Legal

Privacy Policy

How Fluno collects, uses, stores, and protects personal data — for the hotels who use Fluno and the guests whose conversations pass through it.

Fluno is operated by R P K Agrotech Exports Private Limited.
Last updated: 4 August 2026 · Effective: 4 August 2026

1Introduction

Fluno is a service provided by R P K Agrotech Exports Private Limited ("Fluno", "we", "us", "our"). We provide an AI-powered guest-messaging service that hotels connect to channels such as WhatsApp, Instagram, Facebook, web chat, and voice. This Privacy Policy explains what personal data we handle, why, how long we keep it, who we share it with, and the rights you have.

Our WhatsApp features are provided through the WhatsApp Business Platform. Your and your guests' use of WhatsApp is also governed by Meta's and WhatsApp's own terms and policies, which apply in addition to this policy.

This policy works alongside our Terms of Service. Where this policy and the Terms describe the same topic, they are read together.

2Who this policy covers

Fluno handles two kinds of personal data, in two different roles:

• Hotel account data — the details of the hotel staff who sign up and operate Fluno. For this data, Fluno is the data fiduciary (controller).
• Guest conversation data — messages and details of the hotel's guests. For this data, the hotel is the data fiduciary and Fluno acts as a data processor on the hotel's instructions.

Because WhatsApp Coexistence lets the hotel keep using the WhatsApp app on its own number while Fluno also connects to that number, both the hotel's own staff (through the WhatsApp app) and Fluno (through the WhatsApp Business Platform) may see the same guest messages. The hotel remains responsible for informing guests and obtaining any consent required.

If you are a guest who messaged a hotel using Fluno, please direct data requests to that hotel in the first instance; we will support them in responding.

3Information we collect

a. Hotel account information

Your name, work email, phone number, hotel name and address, and billing details needed to operate your subscription.

b. Guest conversation data

Messages exchanged with guests over connected channels, the contact identifiers those channels provide (e.g. phone number or handle), and booking-related details shared in conversation (dates, room type, guest count).

c. Technical & usage data

Operational telemetry such as latency, error rates, model usage, and aggregated product analytics (no guest PII).

d. What we do not collect

We do not collect or store guest payment-card details — those flow directly through your payment provider. Voice calls are transcribed and the audio is discarded; we keep the transcript only.

4How we use information

• To operate the messaging service and generate AI replies on the hotel's behalf.
• To maintain conversation context for follow-ups and handovers.
• To provide support, debug issues, and keep the service secure and reliable.
• To bill subscriptions and prevent fraud or abuse.
• To meet legal, tax, and regulatory obligations.

We do not use personal data for advertising, and we do not sell it (see §8).

5Legal bases (DPDP Act)

We process personal data under India's Digital Personal Data Protection Act, 2023 — principally on the basis of (a) the hotel's instructions and our contract with the hotel, (b) the consent the hotel obtains from its guests, and (c) our legitimate need to secure, support, and bill the service. Where consent is the basis, it can be withdrawn at any time (see §11).

6Where your data is stored

All guest and hotel data is stored on Amazon Web Services in the Mumbai region (ap-south-1). Databases, conversation logs, and backups stay within India; we do not replicate data outside India. A guest messaging from abroad is still processed in Mumbai and the reply returns by the same path.

7How long we keep it

8Sharing & sub-processors

We do not sell, rent, or trade personal data, and we do not share one hotel's data with another. We share data only with the sub-processors needed to run the service. We require each sub-processor to handle data under data-processing terms covering residency, access controls, and breach notification.

We notify customers 30 days before adding a new sub-processor.

9AI & your data

Your guest conversations are never used to train Fluno's models. We do not permit our LLM providers to use your data to train their models, and we have not enrolled in any provider programme that would allow it. Where a provider offers zero-data-retention configuration, we use it. If we ever offer an optional AI-improvement program, it will be strictly opt-in with clear scope.

9bSecurity incidents

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and in any case within 72 hours of becoming aware, with what we know about the nature of the breach, the data affected, and the steps we are taking. We will also notify the Data Protection Board of India where the DPDP Act requires it.

10How we secure data

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Passwords are never stored in plain text. Production access is limited to a documented list of engineers reviewed quarterly, protected by single sign-on and hardware security keys, and every access is logged. Support staff can read your data only after you raise a ticket, scoped to your account.

11Your rights

You can, at any time:

• Access & export — download conversation history, guest records, and configuration as JSON/CSV.
• Correct — fix inaccurate account or guest details.
• Delete — remove a specific guest's data, or close your account (all data deleted within 30 days; booking records anonymized but kept 7 years for tax law).
• Audit — request a log of who at Fluno accessed your data and why.
• Withdraw consent and lodge a grievance (see §15).

Email support@tryfluno.com; we respond within 7 working days.

How to request deletion of your data

Anyone whose personal data we hold — a hotel customer, or a guest who messaged a hotel using Fluno — can ask us to delete it. To make a request:

• Email support@tryfluno.com with the subject line “Data deletion request”.
• Tell us the phone number, email address, or account the data relates to, so we can locate it.
• We will confirm receipt within 2 working days and complete the deletion within 30 days.

If you are a guest, the hotel you messaged is the data fiduciary for your conversation — you may contact them directly, and we will support them in responding. Booking records are retained for 7 years where Indian tax and hospitality law requires it, but are anonymised so they can no longer identify you.

12Cookies

Our marketing site uses no third-party cookies, no fingerprinting, and no remarketing pixels. The product app uses one essential session cookie (fluno_session) that expires when you log out.

13Children's privacy

Fluno is a business tool for hotels and is not directed at children. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

14Changes to this policy

We may update this policy as the service evolves or the law changes. Material changes will be notified by email or in-dashboard before they take effect, and the "last updated" date above will change.

15Contact & grievance officer

← Back to tryfluno.com