Wyzo1. Who we are and what this policy covers
Wyzo is a BigForge product, operated by [Company name], with its registered office at [Registered office address] (“Wyzo”, “we”, “us”). This policy explains what information Wyzo collects, how we use and share it, and the choices you have.
It covers:
- the Wyzo web app at app.wyzo.one;
- the Wyzo MCP server, which lets AI assistants such as Claude or Cursor work with your Wyzo workspace;
- Wyzo’s APIs and lead-capture endpoints;
- emails and WhatsApp messages that Wyzo sends you.
Wyzo shares its sign-in system and parts of its infrastructure with our other BigForge products. Your Wyzo account uses the same sign-in as those products.
This policy doesn’t cover services you connect to Wyzo, such as Google, Meta, your email provider or an AI assistant. Their own privacy policies apply to what they do with your information.
2. Your organisation’s data and ours
Wyzo is used by organisations, each in its own workspace. Content an organisation and its members put into Wyzo is that organisation’s data. This includes boards and cards, records about leads and contacts, call recordings, messages, HR records and files. The organisation decides what to collect and why. For that data, the organisation is the data fiduciary (or controller), and Wyzo processes it on the organisation’s behalf as its data processor, under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and, where it applies, the EU and UK GDPR.
If your organisation added information about you, such as an employee record or a sales contact, the organisation is responsible for telling you and for having a lawful basis to use it. Send questions and requests about that data to the organisation. We will help it respond.
For your account details, information about how you use Wyzo, and Google user data you connect, Wyzo decides how the information is used and is the data fiduciary (or controller).
3. Information we collect
Account and sign-in
- Your mobile number and the one-time passcode (OTP) you enter. Wyzo signs you in by phone number, not with a password.
- Your name, email address and profile photo.
- Passkeys, if you add one: the passkey’s public key and a device label such as “Windows, Chrome, Bengaluru”. The city is estimated from your IP address.
- Sign-in security data: your IP address, a random device identifier stored in your browser, your browser language, and a bot-check token.
- If someone invites you to a workspace by phone number, we create an account record for that number before you first sign in, and send you a WhatsApp invitation.
Workspace content
This is your organisation’s data (see section 2):
- Projects: boards, cards, comments, tags, attachments, activity history and flow diagrams.
- Sales CRM: leads, contacts and companies (names, phone numbers, email addresses, job titles, locations, notes and custom fields); deals, activities and imported spreadsheets; lead scores Wyzo calculates; and the consent captured with a lead, such as the web page a form was submitted on.
- Lead capture: leads your organisation receives through its web forms or API, Meta Lead Ads and IndiaMART, including the provider’s original submission.
- Calls: when your organisation places calls through its VocalLabs account, the lead’s name, phone number and lead details go to VocalLabs. The recording, transcript, an AI summary and the call outcome come back and are stored with the lead. A call made from your browser streams the caller’s microphone audio to VocalLabs.
- Messages: emails, WhatsApp messages and SMS sent or received through channels your organisation connects, and opens and clicks where the channel tracks them. Wyzo also stores the mailbox passwords and access tokens your organisation enters, so it can send on the organisation’s behalf.
- HR and people records: leave requests, attendance check-in and check-out times, holidays, expenses and receipts, certificates, and documents generated in Wyzo such as offer letters, which can include salary. Also designation, joining date, compensation and notice period.
- Employee verification details, when your organisation asks for them and you submit them: legal name, date of birth, father’s name, personal contact details, PAN, the last four digits of Aadhaar, addresses, education and employment history, emergency contacts, references, UAN, ESIC, PF nominee and documents you upload, along with the time you gave consent.
- Bank and payment details you enter for salary payments: account number, IFSC, account holder name and UPI ID. Admins of the organisations you share them with can view them.
- Files you upload to the Vault or attach anywhere in Wyzo, notes and to-dos (private to you), and addresses you save, with map coordinates.
Information from services you connect
- Google Calendar: see section 4.
- Gmail or other mailboxes your organisation connects to send email.
- Meta (WhatsApp and Lead Ads), IndiaMART and VocalLabs, as described above.
- AI assistants you connect through the Wyzo MCP server: we record which assistant (for example Claude or Cursor) a connection was issued to.
Usage and device information
- The pages and features you use, a “last active” time that updates about every 90 seconds while Wyzo is open, your IP address, your browser and device type, and error reports.
- Microsoft Clarity records how pages are used, including clicks, scrolling and a replay of your session. See section 8.
When you contact us
The messages and any details you send us.
4. Google user data
When you connect your Google Calendar, Wyzo asks Google for access to the data below, and uses it only as this section describes.
What we access
- Your Google account’s email address and name, so we know which account you connected.
- Your calendar events: titles, times, descriptions, locations, attendees, organiser, video-meeting links and your response.
- The list of your calendars, so you can choose which ones appear in Wyzo.
- Your calendar’s time-zone setting, so times are shown correctly.
Wyzo also asks for permission to create and edit events, so that meetings you schedule from Wyzo appear in your Google Calendar. Wyzo creates or changes an event only when you ask it to.
How we use it
To show your calendar and availability inside Wyzo, to keep Wyzo up to date with changes you make in Google Calendar, and to create or update events when you schedule meetings from Wyzo. We use it for nothing else.
What we don’t do
- We don’t sell Google user data.
- We don’t use it for advertising.
- We don’t use it to train AI or machine-learning models, and we don’t send it to Wyzo’s AI features.
- We don’t use it to decide creditworthiness or for lending.
- We don’t transfer it to anyone, except as needed to provide these features, to comply with the law, or as part of a merger, acquisition or sale of assets, after notice to you.
