Privacy Policy
Fyboard is launching as an India-first product suite covering Fyboard, FyTools, and FyServices. This Privacy Policy explains how we collect, use, store, share, and safeguard personal data, including files, records, workflow data, payment references, and AI-assisted processing data.
Connecting Gmail or another mailbox?
Read how FyIntegrations uses connected data, runs email actions, handles AI processing and retains copies after disconnecting.
Read the connected-service privacy disclosures1. Privacy Overview
Our commitment to protecting your personal information
Fyboard is operated by Fybyte Technology Private Limited in India. This Privacy Policy applies to Fyboard, FyTools, FyServices, public website visitors, registered users, customer administrators, invited workspace users, and integrations connected to the Fyboard product suite.
Core Privacy Principles
Data Minimization
We collect only what is needed to run Fyboard, FyTools, FyServices, billing, security, support, and product improvement
- Purpose limitation: Data collected only for specified, legitimate purposes
- Storage limitation: Retained only as long as necessary
- Review of forms, uploads, logs, and AI workflow inputs before expanding collection
Security by Design
Security controls are built around encrypted transport, controlled production access, and India-first infrastructure
- TLS for data in transit and encryption at rest where supported
- Role-based access and least-privilege production access
- Operational reviews for logs, backups, files, and workers
User Control
Customers and users keep control over workspace content, export requests, deletion requests, and privacy choices
- Account and workspace controls where available
- Email-supported export and deletion requests during launch
- Essential cookies by default, consent for non-essential tracking where required
Transparency
Clear, honest communication about our data practices and privacy commitments
- Plain-language privacy policies and notices
- Notice when material processing, vendors, or regions change
- Clear communication about confirmed security incidents when notification is required
Our Privacy Commitments
Never Sell Your Data
We will never sell, rent, or trade your personal information to third parties for monetary gain or any other consideration.
Consent-Based Processing
We process your data when needed to provide the product, comply with law, protect the platform, support customers, or where you consent.
India-First Launch
Our current default production setup is designed around Indian operations and AWS Mumbai hosting, with future regional hosting considered for eligible customers.
Processor Accountability
We maintain a vendor and sub-processor inventory for infrastructure, payments, communications, AI, analytics, monitoring, and support tools.
Privacy by Default
The most privacy-friendly settings are applied by default, with options to customize based on your preferences.
Privacy by the Numbers
Key Points to Remember
- We never sell your personal data to third parties
- You can request export or deletion of personal data through our launch support process
- Current default application hosting is in AWS Mumbai for India-first operations
- GDPR may apply if EU personal data is processed or EU users/customers are targeted
2. Information We Collect
Types of data we gather to provide our services
Account & Profile Information
We collect personal information that you provide when creating an account, joining a workspace, using Fyboard, FyTools, or FyServices, or contacting us by email. This information helps us operate accounts, permissions, billing, security, and support.
Required Information
- • Full name and account display name
- • Email address (primary contact)
- • Password authentication information (passwords are stored as hashes)
- • Account, workspace, and role information
- • Product, tool, service, and plan preferences
Optional Information
- • Profile picture, avatar, or bio
- • Secondary email and security preferences
- • Organization and job title
- • Workspace display preferences
- • Communication preferences
Data Accuracy
You are responsible for keeping your personal information accurate. Incorrect information may affect service delivery and security.
Identity Verification & Security
For business accounts, paid plans, invoicing, fraud prevention, or legal compliance, we may collect additional verification information. We do not require this for every user.
Security
- • 2FA data
- • Recovery and verification signals
- • Login and session identifiers
- • Authentication tokens
Business
- • Company registration
- • Tax identification
- • Business address
- • Authorized representative
Compliance
- • KYC documentation, if legally or commercially required
- • Government ID copies only where required for a transaction or verification workflow
- • Address verification
- • Compliance records
Payment & Billing Information
When you subscribe or buy a module, tool, service, add-on, usage pack, AI credit pack, storage pack, or other entitlement, we collect payment information needed to process transactions through Stripe or Razorpay.
Billing Details
- • Billing name and address
- • Payment method type and gateway
- • Last 4 digits where provided by the gateway
- • Transaction history
Security
- • Stripe or Razorpay customer/order/payment IDs
- • Fraud prevention and risk signals
- • UPI, card, bank, or wallet status returned by the gateway
- • Refund and dispute references
We do not intentionally store full card numbers, CVV, UPI PINs, or netbanking credentials on Fyboard servers. Stripe and Razorpay collect payment credentials under their own security and privacy practices.
3. How We Use Information
Transparent processing for legitimate business purposes
We use personal data only for defined product, security, billing, support, compliance, and improvement purposes. Google data is subject to the narrower purposes and Limited Use restrictions in Section 13, general improvement or marketing purposes do not authorize additional uses of mailbox data. For customer workspace content, Fyboard will often act as a processor on behalf of the customer organization, for account, billing, security, marketing, and website data, Fyboard may act as controller.
