Privacy Policy

This Privacy Policy describes how Sanex Labs ("Company", "we", "us", or "our") collects, uses, shares, and protects your personal information when you use Flip ("Platform"), accessible at flip.sanexlabs.co.in. We are committed to protecting your privacy and handling your data transparently.

By using Flip, you consent to the data practices described in this Privacy Policy. If you do not agree with this policy, please discontinue use of the Platform.

1. Information We Collect

We collect the following categories of information:

• Account Information: When you sign in with Google, we receive your name, email address, and profile picture from Google OAuth.
• Usage Data: Conversion history, tools used, file types processed, timestamps, and daily usage counts.
• Device Information: Browser type, operating system, screen resolution, and device identifiers.
• Network Information: IP address (stored only as an irreversible SHA-256 hash for quota management — raw IP addresses are never stored).
• Cookies: Session cookies, anonymous client identification cookies, and essential functionality cookies.
• Payment Information: Transaction IDs, plan details, and billing history (processed through Razorpay — we never store your card details).

2. Information We Do Not Collect

We want to be explicit about what we do not collect or store:

• We do not read, scan, index, or analyse the contents of your uploaded files.
• We do not store your files beyond the time required for conversion (maximum 1 hour).
• We do not store your raw IP address — only an irreversible cryptographic hash.
• We do not store your Google password or any authentication credentials.
• We do not store your credit card, debit card, or bank account details.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve the document conversion services.
• To create and manage your user account.
• To enforce daily conversion quotas and prevent abuse.
• To process payments and manage subscriptions.
• To administer the Flip Rewards programme and wallet system.
• To detect, prevent, and address fraud, abuse, and security issues.
• To communicate important service updates, policy changes, and security alerts.
• To generate aggregated, anonymised analytics to improve the Platform.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your data based on:

• Consent: When you sign in and agree to these terms.
• Contractual Necessity: To provide the services you have requested.
• Legitimate Interest: To prevent fraud, ensure security, and improve services.
• Legal Obligation: To comply with applicable laws and regulations.

5. File Processing and Security

When you upload a file for conversion, the file is transmitted over HTTPS (TLS 1.2+) to our secure servers. Files are stored in isolated, temporary directories unique to each conversion job. Upon completion, converted files are available for download for a limited time (up to 1 hour) and are then permanently and irrecoverably deleted from our servers.

6. Cookie Policy

Flip uses the following types of cookies:

• Essential Cookies: Required for the Platform to function. These include session tokens and CSRF protection cookies.
• Anonymous Identification Cookies: A randomly generated identifier to track guest conversion quotas. This cookie contains no personally identifiable information.
• Authentication Cookies: Secure, HTTP-only cookies to maintain your signed-in session.

We do not use third-party advertising cookies or tracking pixels. You may disable cookies through your browser settings, but this may limit certain Platform features.

7. Anonymous and Guest User Privacy

For users who do not sign in, we track usage through a combination of IP address hashing and a randomly generated anonymous client cookie. The IP hash is a one-way cryptographic hash combined with a server-side salt — it cannot be reversed to reveal your actual IP address. This system exists solely to enforce fair usage quotas.

8. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data with:

• Google: For OAuth authentication (limited to name, email, profile picture).
• Razorpay: For payment processing (limited to transaction data).
• Hosting Providers: Our server infrastructure providers who process data on our behalf under strict confidentiality agreements.
• Law Enforcement: Only when required by a valid legal order, subpoena, or court order issued by a court of competent jurisdiction in India.

9. Data Retention

We retain your data for the following periods:

• Uploaded Files: Maximum 1 hour after conversion completion, then permanently deleted.
• Account Data: Retained for the duration of your active account plus 90 days after deletion request.
• Conversion History: Metadata only (file name, size, type, timestamp) retained for 12 months for your reference.
• Payment Records: Retained for 7 years as required by Indian tax and financial regulations.
• Anonymous Usage Data: IP hashes and anonymous quotas are retained for 30 days and then purged.
• Fraud Logs: Retained for up to 3 years for security and legal purposes.

10. Data Storage and Location

Your data is stored on servers located in India. We ensure that all data processing complies with applicable Indian data protection laws including the Digital Personal Data Protection Act, 2023 (DPDP Act). If data is transferred outside India, we ensure appropriate safeguards are in place in compliance with applicable law.

11. Security Measures

We implement the following security measures to protect your data:

• HTTPS/TLS encryption for all data in transit.
• Encrypted storage for sensitive data at rest.
• Isolated file processing environments per conversion job.
• Rate limiting and DDoS protection.
• Regular security audits and vulnerability assessments.
• Role-based access controls for administrative functions.
• Automated file deletion after processing completion.

