Privacy Policy

1. Information we collect

Naffo Technologies Pvt Ltd operates Naffo. We collect information you provide, such as your name, email, phone number, company details and accounting or business records entered into Naffo. When you sign up, we record your account's acceptance of the Terms, acknowledgement of this notice and data responsibilities, the date and time, signup method, version and a copy of the wording presented. Existing accounts are not treated as having accepted a new version merely by signing in.

2. How we use information

We use information to operate and secure the Service, provide support, improve features, communicate important updates and meet legal obligations. We use agreement records to demonstrate which terms were accepted and to resolve disputes. Acknowledging this notice is not a blanket consent to unrelated processing or consent on behalf of people whose information you upload.

3. Data sharing and optional connections

We do not sell your personal information. We may share data with service providers who help deliver the Service, subject to applicable confidentiality and security obligations, or where required by law.

When you enable an external AI or other connection, data returned by authorised Naffo tools is shared with that client and its provider. This can include personal details inside invoices, employee records, messages, prompts, attachments or tool results. The provider may process, retain or transfer these under its terms and your plan settings. Review its purposes, retention, training, processing locations and access permissions before enabling it. Sharing requires lawful authority for the particular purpose and recipient.

Signup does not itself enable these connections. Revoke unnecessary credentials and permissions in Naffo and with the provider. Revocation does not automatically delete copies already shared; request deletion from the provider where applicable. Naffo remains responsible for obligations that apply to its own processing and its service providers; customer responsibility does not waive these duties.

4. Google user data

If you sign in with Google, we receive only your name, email address and profile picture (the openid, email and profile scopes). We use them to create and sign you in to your account. Signing in does not give Naffo access to Gmail, Google Drive, Google Workspace or Google Photos data.

Gmail sending (optional). A company owner or administrator can connect a Gmail account so that Naffo sends task reminders, payment reminders, customer follow-ups, campaigns and emails your team composes from that account. For this, Naffo asks Google only for permission to send email (the gmail.send scope) and cannot read the mailbox. We store the connection's access tokens encrypted, together with a record of each email Naffo sends.

Gmail inbox features (optional). Only if your company turns on inbox features does Naffo also ask for permission to read the mailbox (gmail.readonly), or to read it, mark emails as read and archive them (gmail.modify). Naffo then syncs recent emails to pause payment reminders when a customer replies, show customer emails and attachments in Naffo, and create follow-up tasks from emails. Synced emails are kept for 30 days. Users of your company can ask Naffo's built-in assistant, or an AI assistant your company has connected to Naffo, to read synced emails; the email is then sent to that assistant's AI provider to answer the request. Naffo's built-in assistant uses Microsoft Azure OpenAI, which does not use this data to train models. You can switch back to send-only or disconnect Gmail at any time in Naffo; Naffo then revokes the extra access with Google.

Naffo's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use raw, aggregated or derived Google user data to develop, improve or train generalized or foundational artificial intelligence or machine learning models, and we do not allow our AI providers to do so. We do not sell Google user data or use it for advertising.

5. Mobile app

This section covers the Naffo Android app (tech.naffo.app). The app uses the same account and business records as naffo.tech, so the rest of this policy applies to it too. Location, camera, microphone and notifications need your permission. You can refuse a permission or revoke it later in Android settings; features that need it then stop working. We do not use data from the app for advertising and we do not sell it.

Location while on duty (field staff). If your company uses Naffo's field-force features and you start a duty in the app, the app records your location from the moment you start the duty until you end it, including when the app is in the background or closed. Before Android asks for background location, the app explains this in its own notice, and an "On duty" notification stays visible for as long as recording runs. If the app or phone restarts during a duty, recording continues until you end the duty. The recorded route is uploaded to Naffo and shared with your company, which uses it for your duty route, its live field map and your travel allowance. The app does not collect location in the background at any other time. Your duty location history is kept with your company's records, with no fixed time limit. It is deleted when your company deletes your login in Naffo or when the company itself is deleted.

Location while you use the app. With the app open, the app may also use your location to tag a record you create with where it was made: a customer visit check-in, a sales order, or proof photos and videos for an SOP or field assignment. The field map shows your position while it is open. These uses need only the "while using the app" permission. The app asks for precise location; if you allow only approximate location, it uses that instead.

Maps. Maps, driving routes and address search in the app are provided by Microsoft Azure Maps. To draw a map or a route or to find an address, the app sends the map area, the route's start and end points (which can be your current position) or the address you searched for directly to Azure Maps.

