Data sharing policy

We never sell personal data. We share the minimum required to operate the platform, with vetted processors under contract.

Supabase (auth, database, storage) — US/EU regions. Razorpay (payments) — India. Resend (transactional email) — US. Vercel (hosting & edge) — global. PostHog (product analytics) — US/EU. Each holds a signed data-processing agreement with us.

Sellers see aggregated sales metrics about their products and the buyer's first name + initial. They never see buyer email, phone, or payment details unless the buyer explicitly opens a support thread.

Buyers see a creator's public profile, products, and review responses. Verified-creator KYC documents stay internal.

We respond to valid Indian and foreign legal process narrowly. We notify the affected user unless legally prohibited, and we publish a yearly transparency report.

When you click a partner referral link (e.g. on /rewards), the partner sees your IP and a referral cookie; they don't see your FlowBase account details unless you complete the partner's signup.

We share anonymized, aggregated platform metrics with investors and in our public 'state of the marketplace' reports. Individual users are never identifiable in these.

We only email you for transactional purposes or for the lists you opted into. You can change preferences in /dashboard/settings → Notifications.

Some processors are based outside India. We rely on signed SCCs / DPA addenda and verify they offer adequate safeguards under the DPDP Act, 2023.

If we add a new sub-processor we update this page and email creators 14 days in advance for material changes.