flyox
Privacy Policy
Draft — not yet in force. Last edited on the date this file was last changed.
Before this is published as a real policy
The bracketed items below must be filled in by the company operating Flyox, and the whole document
reviewed by a lawyer qualified in Indian data-protection law. Nothing here should be presented to
customers as a finished policy until that happens. This draft describes what the software actually
does today; it does not, on its own, make anything legally compliant.
1. Who this is about
Flyox is financial software for businesses. It reads bank statements that a business uploads and shows
that business its own cash position. The people whose personal data it holds are:
- Users — the founders, finance staff and investors who sign in.
- People named in uploaded statements and invoices — customers, vendors and
employees appear in transaction descriptions and customer names because banks print them there.
Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), the business using Flyox decides
what data to upload and why, and Flyox processes it on that business's instructions. In the Act's
terms, the customer business is the Data Fiduciary for the statement data it uploads, and
[LEGAL ENTITY NAME] acts as its Data Processor. For the account data of its own
users (name, email, password, sign-in records), [LEGAL ENTITY NAME] is the Data Fiduciary.
[COMPLETE: operator details]
Legal entity name, CIN, registered address, and contact email of the company operating Flyox.
2. What is collected, and why
| What | Why it is held | Where it comes from |
|---|
| Name, email address, password (stored only as a hash) | To create an account and sign in | Typed by the user |
| Company name, role, team membership | To decide what each person may see | Typed by the user |
| Bank transaction date, description, amount; account nickname | To calculate cash, burn, runway and the rest of the figures | Statement files the business uploads |
| Customer names, invoice amounts and due dates | To track money owed to the business | Typed by the user |
| Activity log — who categorised, voided, imported, exported, invited | So a business can see who changed its financial records | Generated as people use Flyox |
| Sign-in records — email tried, IP address, browser string, success or failure | To detect and investigate attempts to break into an account, and to rate-limit them | Generated on each sign-in attempt |
| That you accepted this notice and the Terms, when, your confirmation that you are 18 or older, and a fingerprint (SHA-256) of the exact text you were shown | To be able to show that notice was given before an account was created | Recorded when an account is created |
| Requests you make about your data, and their answers | To answer them, and to show that they were answered | Typed by the user |
Flyox does not ask for, and has no field for, bank account numbers, card numbers, PAN, Aadhaar or any
government identifier. If such a number appears inside a statement's narration, it is stored as part
of that text; Flyox does not extract, index or use it.
3. What is not done
- Nothing is sold, rented or shared for advertising.
- There is no advertising, no analytics service, no tracking pixel and no third-party script. Every
script, stylesheet and font is served from Flyox's own address, as the
cookie notice describes, so opening a page sends nothing to any other company.
- No data is sent to any advertising, analytics or profiling service, ever. Flyox makes exactly
two kinds of outbound request, both tied to a specific action rather than to ordinary use:
- Sending you an email — a password reset link or an invitation. Your email
address is given to the mail provider named in the processor list below, because that is how
the message reaches you. No financial data is included.
- Checking a password against known breaches, when an account is created, an
invitation is accepted, or a password is reset. Flyox asks a public corpus of exposed
credentials whether the chosen password appears in it. The password is never sent.
Flyox computes a SHA-1 of it, sends only the first five characters of that hash, receives
roughly eight hundred candidate rows, and looks for the match on its own servers. The service
learns five characters it already shares with about one in a million of its records, and never
learns the password, the full hash, or which row was being asked about. The reply is cached for
ten minutes, keyed on those five characters.
Two consequences worth stating plainly rather than leaving you to discover them: setting a
password can be delayed by up to two and a half seconds by a service Flyox does not run, and if
that service cannot be reached the password is accepted unchecked. Flyox asks;
it cannot promise an answer every time.
Nothing else leaves. Looking at your figures, importing a statement, exporting, and using
“Ask Flyox” make no outbound request at all.
- No large language model or other AI service receives transaction data. The suggestions and the
"Ask Flyox" chat are calculated by fixed rules in the software itself.
- Nothing is fetched from a bank. Data arrives only when someone uploads a file.
