What We Collect
Cformly collects the minimum data needed to file Form C / Form III (foreigner registration) on behalf of your guests:
- Guest passport data: full name, surname, given names, sex, date of birth, nationality, passport number, place/date of issue, expiry. Captured via camera OCR from the passport's MRZ line, processed on-device.
- Guest visa data: visa number, type, place/date of issue, expiry. Captured via camera; the image is sent to our backend only for OCR extraction and deleted after the request completes (never stored beyond the request lifecycle).
- Guest photo: captured and resized to portal limits, stored encrypted on-device.
- Host/property profile: establishment name, address, FRRO office jurisdiction, contact details. Entered once, reused across filings.
Where Data Is Stored
- On-device encrypted SQLite database (key in iOS Keychain / Android Keystore, hardware-backed where available). Never in plaintext, never in cloud backups.
- Backend (India region): host accounts, auth tokens. No raw passport/visa images are stored server-side beyond the request lifecycle.
How We Use It
- To pre-fill Form C / Form III fields for review and filing.
- To generate a filled PDF for manual submission (Tier 1 fallback).
- To auto-fill the FRRO portal via the browser extension (Tier 2).
Your Rights (DPDP Act 2023)
- Access: export all your data in machine-readable JSON (Settings > Data & Privacy > Export Data).
- Correction: edit any guest field on the Review screen before filing.
- Erasure: Settings > Delete Account removes all local PII, keys, and triggers server-side deletion. You receive a confirmation when complete.
- Grievance: contact dpo@cformly.com for any privacy concern or data request.
Data Retention
- Document images are auto-purged after successful filing (host-configurable to retain proof). Default: images deleted, structured record retained for history.
- The encrypted local store persists until you delete the account or uninstall.
Cross-Border Processing
The OCR backend runs in an India region (ap-south-1 / asia-south1). No third-party AI services are used — all OCR runs on self-hosted open-source infrastructure (Tesseract / PaddleOCR). No data leaves India.
Consent
By using Cformly, you consent to this data processing. You can withdraw consent at any time by deleting your account. Withdrawal does not affect filings already submitted to the FRRO (those are governed by the FRRO's own policies).
Contact