People at Wyzo don’t read your Google user data unless you ask us to, for example for support. The only other reasons are security, such as investigating abuse, or a legal requirement.
Who can see it
In Wyzo, only you see your calendar events. Admins of the workspace your calendar is connected through can see which Google account you connected, whether it is syncing, and sync activity such as counts and errors. They never see your events.
Storage and security
Google gives Wyzo an access token, which we store encrypted (AES-256) and use only on our servers. It never reaches your browser. To show your calendar, we store a copy of your events from 30 days in the past to 180 days ahead.
Deleting it
- Press Disconnect in Wyzo’s Calendar settings at any time. We delete our copy of your calendar and revoke Wyzo’s access at Google.
- You can also remove Wyzo from your Google Account at myaccount.google.com/connections.
- If your Google access stops working, or your connection stays paused, for 30 days, we delete the connection and our copy automatically. Leaving the workspace your calendar is connected through deletes it too.
Limited Use
Wyzo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.
5. How we use information
- To provide Wyzo: sign you in, run your workspace, sync your calendar, place the calls and send the messages your organisation asks for, generate documents, and deliver the notifications you turn on.
- To keep Wyzo secure: verify sign-ins, detect bots and abuse, prevent fraud and enforce our Terms.
- To communicate with you: workspace invitations; notifications about cards and boards you follow, by email and WhatsApp, which you choose per card, list or board; service and security notices; and replies to your requests.
- To support and improve Wyzo: troubleshoot problems and understand how features are used, including with Microsoft Clarity.
- To meet legal obligations: comply with the law, respond to lawful requests, and establish or defend legal claims.
We don’t sell personal information, and we don’t use it for advertising.
If you are in the European Economic Area or the UK, we rely on these legal bases:
- performing our contract with you or your organisation;
- our legitimate interests in securing, supporting and improving Wyzo;
- your consent, for example for employee verification details and optional notifications, which you can withdraw at any time;
- legal obligations.
6. AI features
Some Wyzo features use AI models:
- drafting card descriptions;
- turning a pasted message or screenshot into a ticket;
- team insights;
- flow-diagram suggestions;
- blog and website content generation, and keyword research;
- summaries of calls placed through VocalLabs.
When you use one of these features, Wyzo sends the content it needs to an AI model provider through OpenRouter. For example, that is the text or screenshot you paste or, for team insights, members’ names, card titles, workload and days away. The providers include Anthropic, Google, OpenAI, DeepSeek and others available through OpenRouter. We log AI requests and responses with Langfuse to monitor quality and cost.
We don’t use your content to train our own models. Model providers process it to produce a result, under their own terms. AI output can be wrong, so check it before you rely on it. Google Calendar data is never sent to AI features.
9. How long we keep information
- Your account: while it is active. When you ask us to delete it, we delete or anonymise your information, except what the law requires us to keep.
- Workspace content: for as long as the organisation’s workspace exists, or as the organisation decides. When a member leaves, content they created stays with the workspace.
- Google Calendar: as described in section 4. Records of calendar sync activity are kept for 14 to 30 days.
- Notes in the trash: 30 days.
- Logs and monitoring data: for limited periods, to keep Wyzo running and secure.
- Legal requirements: we may keep information longer where the law requires, for example for tax and accounting, or to resolve disputes and enforce our agreements.
10. How we protect information
- All connections to Wyzo are encrypted in transit (HTTPS/TLS).
- Your sign-in tokens are kept in HttpOnly cookies, out of reach of page scripts.
- Database access is checked row by row, so each person reaches only the data their role and workspace allow.
- Google Calendar access tokens are encrypted (AES-256-GCM). Lead-capture API keys are stored only as one-way hashes, and outgoing webhooks are signed.
- Sign-ins are rate limited.
Files you upload are stored on our content delivery network and can be opened by anyone who has a file’s link. Share file links carefully.
No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.
11. Where your information is processed
Wyzo is operated from India. We and our providers process information in India, the United States and other countries where those providers operate. When information moves across borders, we take the steps applicable law requires to protect it.
12. Your rights and choices
Depending on where you live, you can:
- access the personal information we hold about you;
- correct or update it;
- ask us to delete it;
- withdraw a consent you gave;
- receive a copy in a portable format;
- object to or restrict some uses (in the EEA and UK);
- nominate someone to exercise your rights if you die or can’t act yourself (under the DPDP Act);
- raise a grievance with us (section 15);
- complain to a regulator, such as the Data Protection Board of India or your local data protection authority.
Some of this you can do yourself in Wyzo:
- edit your profile;
- disconnect Google Calendar;
- turn notifications off;
- reply STOP to Wyzo’s WhatsApp messages.
For everything else, including deleting your account, email [privacy email]. We may need to verify your identity first. For data an organisation added about you, contact that organisation. We will help it respond. Using your rights won’t affect how we treat you.
13. Children
Wyzo is a workplace tool and isn’t meant for children. Don’t create an account if you are under 18. If an organisation adds a member under 18, such as an intern, the organisation must obtain any consent the law requires, including the verifiable consent of a parent or guardian under the DPDP Act. If you believe we hold a child’s information without that consent, contact us and we will delete it.
14. Changes to this policy
We may update this policy. When we do, we change the “Last updated” date above. For material changes, we tell you in Wyzo or by email before they take effect.
15. Contact us and grievances
[Company name]
[Registered office address]
General enquiries: [support email]
Privacy requests: [privacy email]
Grievance Officer: [Grievance Officer name], [Grievance Officer email]. We acknowledge and resolve grievances within the time limits set by applicable law, including the DPDP Act and the Information Technology Act, 2000 and its rules.