Privacy Policy
Oxxbow Ventures Private Limited (operating as “Float”) · Bengaluru, Karnataka, India · Last updated: August 1, 2026
1. Introduction and who we are
This Privacy Policy describes how Oxxbow Ventures Private Limited (“Company”), operating the Platform under the brand name “Float”, processes personal data of users of the Platform. References in this Policy to “Float” “, we” or “us” mean the Company. For personal data processed as described here, Float is the Data Fiduciaryunder the Digital Personal Data Protection Act, 2023 (“DPDP Act”). This Policy is the notice contemplated under Section 5 of the DPDP Act and should be read with the Terms of Service.
2. Personal data we process
- Identity and contact data - name, email address, mobile number, profile details, and, where you provide them for Deal Documents, your address and PAN (and GSTIN, if registered).
- Deal and business data - Deal Records, invoices, contract terms, deliverables, payment status you report, and related communications on the Platform.
- Counterparty contact data - name, organisation, email, and phone number of your deal counterparties that you provide (see Section 4).
- Connected-account data- if you link a social or creator account, the account identifier and audience/engagement metrics made available by that platform's API, per the consent screen shown at connection. If you connect Instagram via Instagram Login, we receive your Instagram-scoped user ID, username, account type, and follower count from Meta, solely to confirm you control the account listed on your Float profile; we do not receive or store your Instagram password, direct messages, or private content.
- Technical data - device information, log data, IP address, and cookies/analytics identifiers used to operate and secure the Platform.
We do not knowingly process personal data of persons under 18; the Platform is not offered to them.
3. Purposes and basis of processing
We process personal data for the following purposes, on the basis of your consent given at sign-up or at the relevant feature, or as a legitimate use permitted under Section 7 of the DPDP Act (including voluntary provision of data for a specified purpose, compliance with law, and responding to legal process):
- creating and operating your account and providing the deal-management service, including generating Deal Documents and tracking deal status;
- sending communications you have authorised, including deal notifications and payment reminders to counterparties (Section 7 of the Terms);
- service, security, fraud-prevention, and troubleshooting operations;
- service-related announcements and, with your consent, marketing communications (opt-out available at any time);
- complying with applicable law, including tax and record-keeping obligations;
- producing aggregated, de-identified analytics that do not identify you.
Float does not use AI or automated systems to make significant decisions about you based on your personal data (for example, decisions affecting eligibility, financing, or access to the Platform) without human involvement. Where any such automated processing is introduced in the future, it will be disclosed to you separately and will be subject to appropriate safeguards under the DPDP Act.
Where your consent is not required under the DPDP Act (for example, for the legitimate uses described in Section 7 of the Act), we will process personal data only for that permitted use and no further.
4. Counterparty data you provide
When you enter a counterparty's details to create a Deal Record or send communications, you are providing personal data of another person. You confirm you are entitled to provide it for these purposes. Where the counterparty is not a Platform user, we process their data only to operate your deal (including sending the communications you authorise), to invite them to view or confirm the deal, and as required by law. Counterparties may exercise the rights in Section 10 in respect of their data, and may opt out of non-essential communications via the link included in messages.
5. Consent and withdrawal
Where processing is based on consent, you may withdraw consent at any time through [account settings / by writing to the contact in Section 12], with effect for the future. Withdrawal does not affect the lawfulness of processing before withdrawal. If you withdraw consent required to provide the service, we may be unable to continue providing the Platform, and consequences will be explained at the point of withdrawal.
7. Cross-border processing
Personal data may be processed or stored on infrastructure located outside India (for example, cloud and communications providers), except in any country restricted by the Central Government under Section 16 of the DPDP Act. Where data is processed outside India we apply the same safeguards described in this Policy. [Counsel to confirm current restricted-country notifications, if any, at publication.]
8. Retention
We retain personal data only as long as necessary for the purposes above: account data for the life of your account; Deal Records and Deal Documents for the life of your account and thereafter as needed for legal, tax, and audit requirements (invoice-related records are retained for the period prescribed under applicable tax law, typically up to 8 years); log and security data for shorter operational periods. When retention is no longer required, data is deleted or irreversibly anonymised. Upon verified account deletion, your personal data will be deleted or anonymised within 30 days, unless retention is required by law.
9. Security safeguards
We implement reasonable security safeguards appropriate to the nature of the data, including encryption in transit and at rest, role-based access controls, logging and monitoring, and vendor security review. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the form and manner prescribed under the DPDP Act and rules.
10. Your rights under the DPDP Act
As a Data Principal you have the right to:
- access - obtain a summary of your personal data being processed and the processing activities;
- correction and erasure - have inaccurate or incomplete data corrected, updated, or erased where no longer necessary and not required to be retained by law;
- grievance redressal - raise a grievance with us using the contact in Section 12 and receive a response within the period prescribed under the DPDP Act and rules;
- nominate - nominate another individual to exercise your rights in the event of death or incapacity.
To exercise any right, write to hello@thefloat.in from your registered email or use in-app controls where available. If you are not satisfied with our response, you may approach the Data Protection Board of India in the manner prescribed. Please also note the corresponding duties of Data Principals under Section 15 of the DPDP Act, including not impersonating others and not furnishing false particulars.
12. Grievance Officer / Data Protection contact
In accordance with the Information Technology Act, 2000 and rules thereunder, and the Consumer Protection (E-Commerce) Rules, 2020 to the extent applicable, the Grievance Officer of Float is:
Khushi Narang, Grievance Officer
Oxxbow Ventures Private Limited
A/102, Ananda Valmark, Hulimavu, BG Road, Bengaluru – 560076, Karnataka
Email: hello@thefloat.in
We will acknowledge complaints within 24 hours and endeavour to resolve them within 15 days of receipt.
13. Children
The Platform is available only to persons aged 18 and above. We do not knowingly process children's personal data; if we learn we have done so, we will delete it.
14. Third-party links and platforms
The Platform may contain links to third-party sites and services governed by their own privacy policies, which we do not control and for which we are not responsible.
15. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified through the Platform or by email before they take effect. The “Last updated” date at the top reflects the current version.
16. Contact
Contact us: hello@thefloat.in