Your information. A straight answer.

01

Who is responsible

BYBO is the enterprise AI and website practice of N&G Ventures, based in Bengaluru, India. N&G Ventures is the Data Fiduciary for the personal data described here — the entity that decides why and how it is handled.

For anything in this notice, write to support@bybo.in. That address reaches a person, and questions about your data are answered by a person rather than a form.

02

What we collect, and why

We ask for as little as will let us answer you properly. Nothing on this site asks for a payment card number, a government identifier such as Aadhaar or PAN, or any special category of data, and you should never send those to us through this website.

• When you send an enquiry: your name, work email, and whatever you choose to put in the message. Company, phone, industry, role and website are optional, and the form works without them. If you tick the box that says BYBO may call or WhatsApp you about this enquiry, we use the phone number for that call or message. We use this to understand your request, reply to it, and if you go ahead, to run the resulting engagement.
• When you use the chat widget: whatever you type into it, so that we can answer. The assistant (BYBO AI) is our own software on bybo.in; your messages are processed by our AI model provider, Anthropic, to generate replies. If you book a call, we use the name, email and phone you give to confirm it.
• When you allow measurement: how pages on this site are used, so that we can tell which are useful. This is off unless you turn it on, and the site works identically either way.
• Automatically, as with any website: your browser sends an IP address and user-agent with each request, which our host records in server logs for security and reliability.

03

The basis on which we handle it

For an enquiry, we rely on your consent, given by submitting the form, and afterwards on the legitimate purpose of answering you and managing the relationship you asked to start. A phone call or a WhatsApp message is a separate consent: it happens only if you tick that box. You can withdraw it by writing to support@bybo.in.

For measurement, we rely only on consent, which you give or withhold using the banner on this site. Declining costs you nothing.

Consent given here is meant to be as easy to withdraw as it was to give. Write to support@bybo.in, or use the measurement settings link in the footer, and it is done.

04

What happens to the enquiry form

When you press Send enquiry, the form posts to a BYBO server, which emails the contents to our team inboxes. One of those inboxes is a Google Workspace address, so Google receives the enquiry as our email provider. This is a change from an earlier version of this site, where the form only prepared a draft in your own email or WhatsApp app; that notice no longer describes how the site works, and this paragraph replaces it.

We also send you an acknowledgement, to the address you gave, so that you have a record that it arrived and know when to expect a reply.

If you tick “BYBO may call or WhatsApp me about this enquiry” and you give a phone number, BYBO may call you, or message you on WhatsApp, about that enquiry. The automated step is a phone call. Calls are placed only on Monday to Saturday, between 10:00 and 19:30 India time, and only to numbers on an allowlist we control. A missed call may be tried once more on the next such day. After two misses we stop calling; someone may then follow up on WhatsApp. WhatsApp is not sent automatically by the website. We do not call if you leave the box unticked.

So that we can place that call, avoid calling the same number twice in a day, and keep the outcome, the server stores the enquiry — name, email, phone, what you wrote, and afterwards a short summary of the call — in a private file store on Vercel. It is not a public database and it is not a marketing list.

The email is delivered by Resend, a transactional email provider, acting on our instructions. Your email address is set as the reply-to so that a reply from us reaches you directly. The call, when you have agreed to it, is placed through ElevenLabs, which receives the number and a short brief of your enquiry in order to make the call and returns a transcript summary to us.

A hidden field and a per-address rate limit are used to reject automated submissions. Nothing about that involves tracking you.

05

Who else touches it

We keep this list short on purpose, and it is complete as of the date above.

• Vercel — hosting, server logs, and the private store that holds the enquiry record described above.
• Resend — delivery of the enquiry email described above, and of the short call summary sent to our team when a call finishes.
• ElevenLabs — placing the phone call described above, only when you have ticked the consent box. They receive the number you gave and a short brief of the enquiry.
• Google — as our email provider, one of the team inboxes an enquiry is delivered to; and separately, through Analytics and Tag Manager, website measurement, which happens only if you allow it.
• Meta — advertising measurement, only if you allow it.
• WhatsApp and your email provider — if you choose to contact us that way, that conversation is also handled under their own terms.

Some of these operate outside India. Where that is so, the transfer is made on the terms those providers offer and subject to any restrictions the Central Government places on particular countries under the DPDP Act.

06

Data inside the systems we build

This notice covers this website. It does not cover the systems BYBO builds for a client.

In that work the client is the Data Fiduciary and BYBO acts as a Data Processor on their instructions, under a written agreement that sets out what may be accessed, what is retained, where it is processed and what happens at the end. If your data is in a system we built for someone else, your rights are exercised with them, and they will tell you how.

We do not reuse a client’s documents, figures or process detail to train anything, and we do not carry it into another engagement.

07

How long we keep it

An enquiry that does not become an engagement is kept while it is still reasonably live, and then deleted. An enquiry that does is kept for as long as the engagement runs and afterwards only for as long as tax, accounting or legal obligations require.

Under the DPDP Act, personal data must be erased once the purpose it was given for is served and no law requires it to be kept. If you would like yours erased sooner, ask, and we will do it unless something requires otherwise — in which case we will tell you what.

08

Your rights

Under the DPDP Act, as a Data Principal you may:

• Ask what personal data of yours we hold and what we have done with it.
• Ask us to correct anything inaccurate, complete anything incomplete, or update anything out of date.
• Ask us to erase it, where no law requires us to keep it.
• Withdraw consent you have given, at any time, as easily as you gave it.
• Nominate someone to exercise these rights on your behalf if you die or become incapable of exercising them yourself.
• Raise a grievance with us and have it answered — and if our answer does not satisfy you, take it to the Data Protection Board of India.

Write to support@bybo.in to exercise any of these. We will not charge you, and we will answer within a reasonable period. We may need to confirm who you are first, so that we do not hand your data to somebody else.

09

Keeping it safe

The site is served over HTTPS, access to the enquiry inbox is limited to people who need it, and credentials for the services listed above are held as environment secrets rather than in code.

No one can promise a system is impossible to breach. What we can say is what happens if one occurs: under the DPDP Act we would notify the Data Protection Board and every affected person, and we would tell you what happened, what it affected and what to do, rather than the least we could get away with.

10

Children

This site is meant for people acting for a business and is not directed at children. We do not knowingly collect a child’s personal data. The DPDP Act requires verifiable parental consent before a child’s data is processed and prohibits tracking or behavioural advertising directed at children; if you believe a child has sent us something, write to support@bybo.in and we will delete it.

11

Where the law currently stands

India’s Digital Personal Data Protection Act 2023 is in force, and the Digital Personal Data Protection Rules were notified on 13 November 2025. The obligations arrive in stages: the provisions on Consent Managers take effect on 13 November 2026, and the principal substantive provisions on 13 May 2027.

We are not waiting for those dates to behave as though they had arrived. This notice is written to the standard the Act sets, and we will update it as the remaining provisions commence and as the Data Protection Board issues guidance.

12

Changes to this notice

When this notice changes materially we update the date at the top and, where the change affects how your data is handled, say so plainly rather than quietly revising the text. The paragraph above about the enquiry form is an example of that.