Privacy Notice

1.Definition:

1. i.
   “Personal Data” means any data/information that relates to an identified or identifiable natural person.
2. ii.
   “Visitor”, “you”, “your” shall mean a natural person who uses or accesses the Website.
3. iii.
   “Customer” shall mean an entity which subscribes to the Platform.
4. iv.
   “User” shall mean an individual who avails the Platform on behalf of the Customer.

2.Personal Data Collected:

We may receive your Personal Data in the following ways:

1. i.
   Talk to us: When you want to start a conversation with us via “Talk to us” section, we may collect your email-ID or any other Personal Data that you provide.
2. ii.
   Contact Us: When you contact us through the email provided in “Contact Us” section, we may receive Personal Data such as your name, email address, phone number and any other Personal Data that you provide.
3. iii.
   Online Identifiers: We may receive Personal Data about your IP address, system, device, browser type, usage duration, system logs etc.
4. iv.
   Careers Page/Candidates: When you apply for job opportunities at Lastbyte, we may receive Personal Data such as your full name, e-mail address, phone number, gender, CV/ Resume, date of birth, current location, educational qualification details, previous work experience and any other Personal Data you provide us.

3.Personal Data That We Process on Behalf of the Customer:

This section concerns the Personal Data of the Users collected by the Customer, and such collection may be facilitated by us. If you are the User of the Platform and your Personal Data was shared with us by the Customer, the Customer has complete control over the Personal Data of the User, and the Company processes Personal Data on the Customer’s behalf. In such an event, the privacy notice of the Customer, on whose behalf we collect and process the Personal Data, will apply. This means that any enquiry, request, objection or complaint that you as a User may have in connection with the collection and/or processing of Personal Data that forms part of your Platform usage should be addressed to and resolved by the Customer.

4.Google User Data:

This section applies when a User connects a Google account to the Platform, for example to link a Gmail mailbox, Google Drive, Google Calendar or Google Meet. It applies to the Platform in addition to section 3.

1. i.
   Data we access: With Gmail, we read messages in the connected mailbox (sender, recipients, subject, body and attachments) and the account’s Gmail signature. We send an email, or save one as a draft in that mailbox, only when a User sends or approves it from the Platform. We never delete email. With Google Drive, we see the names of folders shared with the connected account, and we read a file only when a User of the workspace chooses it or a workspace admin confirms the folder it is in. This can be any file the connected account can open. We create a file or folder in Drive, such as a meeting summary saved as a Google Doc, only in a place the User chose, and we never change or delete files we did not create. With Google Calendar, we read the events on the connected account’s primary calendar to find free time and upcoming meetings, and we create or change an event only when a User asks for it or approves it. With Google Meet, we read the details and transcripts of meetings the connected account organised, to write their summaries and action items. We also receive the connected account’s name and email address.
2. ii.
   How we use it: We use Google user data only to provide and improve the features of the Platform that the User uses, such as showing customer emails as support queries, sending the User’s replies, reading bank statements and invoices for bookkeeping, scheduling meetings and writing meeting summaries.
3. iii.
   AI processing: To provide these features, content may be processed by AI models, for example to extract figures from a statement or to draft a reply for the User to review. We use model providers that do not retain this content or use it to train their models. We do not use Google user data to develop, improve or train generalised AI or machine-learning models.
4. iv.
   Sharing: We do not sell Google user data or use it for advertising. We share it only with service providers that host and operate the Platform for us, such as cloud hosting and AI model providers, under confidentiality obligations; where required by law; or as part of a merger, acquisition or sale of our assets, and then only after obtaining the User’s explicit prior consent.
5. v.
   Human access: Our staff do not read Google user data unless the User first agrees to let us view specific messages or files (for example, to help with a support request), it is necessary to investigate a security issue or abuse, it is required to comply with the law, or it has been aggregated and anonymised for our internal operations.
6. vi.
   Security: Google access tokens are encrypted before they are stored, and data is encrypted in transit.
7. vii.
   Retention and deletion: We keep Google user data while it is needed to provide the Platform. A User can disconnect Gmail, Google Drive, Google Calendar or Google Meet at any time in the Platform’s settings, or remove our access from their Google Account at myaccount.google.com/permissions; either stops any further access. To have Google user data deleted, contact us at [email protected].
8. viii.
   Limited Use: Worcflow.AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.Zoom User Data:

This section applies when a User connects a Zoom account to the Platform, either by signing in with Zoom or by entering their company’s own Zoom Server-to-Server app credentials. It applies to the Platform in addition to section 3.

