Privacy Policy

1. Who this policy covers

This policy covers visitors, people who contact us or book a meeting, account holders, team members, and people whose information is processed through a Ryzo workspace. It applies to our website, WhatsApp and CRM tools, APIs, creative and AI features, and related implementation and support services.

Ryzo determines how account, enquiry, billing, and service-security information is used. When a business uses Ryzo to manage its customers, conversations, campaigns, or files, that business determines the purpose of processing and Ryzo processes that information to provide its service. The business's own privacy notice also applies. A customer agreement may set additional data-processing terms.

2. Information we collect and why

The information involved depends on the features you use. We receive information from you, authorised workspace members, connected services, and people who communicate with a connected business.

• Enquiries and bookings: name, work email, phone number, company, requirements, selected appointment time, referral page, and contact consent, to respond and arrange meetings.
• Accounts and teams: sign-in identity, email, workspace details, membership, role, preferences, and authentication/session information, to provide access and administer your workspace.
• WhatsApp and CRM: customer names and numbers, message content and attachments, timestamps, delivery/read events, templates, Flow responses, notes, tags, assignments, consent records, and campaign activity, to operate the inbox, workflows, and customer follow-up.
• Connected accounts: business and phone-number identifiers, permissions, access tokens, and integration settings, to connect authorised services, sync data, and send requested communications.
• Creative and AI work: prompts, brand information, product references, uploaded images, documents, audio or video, generated outputs, and job history, to perform requested generation and editing tasks.
• Usage and transactions: feature usage, credits, plan and invoice details, payment references/status, API activity, and operational logs, to administer subscriptions, troubleshoot, prevent abuse, and maintain business records. Payment details supplied directly to a payment provider are governed by that provider's notice.

3. How we use information

We use information to deliver the services you request, respond to support and sales enquiries, manage accounts and bookings, operate integrations, measure usage, investigate failures, protect the service, and meet applicable recordkeeping and legal obligations. We may use service activity to understand and improve reliability and usability.

Where applicable law requires consent, we seek it for the relevant purpose. Other processing may be necessary to deliver an agreed service or satisfy an applicable legal obligation. This notice is not blanket consent to unrelated uses of your information.

4. WhatsApp and connected services

When a business connects WhatsApp Business Platform, Ryzo receives and sends the information needed to provide authorised messaging features through Meta. This can include contact numbers, message and media content, template and Flow information, business identifiers, and message status events. Meta processes information under its own applicable terms and privacy notices.

Businesses using Ryzo are responsible for having permission to upload contacts and communicate with them, respecting opt-outs, and complying with applicable messaging rules. Disconnecting an integration stops future authorised access through that connection but does not automatically erase records already held by Ryzo, the business, or the connected provider.

5. AI and creative features

AI features may send relevant prompts, conversation context, brand knowledge, and selected reference files to the provider used for the requested task. Integrations include OpenAI for text and images, ByteDance/Seedance for video, and ElevenLabs for audio, depending on configuration and availability. The generated output and related job information may be stored in your workspace.

Provider processing, retention, and model-improvement settings depend on the provider and the applicable account or API terms. Do not assume that every provider has identical retention or training rules. Do not upload passwords, unnecessary personal information, confidential health records, or other sensitive data to generation tools. Only submit images, voices, and other material you are authorised to use.

6. Who receives information

Information is available to authorised members of the relevant workspace according to their access. Service providers process information needed for hosting, authentication, storage, messaging, AI generation, payment processing, and support. Our technical integrations include Vercel, Firebase/Google, Supabase, Meta, and the AI providers described above, where the relevant feature is used.

We may disclose information when legally required, to investigate abuse or protect rights and security, or in connection with a business restructuring or transfer subject to applicable safeguards. A link to another website or a third-party integration is governed by that service's own privacy practices.

7. Cookies and browser storage

Ryzo and its authentication services use browser storage and, where applicable, cookies to support sign-in, selected workspaces, and preferences. Technical requests may also include IP address, browser information, and diagnostic details used to deliver and secure the service.

You can clear or restrict cookies and site storage using your browser settings. This may sign you out or prevent features from working. Opening a third-party service from Ryzo may allow that service to use its own cookies or similar technologies.

8. Retention and international processing

We retain information for as long as needed for the purpose for which it was collected, considering the active service relationship, workspace instructions, support needs, security investigations, disputes, and applicable accounting or legal requirements. Different record types may have different retention periods; this policy does not promise an automatic deletion schedule for every feature.

Deleting an active record may not immediately remove copies from backups, legal records, or connected providers. Where a record must be retained, we limit further use to the reason for retaining it. Our providers may process or store information outside your country, including outside India. Location and safeguards depend on the service and relevant arrangements; Ryzo does not promise India-only hosting across all integrations.

9. Your choices and privacy rights

Depending on the law that applies to you, you may request access to information, correction, deletion, withdrawal of consent, or other available privacy rights. You can contact us to raise a concern or grievance. Some requests may be limited by legal obligations, the rights of others, or information needed to provide an active service.

To stop promotional communications from Ryzo, use an available unsubscribe option or contact us with your preference. Essential account, security, transaction, and service messages may still be necessary. For messages from a business using Ryzo, ask that business to stop contacting you. Withdrawal of consent does not undo processing that was lawful before withdrawal.

10. Request access, correction, or deletion

Email support@ryzo.in with the subject "Privacy request" or "Data deletion request". Include your account email or WhatsApp number with country code, the relevant business/workspace if known, and what you want us to access, correct, or delete. Do not send passwords, API keys, or full identity documents in your initial request.

We may ask for proportionate information to verify your identity and authority before acting. If your information belongs to a business-managed workspace, contact that business first; we can help identify or route the request where appropriate. We will explain any information that must be retained and handle your request within the time required by applicable law.

You may also remove Ryzo's access through the connected provider's account settings. Revoking an integration or deleting your Facebook/Meta connection is separate from asking us to delete data already stored in Ryzo.

11. Security and account responsibility

We use technical and organisational measures such as authentication, access controls, tenant-scoped access, and server-side integration handling to protect information. No system or internet transmission is completely secure. Protect your credentials, grant only necessary team permissions, and contact us promptly if you suspect unauthorised access.

12. Children's information

Ryzo is a business service and is not directed at children under 18. Do not create an account if you are under 18. Businesses must have any legally required authorisation before providing information about children. Contact us if you believe a child has supplied personal information without appropriate authorisation so we can investigate and address it.

13. Changes to this policy

We may update this policy when services or privacy practices change. The last-updated date identifies the current version. Where required, we will give additional notice or obtain consent before a material new use of personal information.