Privacy Policy

FillFast is used by Organizations (fuel station businesses) that register for the Service and by Employees of those Organizations, whose accounts are created by the Organization to use the Station Portal.

• Organization account data (business details, billing information, Owner/Admin contact details): FillFast acts as the data controller/fiduciary for this data, determining why and how it is processed in order to provide and bill for the Service.
• Employee personal data entered by an Organization (e.g., employee identity documents, bank details, salary, attendance): the Organization acts as the data controller/fiduciary for this data, and FillFast acts as a data processor/service provider, processing it only to provide the Service and on the Organization's instructions. Employees with questions about how their employer uses their data within the Service should also contact their employer directly.

• Directly from you when you sign up, complete onboarding, or use the Service (e.g., an Organization Owner entering business or employee details).
• Automatically, such as session, device, IP address, and location data generated through use of the Service.
• From third-party sign-in providers (e.g., Google, Microsoft), if you choose to use them, subject to their own privacy policies.

• To create and manage accounts, and to authenticate and secure access to the Service (including OTP verification for signup and password reset).
• To provide core functionality: fuel and inventory management, sales and transaction recording, expense tracking, attendance and shift management, payroll processing, approvals, and reporting.
• To process subscription billing and send invoices and payment-related communications.
• To send transactional notifications (e.g., approval requests, OTPs, shift reminders) and, where permitted, service-related updates.
• To monitor, maintain, and improve the security, reliability, and performance of the Service, including audit logging and fraud/abuse prevention.
• To comply with applicable legal, tax, and regulatory obligations.
• To respond to support requests and communicate with Organization Owners/Admins about their account.

We do not sell personal data to third parties.

We process personal data on one or more of the following bases:

• Consent — for example, consent obtained by an Organization from its employees before entering their personal data, or consent you give for optional features.
• Performance of a contract — to provide the Service you or your Organization has signed up for.
• Legitimate uses / legal obligation — including compliance with tax, labour, and payroll laws (e.g., PF, ESI, income tax withholding), record-keeping requirements, and responding to lawful requests from authorities.

When an employee clocks in or out through the Station Portal, we record the device's approximate GPS coordinates at that moment. This is used only to help the Organization verify that attendance was recorded at the correct station, and is visible to the employee's Organization (e.g., station admins/owners) as part of attendance records. We do not track an employee's location outside of the clock-in/clock-out action, and location data is not collected on Organization Owner/Admin accounts unless they separately clock in as an employee.

We may share personal data with:

• Within an Organization — employee data entered into the Service is visible to authorized users within that Organization (e.g., station admins/owners) according to their role and permissions.
• Service providers / sub-processors — such as cloud hosting, database, email/SMS (OTP) delivery, and payment processing providers, who process data on our behalf and under contractual confidentiality and security obligations, solely to help us operate the Service.
• Legal and safety reasons — where required to comply with applicable law, regulation, legal process, or a valid governmental request, or to protect the rights, property, or safety of FillFast, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy continuing to apply to previously collected data.

We do not share Aadhaar, PAN, or bank account details with any party other than the Organization that submitted them, our payroll/payment-processing sub-processors strictly as needed to run payroll or process payments, and as required by law.

We retain personal data for as long as the related account is active and as needed to provide the Service. After an Organization terminates its subscription or an employee account is deactivated, we retain data for a reasonable period to allow for export and to meet legal, tax, payroll, and accounting record-keeping obligations (which, for financial and payroll records, can extend several years under Indian law), after which it is deleted or anonymized, subject to backups being purged in the ordinary course.

We use technical and organizational measures designed to protect personal data, including encryption of data in transit, access controls and role-based permissions, hashed password storage, and audit logging of key actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify affected Organizations and relevant authorities as required by applicable law.

Subject to applicable law, you may have rights to access, correct, update, or request deletion of your personal data, and to withdraw consent where processing is based on consent. You can:

• Update most account and profile information directly within the Service.
• Contact your Organization Owner/Admin for corrections to employment, payroll, or identity data they have entered, since they control that data.
• Contact us at privacy@fillfast.in for requests relating to Organization account data, or where your Organization is unable to assist.

We may need to verify your identity before acting on a request, and some data may need to be retained where required for legal, tax, or legitimate business record-keeping purposes even after a deletion request.

If your employer has added you to FillFast as a Station Portal user, your employer determines what personal data is entered about you (including identity documents, bank details, salary, and address) and how attendance/location data is used within your workplace. FillFast processes this data only to operate the Service on your employer's behalf. Questions about why specific data is collected, or requests to correct or remove personal data your employer has entered, should generally be directed to your employer in the first instance.

We use essential cookies, local storage, and similar technologies to keep you signed in, maintain session security, and remember basic preferences (such as "Remember me"). These are necessary for the Service to function and are not used for third-party advertising.

The Service is intended for business use by adults (18 years or older) acting as station owners, administrators, or employees. We do not knowingly collect personal data from children. If you believe a child's data has been submitted to the Service, please contact us so we can address it.

We primarily store and process data on cloud infrastructure. Where data is processed or stored outside India, we take steps intended to ensure it continues to receive an appropriate level of protection consistent with this Policy and applicable law.

The Service may reference or link to third-party websites or services (for example, sign-in via Google or Microsoft, or payment processors). We are not responsible for the privacy practices of third parties, and we encourage you to review their respective privacy policies.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be indicated by updating the "Last updated" date above, and, where appropriate, through in-app notice or email to Organization Owners/Admins. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

In accordance with applicable Indian law, including the Information Technology Act, 2000 and rules made thereunder, and the Digital Personal Data Protection Act, 2023, you may direct questions, concerns, or grievances regarding this Policy or your personal data to our Grievance Officer:

For general privacy questions, you can also reach us at privacy@fillfast.in.