Legal

Privacy Policy

Last updated: 8 April 2026

This Privacy Policy explains how FlowSkool, operated by EventSkool Private Limited ("FlowSkool", "we", "us"), collects, uses, shares and protects personal data when you use our website at flowskool.io and our platform at app.flowskool.io (the "Service").

Two distinct roles. For data about your own account (you, our customer), we act as the data fiduciary / controller. For data about your contacts and audience that you upload and process through the Service, we act only as a data processor acting on your instructions — see our Data Processing Addendum.

1. Who we are

FlowSkool is a product of EventSkool Private Limited, a company incorporated in India with its registered office at House No. 46, Sonai, Narainpur (Mirzapur), Chunar, Mirzapur — 231305, Uttar Pradesh, India. For privacy questions, contact our Grievance Officer at support@eventskool.io.

2. Information we collect

Information you provide

Account data — name, email, phone number, business name, password.
Billing data — plan, billing address, GSTIN (if any). Card and payment details are handled by our payment processor (Cashfree); we do not store full card numbers.
Content you upload — contacts, message templates, campaign content and other data you choose to manage in the Service.
Support communications — messages you send us.

Information collected automatically

Usage and log data (pages viewed, features used, actions taken).
Device and connection data (IP address, browser, operating system).
Cookies and similar technologies — see our Cookie Policy.

3. How we use your data

To provide, operate, secure and improve the Service.
To process payments and manage your subscription.
To send service, security and transactional communications.
To provide customer support.
To detect, prevent and address fraud, abuse and security issues.
To comply with legal obligations.

4. Legal bases for processing

Where the DPDP Act, 2023 applies, we process personal data on the basis of your consent or for legitimate uses permitted by law. Where the GDPR applies (for individuals in the EEA/UK), we rely on: performance of a contract, your consent, our legitimate interests, and compliance with legal obligations.

5. Sharing & sub-processors

We do not sell your personal data. We share data only with service providers who help us run the Service, under appropriate contracts. Our key sub-processors include:

Provider	Purpose	Location
Supabase	Database & backend hosting	Global
Amazon SES (AWS)	Transactional & campaign email delivery	Global
Meta Platforms	WhatsApp Business API, Instagram & Messenger	Global
Cashfree Payments	Payment processing	India
Google	OAuth, Sheets export, DNS lookups	Global

We may also disclose data where required by law, to enforce our terms, or to protect rights and safety.

6. International transfers

Some of our sub-processors operate outside India. Where personal data is transferred internationally, we take steps to ensure an adequate level of protection consistent with applicable law (including, where relevant, GDPR standard contractual clauses).

7. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service, then for the period required to meet our legal, accounting and dispute-resolution obligations, after which it is deleted or anonymised.

8. Your rights

Subject to applicable law, you may have the right to access, correct, update or erase your personal data, to withdraw consent, to data portability, to nominate (under the DPDP Act), and to grievance redressal. To exercise these rights, contact us at support@eventskool.io. You also have the right to lodge a complaint with the Data Protection Board of India or your local supervisory authority.

9. Security

We implement technical and organisational measures including multi-tenant isolation with row-level security, encryption of secrets, signed webhooks, role-based access control, input sanitisation and access logging. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

10. Children

The Service is not directed to individuals under 18, and we do not knowingly collect their personal data. Where the DPDP Act applies, we will obtain verifiable parental consent before processing a child's data to the extent required.

11. Grievance Officer

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000, our Grievance Officer is:

Grievance Officer, EventSkool Private Limited
EventSkool Private Limited
Email: support@eventskool.io

We aim to acknowledge grievances within the timelines prescribed by law.

12. Changes

We may update this Policy from time to time. Material changes will be notified through the Service or by email. The "Last updated" date reflects the latest revision.

13. Contact

Questions? Email us at support@eventskool.io.