Your information. A straight answer.

01

Who is responsible

BYBO is the enterprise AI and website practice of N&G Ventures, based in Bengaluru, India. N&G Ventures is the Data Fiduciary for the personal data described here — the entity that decides why and how it is handled.

For anything in this notice, write to support@bybo.in. That address reaches a person, and questions about your data are answered by a person rather than a form.

02

What we collect, and why

We ask for as little as will let us answer you properly. Nothing on this site asks for a payment card number, a government identifier such as Aadhaar or PAN, or any special category of data, and you should never send those to us through this website.

• When you send an enquiry: your name, work email, and whatever you choose to put in the message. Company, phone, industry, role and website are optional, and the form works without them. We use this to understand your request, reply to it, and if you go ahead, to run the resulting engagement.
• When you use the chat widget: whatever you type into it, so that we can answer. The widget is our own software, running on proxe.bybo.in.
• When you allow measurement: how pages on this site are used, so that we can tell which are useful. This is off unless you turn it on, and the site works identically either way.
• Automatically, as with any website: your browser sends an IP address and user-agent with each request, which our host records in server logs for security and reliability.

03

The basis on which we handle it

For an enquiry, we rely on your consent, given by submitting the form, and afterwards on the legitimate purpose of answering you and managing the relationship you asked to start.

For measurement, we rely only on consent, which you give or withhold using the banner on this site. Declining costs you nothing.

Consent given here is meant to be as easy to withdraw as it was to give. Write to support@bybo.in, or use the measurement settings link in the footer, and it is done.

04

What happens to the enquiry form

When you press Send enquiry, the form posts to a BYBO server, which emails the contents to our team inboxes and does not store them in a database. One of those inboxes is a Google Workspace address, so Google receives the enquiry as our email provider. This is a change from an earlier version of this site, where the form only prepared a draft in your own email or WhatsApp app; that notice no longer describes how the site works, and this paragraph replaces it.

We also send you an acknowledgement, to the address you gave, so that you have a record that it arrived and know when to expect a reply.

The email is delivered by Resend, a transactional email provider, acting on our instructions. Your email address is set as the reply-to so that a reply from us reaches you directly.

A hidden field and a per-address rate limit are used to reject automated submissions. Nothing about that involves tracking you.

05

Who else touches it

We keep this list short on purpose, and it is complete as of the date above.

• Vercel — hosting and server logs, so that this site is served at all.
• Resend — delivery of the enquiry email described above.
• Google — as our email provider, one of the team inboxes an enquiry is delivered to; and separately, through Analytics and Tag Manager, website measurement, which happens only if you allow it.
• Meta — advertising measurement, only if you allow it.
• WhatsApp and your email provider — if you choose to contact us that way, that conversation is also handled under their own terms.

Some of these operate outside India. Where that is so, the transfer is made on the terms those providers offer and subject to any restrictions the Central Government places on particular countries under the DPDP Act.

06

Data inside the systems we build

This notice covers this website. It does not cover the systems BYBO builds for a client.

In that work the client is the Data Fiduciary and BYBO acts as a Data Processor on their instructions, under a written agreement that sets out what may be accessed, what is retained, where it is processed and what happens at the end. If your data is in a system we built for someone else, your rights are exercised with them, and they will tell you how.

We do not reuse a client’s documents, figures or process detail to train anything, and we do not carry it into another engagement.

07

How long we keep it

An enquiry that does not become an engagement is kept while it is still reasonably live, and then deleted. An enquiry that does is kept for as long as the engagement runs and afterwards only for as long as tax, accounting or legal obligations require.

Under the DPDP Act, personal data must be erased once the purpose it was given for is served and no law requires it to be kept. If you would like yours erased sooner, ask, and we will do it unless something requires otherwise — in which case we will tell you what.

08

Your rights

Under the DPDP Act, as a Data Principal you may:

• Ask what personal data of yours we hold and what we have done with it.
• Ask us to correct anything inaccurate, complete anything incomplete, or update anything out of date.
• Ask us to erase it, where no law requires us to keep it.
• Withdraw consent you have given, at any time, as easily as you gave it.
• Nominate someone to exercise these rights on your behalf if you die or become incapable of exercising them yourself.
• Raise a grievance with us and have it answered — and if our answer does not satisfy you, take it to the Data Protection Board of India.

Write to support@bybo.in to exercise any of these. We will not charge you, and we will answer within a reasonable period. We may need to confirm who you are first, so that we do not hand your data to somebody else.

09

Keeping it safe

The site is served over HTTPS, access to the enquiry inbox is limited to people who need it, and credentials for the services listed above are held as environment secrets rather than in code.

No one can promise a system is impossible to breach. What we can say is what happens if one occurs: under the DPDP Act we would notify the Data Protection Board and every affected person, and we would tell you what happened, what it affected and what to do, rather than the least we could get away with.

10

Children

This site is meant for people acting for a business and is not directed at children. We do not knowingly collect a child’s personal data. The DPDP Act requires verifiable parental consent before a child’s data is processed and prohibits tracking or behavioural advertising directed at children; if you believe a child has sent us something, write to support@bybo.in and we will delete it.

11

Where the law currently stands

India’s Digital Personal Data Protection Act 2023 is in force, and the Digital Personal Data Protection Rules were notified on 13 November 2025. The obligations arrive in stages: the provisions on Consent Managers take effect on 13 November 2026, and the principal substantive provisions on 13 May 2027.

We are not waiting for those dates to behave as though they had arrived. This notice is written to the standard the Act sets, and we will update it as the remaining provisions commence and as the Data Protection Board issues guidance.

12

Changes to this notice

When this notice changes materially we update the date at the top and, where the change affects how your data is handled, say so plainly rather than quietly revising the text. The paragraph above about the enquiry form is an example of that.