Primary Processing Purposes
We process personal information for these launch categories. Retention depends on account status, workspace settings, legal requirements, payment records, backups, and the type of module, tool, service, add-on, or usage pack involved.
Service Delivery
Core Fyboard, FyTools, FyServices, storage, workflow, extraction, AI-assisted, and collaboration functionality.
Security & Fraud
Security monitoring to protect users, workspaces, payments, files, APIs, and the platform from abuse.
Analytics & Improvement
Improving reliability, usability, workflow quality, and performance.
Communication
Keeping users informed about updates, security, and billing.
Legal Compliance
Required to meet tax, accounting, privacy, corporate, payment, and legal obligations.
Business Operations
Supporting customer onboarding, account administration, vendor management, and internal launch operations.
6. Data Security
How we protect your information
Security is foundational for Fyboard because the product may process files, contracts, emails, invoices, workflow records, and AI-assisted outputs.
Multi-Layered Security Architecture
Encryption Standards
Encryption and transport protections for application traffic, databases, files, and secrets.
Infrastructure Security
India-first AWS Mumbai deployment for current launch operations.
Application Controls
Product controls for accounts, workspaces, tools, APIs, and admin access.
7. Data Retention
How long we keep your information
We retain data only as long as needed for product operation, workspace administration, billing, security, legal compliance, backups, disputes, or customer instructions. Section 13 explains connected-mailbox retention and why disconnecting is separate from deleting retained data. Customer instructions do not override Google-data restrictions.
User Account Data
Personal info, account settings, and workspace membership records.
Standard
Account life + deletion/recovery window
Business Data
Workspace content, files, contracts, emails, invoices, forms, Tool Output, and AI Output.
Standard
Customer plan, workspace settings, and legal requirements
Usage Analytics
Platform metrics and performance data.
Standard
Minimized or aggregated where practical
Security & Legal
Audit trails and compliance records.
Standard
As needed for security, accounting, tax, and legal obligations
8. Your Privacy Rights
Understanding and exercising your choices
You may request access, correction, deletion, export, restriction, objection, or complaint review depending on your location, role, customer contract, and applicable law. During launch, requests are handled primarily by email.
Access
View and understand personal data we process about you.
Rectification
Correct inaccurate or incomplete information.
Erasure
Request deletion or anonymization of personal data where legally and technically possible.
Restriction
Limit how we process your personal data.
Portability
Receive data in reasonable portable formats where required and available.
Object
Object to processing based on legitimate interests or direct marketing where applicable.
9. International Transfers
Global data protection and cross-border transfers
Fyboard's current default production setup is India-first: EC2 and RDS in AWS Mumbai. Mumbai hosting does not automatically exempt us from GDPR if EU personal data is processed or if Fyboard later targets EU users or customers.
Our Global Transfer Principles
We are launching with India-focused operations and initially expect India-based internal users. If a customer uploads personal data about EU/EEA individuals, or if Fyboard later offers services to EU/EEA users or customers, storing that data in Mumbai may be treated as a transfer outside the EEA and must be handled with appropriate safeguards.
India Default
Core application and database in AWS Mumbai for launch.
Region Inventory
We track where infrastructure, logs, files, backups, and vendors process data.
Future Regions
EU or US tenant hosting may be added later for eligible customers.
10. Children's Privacy
Fyboard is a business workspace and is not directed to children. Our Terms of Service require individual account holders to be at least 18 years old. Organizations that permit younger end users to access their workspace must ensure that access is authorized, supervised and lawful. This policy does not promise parental dashboards or automatic age-based content filtering.
An authorized organization may include information about dependants or other minors in its workspace records. The organization is responsible for having the authority and any required consent to provide that information. The data-use, access and retention provisions of this policy also apply to those records.
If you believe a child has opened an account or provided personal information without appropriate authority, contact [email protected]. We will investigate and take appropriate steps to restrict the account and address the information, including deletion where required.
11. Policy Updates
How we manage and communicate changes
Privacy is dynamic. We update this policy when Fyboard adds modules, tools, services, payment flows, processors, AI workflows, regions, or legal requirements.
Our Update Philosophy
We are committed to practical, transparent policy updates as Fyboard moves from India/internal launch to broader public and paid B2B use.
Transparency First
Plain-language summaries for material changes.
Advance Notice
Reasonable notice before material changes where practical.
User Choice
Consent or controls for new non-essential processing where required.
Material Changes
Significant modifications affecting user rights, data regions, processors, AI processing, or data sharing.
Administrative
Clarifications, contact info, formatting, or minor operational changes.
Legal Compliance
Changes required by new laws, regulator guidance, payment rules, or court orders.
Security
Updates to improve security, safety, or data protection.