4. Who can see a business's data
A user only ever sees the companies they are a member of. What they can see within a company depends
on their role:
| Role | Can see |
|---|
| Founder | Everything, including the team and the activity log |
| CFO | Everything except managing team membership and managing bank accounts |
| Bookkeeper | Transactions, categorisation, exports and the activity log — not the strategic analysis |
| Investor | Nothing by default. An investor sees no figures at all until the founder grants access for that specific company, one permission at a time. A founder may grant the headline position — cash, runway, the trend, upcoming commitments — and transaction detail is never part of that grant |
Staff of [LEGAL ENTITY NAME] with production database access can technically read stored data.
Who those people are, and under what controls, must be stated here before launch.
[COMPLETE: internal access]
Name the roles with production access, the approval process, and whether access is logged.
5. Processors and where data is stored
Flyox runs on infrastructure operated by other companies. Each one that stores or transmits personal
data must be listed here with its role and location, along with the data-processing terms agreed with
it, as the DPDP Act requires of a Data Fiduciary appointing processors.
[COMPLETE: processor list]
Hosting provider and region, database provider and region, email delivery provider, error-monitoring
provider (if any), and backup storage location. State for each whether data leaves India, and confirm
that no listed processor is in a country restricted by the Central Government under section 16 of the
DPDP Act. Decide also whether the breach-check service described in section 3 belongs on this list:
it receives five characters of a hash and no personal data, which is the sixteenth open question in
validation/DPDP-OPEN-QUESTIONS.md, and it can be switched off entirely if the answer is that it does.
6. How long things are kept
| What | Kept for |
|---|
| Financial records (transactions, invoices, obligations) | As long as the business keeps its account. They are the business's own books; Flyox does not delete them on its own. |
| Activity log | As long as the company exists, because it is the record of who changed those books. |
| Sign-in records (including IP addresses) | One year, then deleted automatically. They are kept that long so that someone else getting into an account can be investigated. |
| Invitations that were never accepted | Deleted a year after they expire. |
| Your requests about your data (below) | Kept with your account, as the record that each one was made and answered. |
| Uploaded statement files | Not kept at all. The file is read in memory during the upload and discarded; only the rows read from it are stored. |
| Password reset links | Valid for one hour and single-use; they stop working as soon as the password changes. |
[COMPLETE: closure retention]
Decide and state how long data is kept after a business stops using Flyox, and what happens at the end
of that period. The DPDP Act requires erasure once the purpose is served, unless another law requires
retention (Indian tax and companies law commonly require financial records to be kept for years).
7. Rights, and how to use them
Under the DPDP Act a person may ask for:
- A summary of their data and how it is processed. In Flyox, Team & access → Your personal data downloads a copy of everything held about you as a person: your account, the companies you
belong to, the notice you accepted, your sign-in records and the activity you performed. It asks for
your password first, because it contains the addresses you signed in from. The companies' financial
records belong to each company, and are exported by the company.
- Correction of data that is wrong, or completion of data that is incomplete. You can
correct your name in Team & access → Your personal data. Transactions, invoices and obligations are
corrected directly in the product, and corrections are recorded rather than overwritten silently.
- Erasure, where the data is no longer needed for the purpose it was given for.
- Grievance redressal, and the right to escalate to the Data Protection Board of
India if a grievance is not resolved.
- To nominate another person to exercise these rights in the event of death or
incapacity.
Any of these can be requested in Team & access → Your personal data. Each request is given a reference and
the date by which it will be answered, and you can see its status there. Erasing an account is done by a
person rather than a button, because it means checking who is asking and whether the law requires
anything to be kept. A request from someone who is named in a statement but is not a user is handled by
email, as below.
[COMPLETE: grievance officer and timelines]
Name and contact details of the Grievance Officer, the email address for requests, the response time
committed to, and how a requester's identity is verified before anything is disclosed or deleted.
8. Security
What is actually implemented is described in plain terms on the security page.
In summary: passwords are stored only as salted hashes, sign-ins are rate-limited and recorded, all
traffic is served over HTTPS in production, every request is checked against the signed-in user's real
company membership, and uploaded files are parsed under strict limits and never stored.
No system is immune from attack, and this page does not claim otherwise. If a personal data breach
occurs, the DPDP Act requires the Data Protection Board and affected people to be notified.
[COMPLETE: breach process]
Who decides that an incident is a breach, who notifies the Board and affected people, within what time,
and how affected businesses are contacted.
9. Children
Flyox is business software and is not directed at children. Creating an account asks you to confirm
that you are 18 or older, and an account is not created without that confirmation.
10. Changes
If this policy changes in a way that affects how data is used, users will be told before the change
takes effect, not after.