Privacy Policy

MobileFirst Applications Private Limited ("FintegrationFS", "we", "us") runs the FintegrationFS platform. This policy explains how we handle personal data when you visit our website, create an account, complete company verification and use our APIs.

There are two roles. For data about our own customers, their staff and website visitors, we decide why and how it is used. For End User data our customers submit to the APIs, the customer decides and we process it on its behalf under our Terms of Service. If you are an End User and have a question about a verification, contact the business that requested it.

• Account details: name, work email, mobile number, role, company name.
• Company verification (KYB) details: entity type, PAN, GSTIN, CIN or LLPIN, registered address, signatory details, and documents you upload such as incorporation certificate, authorisation letter, cancelled cheque and GST certificate.
• Credentials metadata: app names, client IDs and when keys were created or rotated. We never store a client secret in readable form, only a hash.
• Usage and billing data: which APIs were called, when, the response status, latency, cost, wallet credits and invoices.
• Technical data: IP address, browser and device details, and server logs. We use only the cookies needed to keep you signed in.
• Messages: your emails and support requests to us.
• End User data: identity and business details that our customers send through the APIs, such as a PAN or GSTIN to be verified, and the results returned.

• To create and run your account and send the verification codes you request by SMS and email.
• To verify your company and decide which APIs we can enable for you.
• To deliver the verifications you request and to meter, bill and invoice usage.
• To secure the Platform, prevent fraud and abuse, and apply rate limits.
• To meet legal, tax, audit and regulatory duties and respond to lawful requests.
• To give support and tell you about changes to the service, billing and security.
• To improve reliability and performance of the Platform, using aggregated or de-identified data where we can.

We do not sell personal data. We do not use End User data for marketing, and we do not use it to train models.

We process account and company data based on your consent, on what is needed to provide the service you asked for, and on legal obligations. You can withdraw consent at any time, but that may mean we can no longer provide the service. Withdrawal does not affect processing done before it.

For End User data, the customer is responsible for notice and consent, as set out in our Terms.

• Service providers that help us run the Platform: SMS and email delivery, hosting, and database providers. They may use the data only to provide their service to us.
• Data sources and registries that we must query to complete a verification you request, such as government and industry databases. They receive only what is needed for that verification.
• Regulators, courts and law enforcement, where the law requires or to protect rights, safety and the Platform.
• A buyer or successor, if we are part of a merger, acquisition or sale of assets, subject to this policy.

We do not sell or rent personal data to anyone.

Our database runs in Singapore, and some of our service providers operate in other countries. Where data goes outside India we do so only as the law permits and with contractual protections in place.

• Account and company data: while your account is open, and afterwards for as long as needed for audit, disputes and legal obligations.
• Usage, billing and audit records: for the period that tax and accounting law requires.
• End User data and verification results: only as long as needed to deliver the result, bill the call, resolve disputes and meet audit duties, as set out in your contract, and no longer than the law allows.
• Verification codes are short-lived and expire within minutes.

When data is no longer needed we delete or anonymise it.

We protect data with encryption in transit, hashed storage of client secrets, access controls, rate limiting on verification and login, and restricted staff access. No system is completely secure. If a breach affects your personal data we will tell you and, where required, the authorities.

We use cookies only to keep you signed in and to complete registration and verification safely. We do not use advertising or cross-site tracking cookies. Blocking these cookies will stop sign-in from working.

Under Indian law you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or complete inaccurate data;
• erase data we no longer need, subject to legal retention duties;
• nominate someone to exercise your rights if you die or cannot act;
• raise a grievance, as set out below.

Write to nishant@mobilefirst.in. We may need to confirm who you are first.

The Platform is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.

If you have a complaint about how we handle personal data, contact our Grievance Officer: Nishant Shah, MobileFirst Applications Private Limited, A 1101-1104 Eastface, Ambli, Ahmedabad 380054. Email: nishant@mobilefirst.in.

We acknowledge complaints within 2 business days and aim to resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.

We may update this policy. We will tell you about material changes by email or in your dashboard before they apply. The date at the top shows the latest version.

MobileFirst Applications Private Limited, A 1101-1104 Eastface, Ambli, Ahmedabad 380054. Privacy questions: nishant@mobilefirst.in.