has not restricted, and if a country we transfer to is restricted we will stop transferring to it.

8. How long we keep it

We keep what you send us while your agreement stands, and until you ask us to remove it. Where a law requires us to keep something for a period, that takes precedence, and we will tell you so if you ask.

We do not put a countdown on your data that we cannot keep to. Nothing in this application deletes records on a schedule, so naming a period here would be naming one that nothing enforces. The honest position is the simple one: it is here because you agreed to it being here, and it goes when you say so.

• Your form details - kept in our database and in the receiving mailbox while your agreement stands, and removed when you ask.
• Consent records - kept while we hold the details they cover, and for as long afterwards as we may need to show that holding them was agreed to.
• Your cookie choice - 395 days, which is the life of the cookie that carries it.
• Rate-limit counters - short-lived, and cleared out about a day after they are written.
• The administrative audit log - kept, because a log of who did what to a record is only useful for as long as the record can be questioned.

9. Your rights, and what erasure actually does

As a Data Principal under the DPDP Act 2023 you may ask us for a summary of the personal data we hold about you and what we do with it; ask us to correct anything inaccurate or complete anything missing; ask us to erase it; withdraw an agreement you gave, as easily as you gave it; raise a grievance with us; and nominate someone to exercise these rights on your behalf in the event of your death or incapacity. There is no charge.

For cookies, use the Cookie settings link in the footer of every page. It gives and withdraws consent immediately and needs no request to us.

For anything else, email contact@tanflow.com with "Data protection" in the subject, from the address you gave us or quoting your TF-C- reference. If we cannot tell which records are yours, we will ask for the least we need to find them and nothing more.

When we erase a lead, the name, email address, phone number, company, message, IP address and browser identification on that record are cleared and the record is marked erased. Two things survive that, and we would rather say so than have you find out later:

• The consent record described in section 3 is kept. The record of what was agreed to is the evidence that holding your data was lawful, and destroying it would leave us unable to answer for the period during which we held it.
• A line in our administrative audit log recording that the erasure was carried out, by whom, and for which address. An erasure you cannot evidence is an erasure you cannot prove you made. That log is access-controlled and is never shown publicly.

If you want the consent record removed as well, say so and we will consider it on its own terms. Withdrawing consent applies to what we have not already done: if we have replied to your enquiry, that reply has been sent.

Please make requests in good faith. We may not act on one that is false or frivolous, and a request to correct something has to tell us what to correct it to.

10. How we protect it

The site is served over HTTPS with HTTP Strict Transport Security, a Content Security Policy that forbids inline and third-party script, and related response headers. Forms are protected against cross-site request forgery with per-session tokens, against automation with a honeypot field, and against abuse with rate limiting. Database access uses prepared statements throughout. Access to the admin console is authenticated, rate-limited and audit-logged, and database credentials live outside the web root.

No safeguard is complete. If a breach affects your personal data we will notify you and the Data Protection Board of India, as we are required to.

11. Grievance redressal

If you are not satisfied with how we have handled your personal data or your request, write to our Grievance Officer at contact@tanflow.com, or at DCG01-310, DLF Corporate Greens, Sector 74A, Gurugram, Haryana 122004, India, marking it for the attention of the Grievance Officer. We will acknowledge it and respond within the period the law allows.

If we do not resolve it, you may take the matter to the Data Protection Board of India.

12. Where you are outside India

This notice is written to India's Digital Personal Data Protection Act, 2023, which is the law we operate under. If you are somewhere with its own data protection law, that law may give you rights we have not described here. Write to us at contact@tanflow.com and tell us what you are asking for, and we will tell you plainly what we can do.

13. Children

This site and our products are directed at businesses, not at children. We do not knowingly collect the personal data of anyone under 18, which is the age the DPDP Act 2023 uses. We carry no advertising, and we do not track or profile visitors.

If you believe a child has given us personal data through this site, tell us and we will erase it.

14. Changes to this notice

If we materially change what we collect, why, or who sees it, we update this page and raise the version attached to the notice on the forms and to the cookie notice. Raising it asks you again rather than carrying forward a decision you made about a different notice: consent recorded against an earlier wording is not consent to this one.

The date at the top of this page is when it was last changed.

15. Contact

Tanflow Ventures Private Limited
DCG01-310, DLF Corporate Greens, Sector 74A, Gurugram, Haryana 122004, India
contact@tanflow.com

For anything concerning personal data, please put "Data protection" in the subject line so that it reaches the right person.