12. Contact us
Questions, concerns, or rights requests
Privacy and data-rights requests are handled by email during launch. We verify requester identity and workspace authority before disclosing, exporting, changing, or deleting data.
Privacy Team
General privacy questions, policy clarifications, and data-region questions.
Office Location
HQ Address
Fybyte Technology Private Limited
House No. 85, Block-A, Sector Sigma-01, Greater Noida
Uttar Pradesh, India 201305
Details
IST (UTC+5:30)
Mon - Fri, 9 AM - 6 PM
13. Connected services & Google data
Specific disclosures for FyIntegrations, connected mailboxes and linked workflows.
What connecting a mailbox allows
FyIntegrations connects a mailbox you authorize to Fyboard. Google handles Google account authentication, we receive account identifiers, your email address and profile information, the permissions you grant, and access and refresh tokens. We store encrypted integration tokens to support authorized background access. Connecting Gmail does not give Fyboard your Google password.
Email data we access and store
For connected email features, we may synchronize and store messages and threads, subjects, message bodies and previews, sender and recipient addresses, timestamps, labels, read and importance status, drafts, attachment metadata, and synchronization history. Attachment content may be downloaded or copied into FyDrive when an enabled workflow needs it. We also store connection status, processing results and operational records needed to support the integration.
Why we request Gmail permissions
Basic identity permissions (openid, userinfo.email and userinfo.profile) identify the account you connect. gmail.modify supports reading mail, drafts, sending and replying, label changes, archiving, and moving messages to or from Trash. gmail.modify also allows us to retrieve your existing verified sending aliases, we do not request separate label-management or Gmail-settings permissions for these features. These permissions do not provide every Gmail administrator feature, gmail.modify does not permit immediate permanent deletion of messages that bypasses Trash. The Google consent screen shows the permissions requested for your connection.
How your connected data is used
We use connected data to provide the mailbox, search and saved SmartViews, drafts and replies, attachments, contract-linked correspondence, and the processing rules, scheduled actions and AI-assisted features you use or configure. Authorized actions can update your provider mailbox or send messages to recipients, including while you are away. Available actions depend on the provider, permissions, account and enabled product features. Synchronization can run in the background and is not guaranteed to be instantaneous.
Workspace access and recipient sharing
A connection may be personal or linked to an organization, module or record according to the access scope selected in Fyboard. Authorized participants may access linked correspondence, saved attachments, generated documents or outputs under the relevant workspace and resource permissions. Sharing a contract or folder can therefore expose copies associated with it. Visibility of a connection does not itself give another person authority to send as its mailbox owner. Sending or forwarding a message delivers its content and attachments to the recipients you or an authorized workflow select.
AI-assisted features and processing providers
When you use or configure an AI-assisted email feature, such as mailbox questions, summaries, extraction or SmartView suggestions, relevant prompts, email text, metadata, attachments or derived context may be processed by FyAI/FyBrain and the model or processing providers used for that feature. This can involve processing outside the primary hosting region. Outputs and conversation history may be stored for the feature. Review the feature disclosure before use and do not assume all AI processing stays on your device or in your tenant. Contact [email protected] for information about the processors used for your configuration.
Restrictions on Google data
We do not sell Google user data, use it for advertising or creditworthiness decisions, or use it to train or improve general-purpose or shared AI models. These restrictions also apply to derived content, including summaries and embeddings. Transfers are limited to providing the permitted, visible features with your consent, security needs, legal obligations, or a business transfer with the required prior consent. Human access is limited to the exceptions allowed by Google's policies, such as your explicit agreement to inspect specific data for support, security investigations or legal requirements. General improvement, analytics or business-transfer provisions elsewhere in this policy do not expand these permitted uses.
Disconnecting, revoking access and deleting copies
Disconnecting in Fyboard disables the connection and marks its active integration tokens revoked in Fyboard. It does not delete your mailbox at Google or Microsoft and is separate from revoking the provider's authorization. You can also remove Fyboard's access in your provider account settings. Previously synchronized data, saved files, linked records, AI outputs and messages already delivered to recipients are not automatically erased by disconnecting. To request deletion of retained integration data, email [email protected] and identify the mailbox and workspace, do not send passwords or tokens. We verify your identity and authority, assess related records, storage, indexes, processors and backups, and confirm what was deleted or explain any required retention. Do not rely on disconnecting as a guaranteed automatic 30-day purge.
Retention and your choices
Connected data is retained for the enabled service, authorized workspace records and applicable retention obligations. You can disconnect a mailbox, revoke provider access, change available sharing or automation settings, and request access, export or deletion. Pausing synchronization alone does not erase existing copies or necessarily cancel separately scheduled sends. A deletion request is reviewed separately from connection removal, our response target is 30 days, subject to applicable law. Backup rotation, legal preservation and other people's rights can affect completion, and retained data remains subject to the restrictions above. We do not offer an unrestricted permanent archive of Google data.