Privacy Policy

2.1 Tenant administrator and employee data

• Identity: name, email address, phone number, profile photo.
• Account: hashed password, MFA secrets, login timestamps, IP address, device/browser metadata.
• Workplace: department, designation, reporting hierarchy, expertise tags.
• Workspace activity: tasks created, meetings attended, projects, deals, performance reviews and end-of-day reports submitted.
• EAMS optional monitoring (only when the Tenant enables it on devices it controls): screenshots, USB-device events, application activity events.

2.2 End-customer data routed through Tenant Workspaces

• Contact: name, email, phone, billing/shipping address, GSTIN, PAN.
• Commercial: orders, line items, invoices, coupons, subscriptions, refunds.
• Communications: chat messages, ticket content, Telegram and WhatsApp messages, transactional SMS via MSG91, email content sent through the Platform.
• Behavioural: support history, opt-in/opt-out preferences for marketing.

2.3 Financial data

Card numbers and full payment-instrument details are never stored by FYNBIT. Payments are tokenised by our gateways (Razorpay and Fynbit Wallet). We retain only gateway order/payment IDs, the amount, currency, status and metadata required for reconciliation, refunds and statutory tax records.

2.4 Credentials Vault

Some Workspaces use the in-product credentials vault to store API keys, integration secrets and similar sensitive material. Vault contents are encrypted at rest and accessible only to Tenant Users you grant access to. FYNBIT staff do not access vault contents except for narrowly scoped support requests with your consent or under legal compulsion.

2.5 Sensitive categories

FYNBIT does not knowingly request or process special-category data under the GDPR (health, biometrics, religion, political views, etc.), nor sensitive personal data of children. Tenants undertake not to upload such data without their own lawful basis and our prior written agreement.

4.1 Under the GDPR (Art. 6)

• Contract — to deliver the Services you have signed up for.
• Legal obligation — for tax, accounting, anti-fraud and law-enforcement requirements.
• Legitimate interests — to secure the Platform, prevent abuse and improve the product (balanced against your rights).
• Consent — for marketing communications and optional features such as cookies that are not strictly necessary; you may withdraw consent at any time.

4.2 Under the DPDP Act, 2023

We process personal data either with your consent (for purposes for which the law requires consent) or for a "legitimate use" under §7 of the DPDP Act (including service performance, employer-employee processing, compliance with law, and prevention of fraud).

4.3 Under the CCPA

We process personal information only for the "business purposes" described above and do not "sell" or "share" (as those terms are defined under the CCPA) personal information for cross-context behavioural advertising.

7.1 GDPR / UK GDPR rights

• Access — obtain confirmation of processing and a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion in defined circumstances.
• Restriction — limit processing in defined circumstances.
• Portability — receive structured, commonly used data and transmit it to another controller.
• Object — to processing based on legitimate interests or for direct marketing.
• Automated decision-making — not be subject to solely automated decisions with legal or similarly significant effects.
• Lodge a complaint — with your supervisory authority.

7.2 DPDP Act rights (Data Principals)

• Right to access information about processing.
• Right to correction and erasure.
• Right of grievance redressal — see our Grievance Redressal page.
• Right to nominate another individual to exercise rights in case of incapacity or death.

7.3 CCPA rights

• Right to know what personal information we collect, use and disclose.
• Right to delete personal information, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — note: we do not sell or share for cross-context advertising.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising any CCPA right.

7.4 How to exercise rights

If you are an End-Customer of a Tenant, please contact that Tenant directly — they control your data and we will support them in fulfilling your request. If you are a Tenant or interacting with FYNBIT directly, email privacy@vizible.in. We will verify your identity and respond within thirty (30) days (or as required by applicable law).