12. Your Rights Under Indian Law (DPDP Act)

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access your personal data that we hold.
• Request correction of inaccurate or incomplete personal data.
• Request erasure of your personal data (subject to legal retention requirements).
• Withdraw consent for data processing at any time.
• Nominate another person to exercise your rights in the event of your death or incapacity.
• Lodge a grievance with our Data Protection Officer or the Data Protection Board of India.

13. Your Rights Under GDPR (EEA Users)

If you are in the European Economic Area, you additionally have the right to:

• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interest.
• Restrict processing in certain circumstances.
• Lodge a complaint with your local Data Protection Authority.

14. Children's Privacy

Flip is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete such information promptly. If you believe a child has provided us with personal data, please contact us immediately.

15. Google OAuth Data Usage

When you sign in with Google, we request access to your basic profile information (name, email, and profile picture). We use this information solely to create your Flip account and display your profile within the Platform. We do not access your Google Drive, Gmail, contacts, calendar, or any other Google services. You may revoke Flip's access to your Google account at any time through your Google Account permissions settings.

16. Payment Data Security

All payment transactions are processed through Razorpay, a PCI-DSS Level 1 certified payment gateway. Your credit/debit card information is transmitted directly to Razorpay and is never received, processed, or stored on our servers. We only store transaction reference IDs and payment status for record-keeping purposes.

17. Wallet and Reward Data

If you participate in the Flip Rewards programme, we maintain records of rewards credited, wallet balance, and withdrawal history. This data is necessary for the proper functioning of the rewards system and for audit and fraud prevention purposes. Wallet transaction data is retained for 7 years in compliance with financial regulations.

18. Automated Decision-Making

We use automated systems for fraud detection, quota enforcement, and reward distribution. These systems may make decisions that affect your access to the Platform (such as account suspension for detected abuse). You have the right to contest any automated decision by contacting our support team, and we will conduct a manual review.

19. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any third-party services before providing your personal information.

20. Communication Preferences

We may send you service-related communications including security alerts, policy updates, and account notifications. These are considered essential and cannot be opted out of while you maintain an account. We will not send promotional or marketing emails without your explicit opt-in consent.

21. Data Breach Notification

In the event of a data breach that is likely to affect your rights and freedoms, we will notify affected users via email and a prominent notice on the Platform within 72 hours of becoming aware of the breach, as required by applicable law. We will also notify the relevant regulatory authorities as required.

22. International Data Transfers

If you access Flip from outside India, please be aware that your data will be transferred to and processed in India. By using the Platform, you consent to this transfer. We ensure that any international data transfers comply with applicable data protection regulations and that appropriate safeguards are in place.

23. Log Data

Our servers automatically record certain information ("Log Data") when you access the Platform, including request timestamps, response codes, request duration, and error messages. Log data is used solely for debugging, performance monitoring, and security analysis. Log data is retained for 30 days and then purged.

24. Analytics

We collect anonymised, aggregated analytics data to understand how users interact with the Platform, which tools are most popular, and where we can improve. This data is fully anonymised and cannot be used to identify individual users. We do not use third-party analytics services that track individual users across websites.

25. Account Deletion

You may request deletion of your account and all associated personal data by contacting us at our support email. Upon receiving a verified deletion request, we will:

• Delete your account profile and authentication data within 15 business days.
• Delete your conversion history and usage data within 30 days.
• Retain payment records for the legally required 7-year period in anonymised form.
• Forfeit any remaining wallet balance unless a withdrawal is initiated before deletion.

26. Do Not Track Signals

Our Platform does not respond to Do Not Track (DNT) browser signals as there is no consistent industry standard for compliance. However, we do not engage in cross-site tracking or behavioural advertising, so your privacy is protected regardless of your DNT settings.

27. Data Protection Officer

We have designated a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and compliance. You may contact our DPO for any privacy-related concerns, requests, or complaints at the contact information provided below.

28. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via email and a prominent notice on the Platform at least 15 days before the changes take effect. Your continued use of the Platform after the effective date constitutes your acceptance of the updated policy.

29. Compliance

This Privacy Policy is designed to comply with the following regulations:

• Digital Personal Data Protection Act, 2023 (India)
• Information Technology Act, 2000 and IT Rules, 2011 (India)
• General Data Protection Regulation (GDPR) — for EEA users
• California Consumer Privacy Act (CCPA) — for California residents

30. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Company: Sanex Labs
• Data Protection Officer: privacy@sanexlabs.co.in
• General Support: support@sanexlabs.co.in
• Platform: flip.sanexlabs.co.in
• Location: Hyderabad, Telangana, India