Camera, photos and videos. The app uses the camera only when you take a photo or video in it, for example proof photos and videos for SOPs and field assignments, scanned receipts, bills and visiting cards, and photos you attach to records or to the AI assistant. When you choose an existing photo or file, the app receives only the items you pick. Photos and videos are uploaded to Naffo and stored with the records they belong to. Scanned documents are read by an AI service provider working on our behalf, which extracts the details for you to review. SOP photos and videos are deleted from storage 90 days after we receive them unless a legal hold applies; the record that the proof was submitted is kept.

Microphone and voice. The app uses the microphone only while the app is open: for the voice assistant, and to record sound with SOP videos. Your speech is sent to Naffo and turned into text by speech service providers working on our behalf, and they also produce spoken replies. The text is then handled like a typed request to the AI assistant. Naffo does not keep voice-assistant recordings. If you turn on the optional "Naffo" wake word on a device, the microphone stays open while the app is in the foreground; the phone detects speech itself and sends only short bursts of speech to check for the wake word, and anything that is not a request to the assistant is discarded.

Files and the AI assistant. Files you attach in the app, such as documents for AI import, bank statements and task attachments, are uploaded to Naffo and stored with your business records. When you use the AI assistant, your messages, attached files and the business records it needs to answer are sent to an AI service provider working on our behalf. Documents you send for AI import are also read by an AI service provider. Conversations are saved so you can return to them, and you can delete a conversation in the app.

Crash logs and diagnostics. Production versions of the app send crash reports to Firebase Crashlytics, a Google service, so that we can find and fix crashes. A report contains technical details such as the stack trace, the app version, the device model, the Android version and an identifier that Crashlytics creates for the app installation. We do not attach your user ID, name, phone number, company or business records to crash reports. Test and development builds do not send crash reports.

Push notifications. After you sign in, the app registers the device for push notifications with Firebase Cloud Messaging (FCM), a Google service. We store the device's push token with your account, together with an app installation ID, the app version, the device model, the Android version, the language and time zone and whether notifications are allowed, so that we can send you notifications about your work. When you log out, the app asks us to remove this registration. You can turn notifications off in Android settings.

Except where stated above, data from the app is kept as described in Data retention. To delete your account, see Deleting your account.

6. Deleting your account

You can delete your Naffo account in the app (Profile or Settings, then Delete my account) or by emailing harsh@naffo.in from the email address on your account with the subject "Delete my account", your username and your company name. Never send your password. naffo.tech/delete-account explains both routes and what happens to your data.

If you are a team member (anyone who does not own the company), your login is switched off at once and you are signed out on every device. Your company's owners and admins finish the deletion, and we remind them every week until they do. The deletion removes your login and the details on it, your sessions, your notifications and the devices registered for your push notifications.

If you own a company, your request goes to Naffo support and your login keeps working so you can export your company's books. Within 30 days we contact you to delete your login and, if you are the company's only owner, to agree what happens to the company. Deleting a company deletes all of its data and cannot be undone. The law may require the business to keep its books for several years, so export them first; Naffo does not keep a copy.

Records you created while working for a company belong to that company and stay with it, for example invoices, orders and payments. The company's activity log keeps your name on the actions you took. Deleted data can remain in our encrypted backups until those backups expire; we never restore a deleted account from them.

7. Data security

We use administrative, technical and organisational safeguards to protect information. No storage or transmission method is completely secure. Keep account credentials and API keys secure, limit access and promptly report suspected unauthorised disclosure to harsh@naffo.in. Each party must meet the security and incident response obligations that apply to it.

8. Data retention

We retain information, including agreement records, only for as long as needed for the relevant purpose and applicable legal requirements, including resolving disputes and enforcing agreements where lawful. Deletion requests are subject to lawful retention requirements. Copies held independently by a connected provider are subject to its policies and applicable law.

9. Your choices and rights

You may request access, correction or deletion of your personal information and raise privacy concerns using the contact below, subject to applicable law. Where processing relies on consent, you may withdraw it; this may affect features that need the information. A signup agreement does not waive these rights. For information uploaded by your employer or another business, contact that business as well so the request can be addressed by the appropriate party.

The Digital Personal Data Protection Act, 2023 and its rules have phased commencement. Rights and obligations apply as the relevant provisions come into force; other applicable privacy laws continue to apply. This notice does not claim certification or guaranteed compliance.

10. Contact us

For privacy requests, withdrawal of consent where applicable, or grievances, email harsh@naffo.in. Include enough information to identify your account and request without sending unnecessary sensitive data. This contact channel does not restrict rights to approach a competent authority under applicable law.