Privacy Policy
Last updated 14 November 2026
This explains what we collect, why, where it sits, and how to get it deleted. It is written to be read, not to be skimmed past.
Who we are
Sumflow Cloud is the trading name of a sole proprietorship run by Vishal Kumar Sharma, registered for GST in India.
For anything in this policy, write to hello@sumflowcloud.com.
What we collect
If you only visit the website
We use privacy-friendly analytics that count page views and referrers without cookies and without building a profile of you. Our host records standard server logs, including IP addresses, for security and abuse prevention. We do not sell this, and we do not use it to identify you.
If you arrive from a Google Ads campaign, Google may set its own cookies under its own policy. You can opt out at adssettings.google.com.
If you contact us or ask for an audit
Your name, email address, phone number, business name and whatever you tell us about your store. If you send exports for a free profit audit, those files contain your order, advertising and settlement data.
Audit files are deleted within 30 days of us sending the report back, unless you become a client. We do not use one business's data to advise another.
If you become a client
- Business data we are asked to move: orders, products, advertising spend, payment settlements, shipping and return records.
- Access credentials: API keys and tokens for the platforms you ask us to connect.
- Billing details: business name, address, GSTIN and invoice history. Card and bank details go to our payment gateway, never to us.
Your customers' personal data may appear inside the order data we process. We handle it only to run your pipelines, we do not use it for our own purposes, and we never sell or share it.
How we handle credentials
We ask for the narrowest access that does the job — read-only wherever a platform offers it. Credentials are stored encrypted and are never written into code repositories, support tickets or chat messages. You can revoke our access from your own platform settings at any time, without telling us first.
Where your data is stored
Your database and pipelines run on servers we rent for your account, in India unless we agree otherwise in writing. On the Scale plan the database is Amazon RDS in the AWS Mumbai region. Backups are encrypted and kept offsite.
Who else is involved
We keep this list short on purpose. Each of these handles data only to deliver part of the service:
| Who | What for |
|---|---|
| Cloudflare | Website hosting, email forwarding, analytics |
| Hostinger | Servers running client applications and pipelines |
| Amazon Web Services | Managed database, Scale plan only |
| Razorpay or a similar gateway | Taking payment and issuing receipts |
| Advertising and search performance reporting |
We do not sell personal data to anyone, and we do not share it for anyone else's marketing. We will disclose data if a law or a valid court order requires it, and we will tell you unless we are legally barred from doing so.
How long we keep things
- Client data: for as long as you are a client. After you leave, we provide a full export and delete our copies within 30 days.
- Backups: roll off on their own schedule, within 30 days at most.
- Audit files from prospects: deleted within 30 days.
- Invoices and tax records: kept as long as Indian tax law requires, which is longer than the rest.
Your rights
Under India's Digital Personal Data Protection Act, 2023, you can ask us to show you the personal data we hold about you, correct it, or erase it, and you can withdraw consent you previously gave. Email hello@sumflowcloud.com and we will reply within 30 days. There is no charge.
If you think we have mishandled your data, tell us first — we would rather fix it than argue about it. You also have the right to complain to the Data Protection Board of India.
Security, honestly stated
We encrypt data in transit and at rest, limit access to the one person running this business, patch servers on a schedule, and keep daily offsite backups. No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority as quickly as we reasonably can, with what we know at the time rather than waiting for a complete picture.
Children
This service is sold to businesses. It is not directed at anyone under 18, and we do not knowingly collect their data.
Changes
If this policy changes in a way that affects you materially, we will email clients before it takes effect. The date at the top always shows the current version.