Privacy policy
Last updated 3 November 2026
This policy explains what personal data Flexsetu collects, why we use it, who sees it, how long we keep it and the rights you have under the Digital Personal Data Protection Act, 2023. It covers flexsetu.com and the Flexsetu apps. Flexsetu is run by ROLL - ON MEDIA PRIVATE LIMITED, No. 42 & 43, First Floor, Rajiv Nagar, Varadharajapuram, Kancheepuram 600044, which decides how your data is used.
We do not sell your data, show advertising, or use analytics or tracking scripts.
1. What we collect
Your account
- Your Indian mobile number, whether you are a person or an organisation, your password and, if you add one, your email.
- We keep your password only as a hash. We keep your phone number and email only in a keyed, scrambled form, with a masked hint such as +91 98******11, so that our staff cannot read them in full.
Your profile
- Your nickname, picture and, if you choose, your gender and skills, which others can see.
- For matching you to tasks: your state, city, education, skills and the device you work on, either as you tell us or as verified.
Identity checks
- For a person: your full name, date of birth, one identity document (a masked Aadhaar, with the first 8 digits hidden, PAN, passport, driving licence or voter ID) and, if you choose, a selfie.
- For an organisation: its legal name and registration number, its documents, and its representative's name and identity document.
- We record when you gave your consent, and our team reviews what you send.
Payout accounts
Your bank account or UPI ID and the account holder's name are sent to our payment partner to be verified. We keep only the partner's reference, a masked label and whether the name matched, not the full account number.
Location
- The app asks for your location only while you use it, never in the background.
- To sort tasks near you, your device rounds your position to about 1 km before sending it. We use it only to sort the list. The website keeps it for the visit only.
- When you look up the address of a place, your position is sent to Ola Maps to find it.
- During a local job, when you check in, confirm completion or ask for help, your exact position is sent. We keep how far you were from the job, and the position itself encrypted, for 30 days.
- A local task shows others only a point up to 450 metres from the place. The exact address is encrypted and given only to the chosen worker.
Emergency contacts
The names and phone numbers or emails of the emergency contacts you add are kept encrypted. You add, see and remove them in your account settings; each is confirmed with a code we send them. They are told only if you ask for help, and after verifying themselves they can see your position for up to 30 minutes.
Messages, files and money
- The messages you send. They are checked automatically: messages asking for passwords, codes or payment outside Flexsetu are not sent, and contact details and links may be flagged for our team.
- The files you upload, up to 25 MB each, such as handed-in work, evidence and pictures. Every file is scanned for viruses.
- Your top-ups, task pools, earnings, withdrawals and fees, each with its number.
Technical data
- Whether you use the website or the app.
- Your IP address, kept only in scrambled form, to limit how many sign-in codes and password attempts can be made.
- Request logs: the page or action asked for and your browser's headers, such as the user agent and forwarding address.
2. Why we use it
- to create your account, sign you in and keep it secure;
- to show you tasks and services and match you to the ones you can take;
- to hold and move money, and to verify identities and payout accounts;
- to keep people safe in local work and answer requests for help;
- to review listings, resolve disputes and prevent fraud and abuse;
- to tell you about your tasks and orders;
- to meet our duties under the law, such as tax, accounts and lawful requests.
We use your data with your consent, which you give when you sign up and when you start an identity check, or where the law allows us to without consent, for example to meet a legal duty.
3. Who sees it
- The other side of a task or order sees your nickname, picture, the gender and skills you made public, the work and your messages. For a local task, the chosen worker gets the exact address.
- Our team sees what it needs for review, support, safety and disputes. Identity documents and help-request locations are open only to the staff member handling the case, and every look is logged.
- Service providers who work for us: Exotel sends sign-in codes by SMS; Ola Maps finds addresses and routes and serves the map, which your browser loads directly from Ola; our payment partner, name to confirm, handles top-ups, payouts and payout account checks. Our servers, file storage and virus scanning are run by us at hosting provider and location to confirm.
- Authorities, when the law requires us to share.
4. How we protect it
Addresses, locations and emergency contacts are encrypted. Phone numbers, emails and IP addresses are kept in scrambled form. Backups are encrypted every day. Staff access to sensitive data is limited to the people handling a case and is logged.
5. How long we keep it
| Data | Kept for |
|---|---|
| Exact addresses, job locations and completion codes of local tasks | 30 days |
| Records of how a task was reviewed | 180 days after the decision |
| Evidence in a dispute | 365 days |
| Files you upload, such as handed-in work, pictures, evidence and identity documents | 365 days after what they belong to ends: the order, task, service or identity check |
| Money movements and statements | 8 years, as tax and company law requires |
| Emergency contacts | 1 year after you add them, or until you remove them |
| Your number, email, password, name, profile and payout accounts | While your account is open, and 15 days after you ask to close it |
| Orders and their messages, disputes and identity checks | 8 years after your account closes, as the law requires |
| Backups | 14 days |
6. Cookies and storage
The website uses only the cookies it needs to keep you signed in safely:
| Name | What it does | Lasts |
|---|---|---|
__Host-taskcat_access |
Keeps you signed in | 15 minutes |
__Host-taskcat_refresh |
Renews your sign-in | 30 days |
__Host-taskcat_csrf |
Protects your actions from forged requests | 30 days |
The website also keeps your rounded nearby position for the visit, and drafts of local tasks on your device. The app keeps your sign-in in the phone's secure storage and sets no cookies.
7. Your rights
Under the Digital Personal Data Protection Act, 2023, you can:
- ask what personal data we hold about you and how we use it;
- have it corrected, completed or updated;
- have it erased, except what we must keep by law or for an open dispute, by closing your account in Settings;
- withdraw your consent, which stops further use but may mean you can no longer use parts of Flexsetu;
- nominate someone to act for you if you die or cannot act yourself;
- complain to us, and then to the Data Protection Board of India.
Write to our Grievance Officer from the phone number or email on your account. We answer within 15 days.
8. Children
Flexsetu is only for people aged 18 or over, and we check age when we verify identity. We do not knowingly collect data about children, and tasks involving children are not allowed.
9. Changes
We will tell you about an important change to this policy in the app or by message before it takes effect.
10. Contact
Questions about your data: write to our Grievance Officer or contact us.