Privacy Policy

This policy explains how Finchbyte ("Finchbyte", "we", "us") handles personal data when you visit https://finchbyte.com, contact us, use our client portal or work with us. It is written to meet the India Digital Personal Data Protection Act 2023 (DPDP Act) and IT Act 2000, the EU and UK General Data Protection Regulation (GDPR), US state privacy laws including the California Consumer Privacy Act as amended by the CPRA, Canada's PIPEDA, Brazil's LGPD, Australia's Privacy Act 1988 and similar laws. If you have questions, contact our contact page.

1. Who is responsible for your data

• Controller / data fiduciary: Finchbyte, available on request. Email: our contact page. Phone: available on request.
• Grievance Officer (India): the Grievance Officer, our contact page, available on request. See Grievance Redressal.
• Data protection officer: not appointed (contact our privacy team instead).
• EU representative: not appointed. UK representative: not appointed.

When we run marketing, SEO, CRM or reporting for a client, the client decides why and how its customers' data is used and we act as its processor (service provider) under our Data Processing Agreement. Questions about that data should go to the client first.

2. Personal data we collect

Information you give us

• Enquiries (contact, callback and free growth audit forms): name, email, phone or WhatsApp number, company, website, service interest, budget range and your message.
• Newsletter: your email address and when you confirmed your subscription.
• Proposals: the name you type when you accept or decline a proposal, and the time.
• Client portal: your name, email, phone, login details (passwords are stored encrypted), two-factor settings, requests and messages you send, and documents we share.
• Privacy requests: the details you give us to exercise your rights.

Information collected automatically

• Only with your consent (analytics cookies): an anonymous visitor ID, pages you view, time on page, scroll depth, buttons, calls, WhatsApp and email links you click, forms you start and submit, your device type, browser, operating system, approximate country, referring website and campaign tags. If you later fill in a form or open a personal link from us, this history is linked to your enquiry.
• Only with your consent (marketing cookies): advertising identifiers set by Google, Meta and LinkedIn to measure our ads.
• Always (necessary): security and server logs, your cookie choice, a one-way hashed form of your IP address to prevent spam and abuse, and a record when you open a personal short link (/go/…) we sent you.

Information from other sources

• Business contact details that you or your colleagues share with us, referrals and publicly available business information (such as your company website or professional profile).
• Reports from advertising and analytics platforms, and, for clients, data from accounts you connect to our platform (for example Google Search Console, Google Analytics or Meta).

We do not ask for sensitive personal data (such as health, religion, biometric, financial account or government ID data). Please do not send it to us.

3. Why we use it and our legal bases

Profiling and automated decisions. We score enquiries (0–100) from the pages you visit and the details you give, so our team can reply to the most urgent requests first. A person always reviews and decides; we make no decisions based solely on automated processing that have legal or similarly significant effects on you. You can object to this scoring at any time.

AI tools. We use AI tools to help draft content and reports and to automate tasks. People at Finchbyte review the results. We do not allow our AI providers to use your personal data to train their models where we can control this, and we do not use AI to make significant decisions about you.

4. Who we share it with

We do not sell your personal data for money. We share it only with:

• Service providers who process it for us under contract: website and database hosting, email delivery, analytics (Google Analytics, Google Tag Manager, Microsoft Clarity), advertising platforms (Google Ads, Meta, LinkedIn) when you allow marketing cookies, messaging (WhatsApp, SMS and email providers) and payment providers.
• Professional advisers such as lawyers, accountants and auditors.
• Authorities when the law requires it, or to protect rights, safety and property.
• A buyer or successor if our business is reorganised or sold, who must keep protecting your data.

Allowing marketing cookies lets advertising platforms receive identifiers and page activity to measure and improve our ads. Some US state laws call this "sharing" or "targeted advertising". You can opt out at any time on Your privacy choices, and we automatically honour the Global Privacy Control (GPC) signal from your browser.

5. International transfers

We are based in India and our providers may process data in other countries, including India, the European Union, the United States and Singapore. When personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful safeguard. We do not transfer data to any country restricted by the Government of India under the DPDP Act.

