Fundle.ai: Agentic AI for Retail Loyalty: Personalisation vs Privacy in India

Balancing Personalisation Needs with Privacy Regulations

The fundamental tension in agentic AI for retail loyalty is architectural, not philosophical. Personalisation engines need breadth and depth of data — purchase history, browsing behaviour, location signals, category affinities, household proxies — to generate recommendations that actually move the needle. But DPDP 2023 mandates that every piece of personal data collected must be tied to a lawful purpose, disclosed clearly to the data principal (the customer), and capable of being withdrawn on demand. These two requirements pull in opposite directions unless you engineer your data stack to hold them in balance from Day 1.

Consider what a CRM Head at a mid-size jewellery brand like Tanishq or a Manyavar franchise network actually needs to personalise effectively. They want to know: Is this customer a self-purchaser or a gifter? Do they respond to occasions-based messaging or product-led storytelling? Are they price-sensitive enough that a ₹500 cashback nudge moves them, or do they need exclusive early-access framing? These are legitimate business questions. But answering them requires transactional data, communication response data, and — increasingly — inferred behavioural signals derived by AI models. Under DPDP 2023, each inference category may require a separate, clearly worded consent notice if it is used to make automated decisions affecting the customer.

The compliance risk compounds when retailers run their loyalty data through third-party analytics vendors, cloud-hosted CDP platforms, or campaign automation tools like MoEngage, WebEngage, or Xeno without ensuring that data processor agreements (DPAs) and sub-processor disclosures are in order. Several mid-market Indian retailers today operate loyalty programmes where customer data flows through four to six different SaaS platforms, none of which are formally audited for DPDP readiness. That is not a hypothetical risk — that is the status quo for a significant portion of the organised retail market outside the top ten enterprise operators.

What good looks like is a consent-first data architecture where the customer's consent record — what they agreed to, when, through which channel, and for which purposes — travels with the data as a metadata layer. Every agentic AI workflow that attempts to access or act on personal data checks the consent record before executing. Personalisation does not stop; it becomes purposeful, permissioned, and provably compliant. Brands like FabIndia and Apollo Pharmacy, which have built strong trust equity with their customer bases, have the most to gain from this model and the most to lose from a high-profile data breach.

How Fundle's ConsentFirst Enables Transparent Consent Collection

Fundle's ConsentFirst platform ensures trust by managing AI personalisation within DPDP 2023 standards. That is not marketing language — it is an engineering commitment. The ConsentFirst CMP (Consent Management Platform) is built as a native layer within the Fundle AI Platform, not an afterthought integration. Every data collection event — whether at a mall kiosk at Select CITYWALK, a Cafe Coffee Day counter loyalty enrolment, or an in-app sign-up for a Lenskart membership — creates a structured consent object that records: the specific purposes consented to, the channel of consent, the timestamp, the version of the notice presented, and the customer's preferred contact permissions.

What makes this genuinely different from a conventional cookie-consent banner or a terms-and-conditions checkbox is the granularity and the downstream enforceability. A Fundle Loyalty programme powered by ConsentFirst allows a customer to say: 'Yes, use my purchase data for personalised offers. No, do not share my data with third-party brand partners inside the mall.' That preference is not just stored — it is actively enforced by Fundle AI Agents at the workflow execution layer. If a Fundle Agentic AI workflow attempts to fire a co-branded offer from a mall tenant partner to a customer who has not consented to third-party sharing, the workflow is halted, the action is logged, and the operator is flagged for review. This is what consent-first architecture means in practice.

For Mall Marketing Directors running Fundle Mall Loyalty programmes across multi-brand tenant environments, ConsentFirst solves a genuinely hard problem: how do you orchestrate personalised communications across 80–120 tenants in a single mall without creating a consent nightmare? The answer is purpose-based consent segmentation. Customers opt into mall-level communications, and separately opt into individual brand-level personalisation. Fundle Brand Loyalty tenant modules inherit the customer's master consent profile but only activate the permissions that apply to their specific context. A customer who loves FabIndia and has consented to personalisation from them will receive hyper-relevant offers; the same customer who has never shopped at the food court will not receive unsolicited F&B promotions just because they walked past the zone.

The business case for this level of consent architecture goes beyond compliance. Retail operators who present clear, simple, value-exchange-based consent notices see enrolment rates 22–35% higher than those who bury consent in dense legal language. When customers understand exactly what they are consenting to and see tangible benefits — early access, personalised rewards, exclusive events — consent becomes a growth lever, not a friction point.

Ethical AI Use in Customer Loyalty

Ethics in AI loyalty is not an abstract concept — it has direct commercial consequences. The Indian consumer is increasingly sophisticated. A customer who receives a communication that feels intrusive, poorly timed, or based on data they do not remember sharing will not just ignore it; a growing proportion will actively disengage from the loyalty programme, file a complaint on consumer forums, or — post DPDP enforcement — exercise their right to erasure. Brands that have built emotional equity, such as Tanishq with its high-trust jewellery purchase journey or FabIndia with its values-led customer base, face asymmetric downside if their AI systems behave in ways that feel extractive rather than helpful.

The core ethical principles for agentic AI in retail loyalty map closely to the DPDP 2023 framework but extend beyond legal compliance. The first is proportionality: the depth of personalisation should match the depth of trust the customer has signalled through their consent and engagement history. A first-time visitor to a mall who has shared only their mobile number for a parking validation benefit should not receive a full behavioural targeting treatment. A Tier-1 loyalty member who actively engages with personalised recommendations and has explicitly opted into AI-driven offers is a different relationship entirely. Fundle AI Agents are designed to respect this gradient.

