Privacy Policy

connectotp is operated by Flincbyte [TODO: full legal name, e.g. “Flincbyte Technologies Private Limited”] (“Flincbyte”, “we”, “us”), [TODO: CIN / LLPIN] · GSTIN [TODO], registered office at [TODO: registered office address].

This policy is our notice under Section 5 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the DPDP Rules, 2025. It also meets the privacy-policy requirement of the Information Technology Act, 2000 and the SPDI Rules, 2011.

We play two roles:

• Data Fiduciary for data about our website visitors, our customers and their team members. We decide why and how that data is used.
• Data Processor for data about the people our customers send OTPs to (“Recipients”). Our customer is the Data Fiduciary for that data, and we process it only on their instructions, under our Data Processing Addendum.

Account data: name, work email, phone number, company name, GSTIN and billing address. Your password is stored only as a salted hash, and API secret keys only as hashes.

Payment data: payments are handled by our payment gateway. We do not see or store card numbers, UPI PINs or bank credentials. We receive only the transaction reference, amount and status.

Recipient data, which we process for our customers: mobile number, the OTP code (stored only as a one-way hash), the message template, the channel used, delivery status and timestamps, and operator delivery receipts.

Technical data: IP address and metadata of API requests and dashboard sessions, and security logs.

Website: this site sets no cookies and loads no analytics, advertising or third-party scripts. The dashboard uses only cookies strictly needed to keep you signed in.

Messages you send us: if you email us, including through the contact form (which only opens your email app), we receive what you write.

We process personal data only for the purposes below, on the basis of your consent or a legitimate use under Section 7 of the DPDP Act (data you give us voluntarily for a specified purpose, or processing needed to comply with law):

• Running your account, billing and issuing GST invoices.
• Delivering messages: sending the OTP by WhatsApp and, on fallback, by SMS, and reporting delivery.
• Security and fraud prevention: rate limits, spend caps, and detecting SMS pumping and abuse.
• Legal compliance: TRAI DLT rules, CERT-In Directions, tax law and lawful requests from authorities.
• Service communications: security alerts, low-balance warnings and changes to these terms.
• Improving the service, using only aggregated or de-identified statistics.

We do not sell personal data. We do not use it for advertising. We do not use Recipient data for any purpose of our own.

We share personal data only as needed to run the service, under written contracts that require confidentiality and security:

We also share data with professional advisers under confidentiality; with government agencies, courts or regulators where Indian law requires it; and with a successor entity in a merger or acquisition, which must keep to this policy.

We store personal data on servers in India.

For the WhatsApp channel, the Recipient’s number and the message must pass through Meta’s WhatsApp Business Platform, which may process them outside India. Section 16 of the DPDP Act permits this unless the Central Government has restricted transfers to that country. Customers who need India-only processing can send with the SMS-only channel.

We keep personal data only as long as the purpose needs it or the law requires. Then we erase it or anonymise it irreversibly.

We maintain reasonable security safeguards under Section 8(5) of the DPDP Act and Section 43A of the IT Act. These include:

• TLS for all traffic and encryption at rest.
• Hashing of OTP codes, passwords and API keys.
• Least-privilege access with multi-factor authentication for staff.
• Access logging and monitoring.
• Backups, vulnerability management and security clauses in vendor contracts.

If a personal data breach occurs, we will inform affected Data Principals and the Data Protection Board of India as the DPDP Act and Rules require, and report to CERT-In within 6 hours where its Directions apply. For Recipient data, we notify our customer, who is the Data Fiduciary, as set out in the DPA.

Under Sections 11 to 14 of the DPDP Act, you can:

• Ask for a summary of your personal data we process, and who we’ve shared it with.
• Ask us to correct, complete, update or erase it.
• Withdraw consent at any time, as easily as you gave it. This doesn’t affect processing that already happened, and we may need to close your account if we can’t provide the service without the data.
• Use our grievance redressal process (section 11 below).
• Nominate someone to exercise these rights if you die or become incapacitated.

Write to privacy@connectotp.com. We may verify your identity before acting.

If you received an OTP from a business that uses connectotp, that business is the Data Fiduciary. Please contact them first; we will help them answer you, and forward any request you send us.

If you aren’t satisfied after using our grievance process, you can complain to the Data Protection Board of India.

connectotp is a business service and is not meant for children. You must be 18 or older to open an account.

Customers who send OTPs to children are responsible for getting verifiable parental consent under Section 9 of the DPDP Act.

If we materially change this policy, we will tell account holders by email or in the dashboard before the change takes effect, and update the date above. You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution.

We acknowledge complaints within 24 hours and resolve them within 15 days of receipt (Rule 3(2), IT Intermediary Rules, 2021), which is well within the time allowed under the DPDP Rules, 2025.