1. i.
   Data we access: We receive the connected Zoom user’s ID, name and email address. We read their scheduled meetings (topic, time, duration, agenda, join link, passcode and dial-in details). For past meetings, we read who attended and Zoom’s meeting summary. We read the transcript files of cloud recordings. We create, change or cancel a meeting only after a User approves that specific action in the Platform. We never store or show a meeting host’s start link.
2. ii.
   How we use it: We use Zoom user data only to provide the features of the Platform that the User uses, such as the Chief of Staff (an AI employee) answering the User’s questions about their meetings, scheduling, moving or cancelling a meeting after the User approves it, and tracking the commitments made in meetings.
3. iii.
   AI processing: To provide these features, transcripts and meeting details may be processed by AI models, for example to extract commitments or to answer the User. We use model providers on zero-data-retention terms that do not use this content to train their models. We do not use Zoom user data to develop, improve or train generalised AI or machine-learning models.
4. iv.
   Sharing: We do not sell Zoom user data or use it for advertising. We share it only with service providers that host and operate the Platform for us, such as cloud hosting and AI model providers, under confidentiality obligations; where required by law; or as part of a merger, acquisition or sale of our assets, and then only after obtaining the User’s explicit prior consent.
5. v.
   Human access: Our staff do not read Zoom user data unless the User first agrees to let us view specific meetings or transcripts (for example, to help with a support request), it is necessary to investigate a security issue or abuse, it is required to comply with the law, or it has been aggregated and anonymised for our internal operations.
6. vi.
   Security: Zoom access tokens, refresh tokens and any client secret a company provides are encrypted with AES-256-GCM before they are stored, and data is encrypted in transit.
7. vii.
   Retention and deletion: A User can disconnect Zoom at any time in the Platform’s settings, or remove the worcflow.ai app from their Zoom account (Zoom App Marketplace → Manage → Added Apps → Remove). Either one deletes the Zoom tokens we hold and stops any further access. Meetings already imported remain in the workspace. To have Zoom user data deleted, contact us at [email protected].

6.Accuracy of Data:

You are solely responsible for the accuracy, correctness, or truthfulness of the Personal Data shared with us whether of your own or any third party. In the event you are sharing any Personal Data on behalf of a third party, you represent and warrants that you have the necessary authority to share such Personal Data with us. You understand and acknowledge that such Personal Data shall be subject to the terms and conditions of this Privacy Notice.

7.How We Use Personal Data:

We use Personal Data for the following purposes:

1. i.
   to provide and inform you about our services.
2. ii.
   To communicate with you.
3. iii.
   to respond to your requests, queries or communication, including those submitted via the “Talk to Us” and “Contact Us” section.
4. iv.
   to provide you with better experience when you access our Website and to improve the Website.
5. v.
   to maintain and manage our Website.
6. vi.
   to contact you for marketing purposes.
7. vii.
   to provide support for operations, provision of the Website including the provision, maintenance and improvement of the Website and digital infrastructure associated with our work.
8. viii.
   to manage our relationship with you.
9. ix.
   for internal record keeping and documentation, including for reporting, audit and compliance purposes.
10. x.
    to process job applications (if you apply for a position with Lastbyte).
11. xi.
    to comply with our legal or statutory obligations under the applicable law and regulations.

8.How We Disclose Personal Data:

We may disclose Personal Data in the following circumstances:

1. i.
   Service Providers: We may share your Personal Data with the service providers who work with us in connection with operating the Website and/ or providing the services. All such service providers are subject to stringent confidentiality restrictions consistent with this Privacy Notice.
2. ii.
   Affiliates: We may disclose Personal Data to our subsidiaries and affiliated entities for purposes consistent with this Privacy Notice.
3. iii.
   Business Transfers: If we are involved in a merger, acquisition, financing, due diligence, reorganization, bankruptcy, or sale of company assets, Personal Data may be disclosed or transferred as part of that transaction. Any successor entity will continue to use Personal Data in a manner consistent with this Privacy Notice or as otherwise permitted by law.
4. iv.
   Legal and Regulatory Compliance: We may disclose Personal Data to courts, regulators, law enforcement authorities, or other third parties where required to comply with applicable law, legal process, or governmental request, or to protect our rights, property, or safety, or that of others.

9.Cookies and Tracking Technologies:

We use cookies, analytics tools, and similar technologies to operate and improve our Website, analyse Website usage, and maintain system security.

These technologies help us:

1. i.
   Understand how visitors use our Website.
2. ii.
   Improve functionality and performance.
3. iii.
   Maintain system integrity.

We do not use cookies or tracking technologies for cross-context behavioural advertising.

You may control cookies through your browser settings. Please note that disabling certain cookies may affect Website functionality.

10.Data Retention:

We will retain your Personal Data for as long as it is required to be retained for the purpose for which it was collected. We may also retain and use your Personal Data as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

11.Security:

We implement reasonable and appropriate technical, administrative, and organizational safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. Although we provide appropriate firewalls and protections, we cannot warrant the security of any Personal Data transmitted as our systems are not hack proof. Data pilferage due to unauthorized hacking, virus attacks, technical issues are possible and we will take measures to mitigate such incidents.

12.Additional Information for Residents of India:

This section applies to Visitors located in India and supplements the information provided elsewhere in this Privacy Notice. It is intended to comply with the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 (collectively “DPDPA”).

You have the following rights that can be exercised:

1. i.
   Right to access information about Personal Data.
2. ii.
   Right to correction and erasure of Personal Data.
3. iii.
   Right of grievance redressal.
4. iv.
   Right to nominate

For ease of the reader, we have provided an itemized description of the Personal Data received and the purposes for which it may be processed.