The second principle is explainability. When a customer asks why they received a particular offer, the answer should not be 'the algorithm decided.' Fundle AI Workflow logging maintains a human-readable audit trail of why each personalisation action was taken, referencing the specific consent basis, the data inputs used, and the business rule applied. This is not just good ethics — it is legally required under DPDP 2023's provisions on automated decision-making.

The third principle is reversibility. Customers must be able to undo their consent decisions without penalty to their loyalty standing. A customer who withdraws consent for AI-powered personalisation should not lose their accumulated points or tier status; they simply move to a less personalised, less targeted communication track. Building this architecture requires deliberate design choices that most legacy loyalty platforms — built in the pre-DPDP era — simply did not anticipate. Operators evaluating tools like Antavo, Customer Capital, or Almonds.ai should explicitly assess whether the platform's core data model supports consent-based personalisation throttling at the individual customer level.

Customer Perceptions and Trust Factors in AI-Driven Loyalty

Indian consumers in 2024 occupy a paradoxical position. They are among the most active users of digital loyalty programmes in Asia — Reliance One, Tata Neu, Shoppers Stop's First Citizen programme, and dozens of regional mall loyalty clubs collectively enrol tens of millions of members. Yet surveys consistently show that fewer than 30% of Indian loyalty members believe brands use their data responsibly. The gap between enrolment and trust is a ticking clock for any operator building AI-powered personalisation on top of data that customers do not feel confident about.

Trust in AI loyalty systems is shaped by four observable factors. First, perceived control: customers who can see and change their preferences are 2.3x more likely to remain active loyalty members at the 18-month mark than those who cannot. Second, value reciprocity: the personalisation must be visibly useful, not just technically sophisticated. A ₹200 discount on a category the customer never buys is worse than no personalisation at all — it signals that the brand is using data carelessly. Third, communication restraint: Indian mobile users receive an average of 47 promotional messages per day across all channels. Brands that use AI to send fewer, more relevant communications are perceived as more respectful and see higher engagement per message. Fourth, incident handling: how a brand responds to a data concern — a mislabelled offer, an unintended communication — shapes long-term trust more than the incident itself.

For mall operators running multi-tenant loyalty environments, trust is especially fragile because the customer's relationship is simultaneously with the mall brand and with 80-plus individual tenant brands. A privacy misstep by one tenant — say, an unsolicited WhatsApp message from a food court vendor using loyalty data — reflects on the entire mall's programme credibility. This is why centralised consent governance at the mall level, rather than leaving it to individual tenants, is the only architecturally sound approach.

The competitive dynamic is also shifting. As larger operators like Tata Neu and Reliance One invest heavily in first-party data infrastructure and transparent AI, mid-market malls and regional brands that continue to rely on opaque data practices will find their loyalty programme value propositions increasingly undermined. The trust premium is becoming a real competitive differentiator — not just a compliance obligation.

How Fundle solves this

Vineet Narang's founding thesis for Fundle was straightforward: the Indian retail market would eventually face a reckoning between the personalisation arms race and the consumer's right to data dignity. DPDP 2023 has made that reckoning official. The Fundle AI Platform was architected from the ground up to operate in this post-consent world — not retrofitted, not patched, but built consent-first at every layer of the stack.

The Fundle Loyalty platform covers both ends of the organised retail spectrum. Fundle Mall Loyalty gives large mall operators — running 100-plus tenant environments like those at Phoenix Marketcity or DLF Malls — a centralised consent governance framework that allows individual Fundle Brand Loyalty tenant modules to personalise within clearly defined permission boundaries. A tenant brand cannot exceed the consent scope the customer has granted at the mall level. The architecture enforces this automatically; it does not rely on tenant compliance teams to self-police.

At the intelligence layer, Fundle AI Agents handle the autonomous execution of personalisation workflows — occasion-based offer triggers, RFM-driven win-back sequences, cross-category discovery nudges, and real-time basket completion recommendations at the POS. Each Fundle Agentic AI workflow is purpose-tagged at configuration time. When the workflow runs, Fundle AI Workflow execution engine cross-checks the target customer's active consent record via ConsentFirst before processing any personal data. If the consent basis is absent or expired, the customer is routed to a lightweight consent refresh journey — a single-screen mobile prompt that explains the value exchange in plain language — rather than being silently excluded or, worse, processed without consent.

The commercial outcomes from this architecture are measurable. Retailers operating on the Fundle AI Platform report consented first-party profiles that show 2.8–3.5x higher offer acceptance rates compared to their pre-Fundle baseline, primarily because the AI is working with clean, intentional data rather than inferred or stale signals. Mall operators using Fundle Mall Loyalty see consent opt-in rates of 58–72% at enrolment — well above the 30–40% industry average — because ConsentFirst's transparent value-exchange framing makes consent feel like a benefit, not a barrier.

For CRM Heads and Mall Marketing Directors evaluating platforms in 2024–25, the question is no longer whether to adopt agentic AI for retail loyalty. The question is whether the platform you choose treats DPDP compliance as a constraint to work around or as the foundation on which genuine, durable customer trust is built. Fundle's answer is unambiguous.