Privacy Policy

We handle account, billing, website, security, and relationship information to operate our business. For those activities, we determine the purposes of processing, subject to applicable law.

When a business customer submits or connects information about its employees, suppliers, customers, or other contacts, we generally process that information on the customer's instructions as a processor or service provider. Our Data Processing Addendum governs that processing. The customer's own privacy notices explain its purposes and practices. An organization that manages your Fynbase account may access and administer information associated with that account.

This policy does not govern third-party services or their independent use of information, or our employment and recruitment activities. Business information that identifies an individual is personal information even when used in a commercial setting.

The information collected depends on the features used, customer instructions, and permissions granted. We collect information directly from you; from your organization and its authorized users; from connected services you or your organization authorize; and automatically when you interact with the Services.

Account and business contacts: name, work email, phone number, business address, company, job role, account identifiers, permissions, and authentication information, used for account administration, access, and communications.

Financial and operational records: invoices, bills, purchase requests and orders, accounting entries, transaction amounts, payment status, business contact details, and supporting records, used to provide the workflows requested by customers. Documents and integrations may contain account identifiers, tax identifiers, or other sensitive information supplied by customers.

Communications and support: messages, emails and attachments connected or submitted to the Services, support requests, and feedback, used to deliver requested communication workflows, provide assistance, and resolve issues.

Integration information: access tokens, granted permissions, external account identifiers, and records retrieved from authorized accounting, email, storage, or other services, used to provide and maintain the selected connection.

Subscription and billing information: billing contacts and addresses, plan, payment status, invoices, and payment references, used to administer subscriptions and business records. Information provided directly to a third-party payment provider is also subject to its privacy notice.

Device and service activity: IP address, browser and device characteristics, approximate location inferred from IP address, access times, pages or features used, event logs, and error information, used for security, troubleshooting, service operation, and permitted analytics.

AI inputs and outputs: prompts, relevant document content, extracted fields, summaries, recommendations, and workflow results, used to perform the AI functions requested by customers.

We do not ask customers to upload health records, biometric identifiers, children's information, or other highly sensitive information unrelated to supported business workflows. Please limit submissions to what the requested service requires and do not include passwords, full payment-card details, or authentication secrets in documents or support messages.

We use information to provide accounts and requested workflows; manage permissions and integrations; process subscriptions; respond to support and accessibility requests; send service and security notices; detect misuse and investigate incidents; maintain and troubleshoot the Services; comply with legal duties; and establish or defend legal claims.

We may use account contact details to communicate about Fynbase products and events, subject to applicable consent requirements and your marketing choices. We do not use customer invoice, email, or other confidential business content for unrelated advertising. Service improvement and analytics remain subject to our customer contracts, the DPA, and the AI commitment below; these purposes do not create an unrestricted right to reuse customer content.

Where applicable law requires a legal basis, we rely on performance of a contract with you; legitimate interests in operating, securing, and supporting our business where not outweighed by your rights; compliance with legal obligations; or consent where required. For processing performed on a customer's behalf, the customer determines and documents the applicable legal basis.

AI features may send the information needed for a requested task to AI providers acting on our behalf, including document excerpts, prompts, business records, and related context. Processing to generate an answer or perform a task is distinct from training a generalized model.

Fynbase will not use customer confidential information or business, financial, or operational data to train generalized AI models for use by unrelated customers or third parties without the customer's express consent. We require AI providers processing that data on our behalf to observe the same restriction.

Enabling an AI feature, accepting the Terms, or allowing operational analytics does not by itself provide that training consent. Any training consent must separately identify the data and intended use. Aggregation or de-identification will not be used to circumvent this commitment. We may use properly aggregated or de-identified information for permitted service analytics and improvement, maintain safeguards against re-identification, and not attempt to re-identify it except to test the effectiveness of de-identification as permitted by law.

We disclose information to authorized people in your organization and to recipients selected through customer instructions, such as an invoice recipient or connected accounting system. We also disclose information to service providers that support hosting, storage, AI processing, communications, security, troubleshooting, billing, and support, only as needed for their functions and subject to appropriate contracts.

We may disclose information to professional advisers under confidentiality obligations; when legally required or reasonably necessary to protect rights, safety, or the Services; and in connection with a merger, financing, reorganization, or sale, subject to appropriate protections and applicable law. We may also disclose information at your direction or with your consent. The DPA governs disclosures of personal data processed on a customer's behalf, including subprocessor authorization.

We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising as defined by applicable US state privacy laws. We do not knowingly sell or share personal information about children under 16. We do not use sensitive personal information to infer personal characteristics or for purposes outside those permitted by applicable law without the required consent.