6. How long we keep it

7. How we protect it

We use encryption in transit (HTTPS), encrypted passwords, two-factor authentication for staff, role-based access so staff only see what they need, private storage for client documents, hashed IP addresses, regular backups and logs of access. Client users can only ever see their own company's data. No system is perfectly secure; if a personal data breach is likely to put you at risk, we will tell you and the relevant authority as the law requires (for example within 72 hours under GDPR, and to the Data Protection Board of India).

8. Your rights

Wherever you live, you can ask us to:

• access your personal data and receive a copy in a portable format;
• correct or complete it;
• delete it (we will keep only what the law requires us to keep);
• restrict or object to its use, including lead scoring and direct marketing;
• withdraw consent at any time (this does not affect processing before the withdrawal);
• opt out of the sale or sharing of personal data, targeted advertising and profiling;
• nominate another person to exercise your rights if you die or become unable to (India);
• appeal our decision on your request (US states) and raise a grievance.

Use the form on Your privacy choices or email our contact page. We will confirm your identity by email, respond within 30 days (we may extend this where the law allows and will tell you why), and never charge you or treat you differently for exercising your rights. An authorised agent may act for you with your written permission.

If you are not satisfied, you can complain to the Data Protection Board of India, your EU/EEA data protection authority, the UK Information Commissioner's Office, the Office of the Privacy Commissioner of Canada, Brazil's ANPD, the Office of the Australian Information Commissioner, or the regulator where you live. We would appreciate the chance to resolve it first.

9. Additional information for California and other US states

In the last 12 months we collected these categories of personal information: identifiers (name, email, phone, IP address, online identifiers), commercial information (services requested or bought), internet and network activity (website activity with consent), approximate geolocation (country), professional information (company, job title) and inferences (lead score). We collect them from you, your device and the sources in section 2, for the purposes in section 3, and disclose them to the service providers in section 4. We have not sold personal information for money. We may have "shared" identifiers and internet activity with advertising platforms for cross-context behavioural advertising when you allowed marketing cookies. We do not use or disclose sensitive personal information to infer characteristics, and we do not knowingly sell or share the personal information of anyone under 16. We offer no financial incentives for personal data. To opt out, use Your privacy choices ("Do Not Sell or Share My Personal Information"); we honour Global Privacy Control signals.

10. Additional information for other regions

• India: we process digital personal data under the DPDP Act 2023 and the DPDP Rules. Our notices are in English; tell us if you need this policy in one of the languages of the Eighth Schedule and we will provide it. You may give, manage and withdraw consent through us or a registered Consent Manager.
• EEA and UK: the legal bases in section 3 apply. Where we rely on legitimate interests, we have balanced them against your rights; ask us for details.
• Canada: we obtain meaningful consent and comply with Canada's Anti-Spam Legislation (CASL) for electronic messages.
• Brazil: you have the rights under Article 18 of the LGPD, including information about the entities we share data with.
• Australia and New Zealand: we handle personal information under the Australian Privacy Principles and the NZ Privacy Act 2020.
• UAE, Saudi Arabia, Singapore, South Africa, Japan and other countries: we apply the same protections and honour the rights your local law gives you.

11. Marketing messages

We send newsletters only after you confirm your subscription by email (double opt-in), and every email includes an unsubscribe link and our postal address. We contact you by phone, SMS or WhatsApp only about a request you made or with your consent, and we respect the do-not-disturb (DND) registry in India and similar rules elsewhere (such as the US TCPA). Reply STOP to any message, or tell us, and we will stop.

12. Children

Our website and services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Cookies

See our Cookie Policy for the full list of cookies and how to change your choice.

14. Changes to this policy

We will update this policy when our practices or the law change. The date at the top shows the latest version. If the changes are significant, we will tell you on the website or by email and, where needed, ask for your consent again.

15. Contact

Finchbyte, available on request. Email our contact page. You can also use Your privacy choices.