Depending on the nature of the request, we may ask you to complete a Personal Data request form or seek certain details to verify the request.

If you would like to exercise ANY of these rights, please contact us at [email protected]. After exercising your rights with us, if your grievance remains unresolved, you may approach the Data Protection Board of India, as prescribed under DPDPA.

13.Additional Information for Residents of European Union and United Kingdom:

This section applies to Visitors located in the European Union (“EU”) and United Kingdom (“UK”). It supplements the information provided elsewhere in this Privacy Notice and is intended to comply with the EU General Data Protection Regulation (the “GDPR”) and the UK GDPR, the United Kingdom Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and any regulation superseding any of the foregoing (“UK Privacy Laws”).

Legal Basis of Processing (for EU residents and UK residents): We will not process your Personal Data without a lawful basis to do so. We will process your Personal Data only on the legal basis of consent, contract, or on the basis of our legitimate interests or for compliance with legal obligations, provided that such interests are not overridden by your privacy rights and interests.

Transfer of your Personal Data across borders (for EU Residents): Personal Data may be transferred to and processed in countries outside the EU or UK. Where such transfers occur, we implement appropriate safeguards in accordance with applicable data protection laws. You may contact us for more information about the safeguards we apply to international transfers.

Your Rights (For EU and UK Residents):

You have the right to request us:

1. i.
   To access information about your Personal Data,
2. ii.
   To withdraw your consent, where we rely on consent to process your Personal Data,
3. iii.
   To have us rectify or modify any such Personal Data,
4. iv.
   To have us erase/delete your Personal Data,
5. v.
   To restrict us from processing such Personal Data,
6. vi.
   To object to our use of your Personal Data,
7. vii.
   To data portability,
8. viii.
   To not be subject to automated decision making, including profiling,
9. ix.
   To lodge a complaint with a data protection authority.

To exercise your rights, please contact us at [email protected]. We may request information to verify your identity before responding to your request.

If you are located in the UK, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). If you are located in the EU, you may lodge a complaint with your local supervisory authority. We encourage you to contact us first so that we may address your concerns.

Governing Laws: For any EU and UK residents, this Privacy Notice shall be governed respectively by the provisions of the GDPR and UK Privacy Laws.

14.Additional Information for Resident of California:

In addition to disclosures made elsewhere in this Privacy Notice, certain states in the United States of America require us to disclose information related to our privacy practices. This section of our Privacy Notice (“California Privacy Notice”) serves to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, “CCPA”), and any capitalized terms defined in the CCPA have the same meaning when used in this Section.

The CCPA provides consumers with specific rights regarding their Personal Information. This section describes those state-specific rights and explains how to exercise those rights. The section will not apply if we do not collect Personal Information about you or if the Personal Information that we collect, is exempted from the CCPA.

For the purpose of this section, “Personal Information” shall mean information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

California-Specific Disclosures

We may disclose Personal Information to service providers and affiliates for business purposes as described in this Privacy Notice.

We do not sell Personal Information. We do not share Personal Information for cross-context behavioral advertising purposes. We do not use or disclose Sensitive Personal Information for purposes other than those permitted by the CCPA.

Your California Privacy Rights:

The California rights set forth below apply to California residents.

1. i.
   Request to know the categories and specific pieces of Personal Information we have collected about them;
2. ii.
   Request deletion of Personal Information collected from them;
3. iii.
   Request correction of inaccurate Personal Information;
4. iv.
   Request information about categories of Personal Information disclosed for business purposes.
5. v.
   Request to limit our use of sensitive Personal Information (if any) unless our use of sensitive Personal Information falls into one of limited business purposes;
6. vi.
   Request to Opt-Out of sale or sharing of Personal Information processing for targeted advertising, personal data sales, or advertising, personal data sales or advertising for cross context behavioral advertising purposes.
7. vii.
   The right to non-discrimination for exercising your rights under CCPA.

To exercise your rights, please contact us at [email protected]. We may request information to verify your identity before responding to your request.

15.Children’s Privacy:

Our Website is not directed to children under the age of 18. We do not knowingly collect Personal Data from children under 18 without appropriate parental or guardian consent, as required by applicable law.

16.Communication Preferences:

Where required by applicable law, we will obtain your consent before sending you marketing or promotional communications.

You may withdraw your consent or unsubscribe from marketing communications at any time by following the instructions included in such communications or by contacting us at [email protected].

Please note that you may continue to receive non-promotional communications related to your interactions with us, such as service-related notices.

17.Changes to This Privacy Notice:

We may update this Privacy Notice from time to time. When we do, we will revise the “Last Updated” date at the top of this page. We encourage you to review this Privacy Notice periodically.

18.Contact Us:

If you have questions about this Privacy Notice or our privacy practices, you may contact our grievance officer at:

Name: Mr. Harsh Shah
Email ID: [email protected]
Address: Office 603, PNO 576/4,5,9, Bhamburda, Shivaji Nagar, Deccan Gymkhana, Pune, Pune City, Maharashtra, India, 411004.