Cookies and similar technologies may support sign-in, sessions, security, preferences, and service performance. Essential technologies are used to deliver requested functionality. Optional analytics or other nonessential technologies will be used only with consent where required and with the choices required by applicable law. We do not deploy cross-context behavioral advertising technologies.

You can manage cookies through your browser and, where offered, the site's privacy controls. Blocking essential cookies may prevent parts of the Services from working. You may contact support@info.fynbase.co about tracking choices. We honor applicable legally recognized opt-out preference signals, including Global Privacy Control, for activities to which they apply. Other browser Do Not Track signals do not have a uniform meaning and do not change our practices. Our no-sale and no-sharing commitments apply whether or not a signal is enabled.

We retain personal information only as long as reasonably necessary for the disclosed purpose, customer instructions, contractual duties, or applicable legal requirements. Relevant factors include the length of the customer relationship, the sensitivity of the information, security needs, legal recordkeeping requirements, and the time needed to resolve a dispute.

Customers have 30 calendar days after expiration or the effective date of cancellation or termination to request or complete an available export of Customer Data. A cancellation request made before the end of a paid term does not start that period early. Contact support@info.fynbase.co if account access has ended or assistance is needed. A timely export request will be preserved while we complete it, subject to lawful security restrictions.

After the export period, customer content is deleted or irreversibly de-identified from active systems within a further 30 days, unless a different period is agreed, a valid deletion instruction requires earlier action, or retention is legally required. Residual backup copies expire through scheduled rotation within 90 days after active-system deletion and are not used for ordinary business processing. Required legal records may be retained separately with restricted access until the obligation ends. Account, subscription, support, and security records may have different retention periods based on their purposes; retaining those records does not justify retaining all customer content.

We commit to reasonable administrative, technical, and organizational safeguards appropriate to the information and risks, as further described in our Security and Trust Page and applicable DPA. No service can guarantee absolute security.

Information may be processed in the United States and other countries identified in the applicable provider disclosures. These countries may have different privacy protections. Where a transfer requires additional legal safeguards, we will put an applicable lawful transfer mechanism in place before the transfer. This policy and consent to ordinary service use are not themselves substitutes for a required transfer mechanism. Contact us for information about relevant safeguards.

Depending on your location and applicable law, you may have rights to access personal information, obtain a portable copy, correct inaccuracies, request deletion, restrict or object to processing, withdraw consent prospectively, opt out of sale, sharing, or targeted advertising, or opt out of certain profiling with legal or similarly significant effects. We do not use personal information for such profiling as part of our own account and website processing. Customers remain responsible for decisions made using their workflows.

To submit a request, email support@info.fynbase.co with the subject Privacy Request and enough information to identify your relationship with Fynbase. Do not send passwords, full account numbers, or identity documents unless we arrange a secure verification method. We will verify requests using information proportionate to their sensitivity. An authorized agent may submit a request with evidence of authority; we may also verify identity or authorization where permitted.

We will respond within applicable legal deadlines and explain any permitted denial, exemption, or extension. You may appeal a denial by replying with Privacy Appeal; we will provide an appeal response and further complaint options as required by applicable law. You may complain to your relevant data-protection authority or state regulator. We will not unlawfully discriminate against you for exercising privacy rights.

If your request concerns information controlled by a business customer, contact that organization. We will forward or direct requests as appropriate and assist the customer under the DPA. You can unsubscribe from marketing emails using their unsubscribe instructions or by contacting us; essential account, billing, and security notices may continue. Withdrawing consent does not affect lawful processing already performed.

Where the CCPA applies, the categories described in Section 2 include identifiers, customer-record information, commercial information, internet or network activity, professional information, and sensitive personal information contained in customer records or authentication information. Our sources, purposes, recipient categories, and retention criteria are described in Sections 2 through 8. We disclose relevant categories to service providers and customer-selected recipients for the stated business purposes; we do not sell or share them for cross-context behavioral advertising.

California rights may include knowing the categories and specific pieces of information collected, sources, purposes, and disclosures; correction; deletion; portability; and applicable rights concerning sensitive information, sale, or sharing. Requests may be submitted as described in Section 9. The service-provider role may require us to act through the business customer. We do not disclose personal information to third parties for their own direct marketing purposes.

Fynbase is designed for business use by adults and is not directed to children under 18. We do not knowingly collect information directly from children under 18. If you believe a child has provided information, contact us so we can investigate and take appropriate steps.

We may update this policy and will identify the effective date. We will provide appropriate notice of material changes and obtain consent where required before materially changing an information use that requires consent.

Fynbase

1601 McCarthy Blvd, Suite R-5, Milpitas, CA 95035, United States

Email: support@info.fynbase.co