Privacy Policy

1. Information we collect

Naffo Technologies Pvt Ltd operates Naffo. We collect information you provide, such as your name, email, phone number, company details and accounting or business records entered into Naffo. When you sign up, we record your account's acceptance of the Terms, acknowledgement of this notice and data responsibilities, the date and time, signup method, version and a copy of the wording presented. Existing accounts are not treated as having accepted a new version merely by signing in.

2. How we use information

We use information to operate and secure the Service, provide support, improve features, communicate important updates and meet legal obligations. We use agreement records to demonstrate which terms were accepted and to resolve disputes. Acknowledging this notice is not a blanket consent to unrelated processing or consent on behalf of people whose information you upload.

3. Data sharing and optional connections

We do not sell your personal information. We may share data with service providers who help deliver the Service, subject to applicable confidentiality and security obligations, or where required by law.

When you enable an external AI or other connection, data returned by authorised Naffo tools is shared with that client and its provider. This can include personal details inside invoices, employee records, messages, prompts, attachments or tool results. The provider may process, retain or transfer these under its terms and your plan settings. Review its purposes, retention, training, processing locations and access permissions before enabling it. Sharing requires lawful authority for the particular purpose and recipient.

Signup does not itself enable these connections. Revoke unnecessary credentials and permissions in Naffo and with the provider. Revocation does not automatically delete copies already shared; request deletion from the provider where applicable. Naffo remains responsible for obligations that apply to its own processing and its service providers; customer responsibility does not waive these duties.

4. Google user data

If you sign in with Google, we receive only your name, email address and profile picture (the openid, email and profile scopes). We use them to create and sign you in to your account. We do not request access to Gmail, Google Drive, Google Workspace or Google Photos data.

Naffo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use raw, aggregated or derived Google user data to develop, improve or train generalized or foundational artificial intelligence or machine learning models, and we do not send it to third-party AI providers.

5. Data security

We use administrative, technical and organisational safeguards to protect information. No storage or transmission method is completely secure. Keep account credentials and API keys secure, limit access and promptly report suspected unauthorised disclosure to harsh@naffo.in. Each party must meet the security and incident response obligations that apply to it.

6. Data retention

We retain information, including agreement records, only for as long as needed for the relevant purpose and applicable legal requirements, including resolving disputes and enforcing agreements where lawful. Deletion requests are subject to lawful retention requirements. Copies held independently by a connected provider are subject to its policies and applicable law.

7. Your choices and rights

You may request access, correction or deletion of your personal information and raise privacy concerns using the contact below, subject to applicable law. Where processing relies on consent, you may withdraw it; this may affect features that need the information. A signup agreement does not waive these rights. For information uploaded by your employer or another business, contact that business as well so the request can be addressed by the appropriate party.

The Digital Personal Data Protection Act, 2023 and its rules have phased commencement. Rights and obligations apply as the relevant provisions come into force; other applicable privacy laws continue to apply. This notice does not claim certification or guaranteed compliance.

8. Contact us

For privacy requests, withdrawal of consent where applicable, or grievances, email harsh@naffo.in. Include enough information to identify your account and request without sending unnecessary sensitive data. This contact channel does not restrict rights to approach a competent authority under applicable law.