Last updated: August 2026

Privacy Notice & Consent

Compliant with the DPDP Act 2023. This notice explains what Cformly collects, where it is stored, and the rights you hold over it.

What We Collect

Cformly collects the minimum data needed to file Form C / Form III (foreigner registration) on behalf of your guests:

• Guest passport data: full name, surname, given names, sex, date of birth, nationality, passport number, place/date of issue, expiry. Read from the passport's MRZ line by on-device open-source OCR — never uploaded to any server.
• Guest visa data: visa number, type, place/date of issue, expiry. Read from the visa by the same on-device OCR — never uploaded.
• Guest photo: captured and resized to portal limits, stored encrypted on-device.
• Host/property profile: establishment name, address, FRRO office jurisdiction, contact details. Entered once, reused across filings.

Where Data Is Stored

• On-device encrypted SQLite database (key in iOS Keychain / Android Keystore, hardware-backed where available). Never in plaintext, never in cloud backups.
• Backend (India region): host accounts and auth tokens only. No document data, ever — no passport/visa images or extracted fields touch a server.

How We Use It

• To pre-fill Form C / Form III fields for review and filing.
• To copy the filled fields to the clipboard or a PDF for manual pasting into the portal.
• To auto-fill the FRRO portal form via the free browser extension (the host stays in the browser; no server relay).

Your Rights (DPDP Act 2023)

• Access: export all your data in machine-readable JSON (Settings > Data & Privacy > Export Data).
• Correction: edit any guest field on the Review screen before filing.
• Erasure: Settings > Delete Account removes all local PII, keys, and triggers server-side deletion. You receive a confirmation when complete.
• Grievance: contact dpo@cformly.com for any privacy concern or data request.

Data Retention

• Document photos and extracted fields stay encrypted on the device until you delete them. They leave it only through actions you take explicitly — pushing reviewed fields to the FRRO portal, or exporting a copy — never to Cformly servers.
• The encrypted local store persists until you delete the account or uninstall.

Cross-Border Processing

All document capture and OCR runs entirely on the phone. Guest passport, visa, and field data are never sent to Cformly servers and never cross a border through us; they leave the device only when you explicitly push fields to the official FRRO portal or export a copy. Only host accounts and property data (non-guest) are held in an India region.

Consent

By using Cformly, you consent to this data processing. You can withdraw consent at any time by deleting your account. Withdrawal does not affect filings already submitted to the FRRO (those are governed by the FRRO's own policies).

Contact

• Data Protection Officer: dpo@cformly.com
• Security: security@cformly.com
• Support: support@cformly.com