Privacy notice

Who we are gobazo is operated by CONSENKO STUDIOS PRIVATE LIMITED ("we", "us", "our"), whose registered address is 2nd Floor, B-30, Block B, Sector 4, Noida, Uttar Pradesh 201301. General contact: hello@consenko.com.

This is the notice required by section 5 of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). Section 5 asks for it in clear and plain language, so that is what this is.

The two roles we play, and why the difference matters Most confusion about a business-to-business product starts with the wrong assumption about whose data is whose. There are two kinds of personal data here and they are not treated the same way.

Your own data — we are the Data Fiduciary. When you sign up, sign in, raise a support ticket or receive an email from us, you are dealing with us directly. We decide why and how that data is processed, so we are the Data Fiduciary for it, and this notice governs it.

Your business's data — we are a Data Processor. Everything your business loads into its workspace — its customers, its staff, its suppliers, its sales — belongs to your business. Your business decides why that data is processed; we process it only on your business's instructions, to run the service it has bought. For that data your business is the Data Fiduciary and we are its processor. What we may and may not do with it is set out in the Data processing agreement, not here.

If you are a customer of a business that uses gobazo and you want your data corrected or erased, ask that business. We will help them do it, but we cannot act on their data on our own initiative. The Grievance redressal notice explains how a request reaches the right place.

What we collect about you, and why As a Data Fiduciary we collect:

Account and identity — name, work email, phone number if you give one, workspace name and role. So that you have an account, so users can be told apart, and so your administrator can manage access. Sign-in and security records — sign-in times, IP address, browser and device, failed attempts, session identifiers. To keep the account secure and to investigate misuse. Support and grievance correspondence — what you write to us and what we reply. To answer you, and to keep a record that we did. Billing details — the entity being invoiced, tax registration, invoice history. To charge for the service and to meet tax and accounting obligations. Service message records — delivery status for verification, password reset, billing and security messages. To prove a message was sent and to fix delivery problems. Product usage, only if you agree to it — which screens and features you use, tied to your account, to decide what to build next. Optional. Refusing changes nothing else. We do not sell personal data. We do not use it to target advertising. We do not build profiles of you for anyone else.

Why we are allowed to process it For most of the above we rely on your consent under section 6 of the DPDP Act, taken at signup with a separate tick per purpose and no pre-ticked boxes. Some of it — running the account you asked for, sending the messages the service cannot work without — would also be a legitimate use under section 7. We ask anyway: an explicit recorded yes costs one checkbox and removes an argument later.

Consent that the service genuinely cannot work without is marked as required when we ask. Optional consent is unticked by default and stays that way until you tick it.

Withdrawing consent You can withdraw any optional consent at any time from your account settings, in as few clicks as it took to give. We stop that processing within a reasonable time, and stop any processor of ours from continuing it.

Withdrawal does not undo processing that already happened lawfully, and it does not remove records we are required by law to keep. Some consents cannot be withdrawn while the account exists — the processing that is the account, for instance — so withdrawing those means closing the workspace. We say so plainly rather than offering a switch that does nothing.

Your rights Sections 11 to 14 of the DPDP Act give you the following rights over your own personal data.

A summary of what we hold (section 11) — which of your personal data we process, what we do with it, and the other Data Fiduciaries and processors it has been shared with. Correction, completion, updating and erasure (section 12) — have wrong data fixed, incomplete data completed, and data erased once it is no longer needed for the purpose you gave it for. A grievance route (section 13) — a named person who must respond, before you approach the Data Protection Board. Nomination (section 14) — nominate another individual to exercise these rights for you if you die or become unable to exercise them yourself. To use any of them, write to our Grievance Officer at mohit.dhawan@consenko.com. Say which right you are exercising and give us enough to find your records. We may need to confirm who you are first; that check exists to stop someone else exercising your rights, not to slow you down.

We respond within the period stated in the Grievance redressal notice. If we refuse, we tell you why and what you can do next.

Two limits, stated up front rather than buried: erasure does not reach data we are required by law to keep — tax invoices being the usual example — and it does not reach your business's own data, where your business is the fiduciary and the request must go to them.

What the Act asks of you The DPDP Act places duties on you too: give accurate information, do not impersonate someone else, do not file a grievance you know to be false, and do not suppress material information when asking for erasure of data the law requires us to keep. We mention it because the Act does.

How long we keep data We keep personal data only while it still serves the purpose it was collected for.

Account data — while the workspace is open, plus a defined window after it closes, so the business can change its mind and so final invoices can be settled. Sign-in and security logs — a limited period, for security investigation. Billing and tax records — as long as tax and company law requires, which is longer than everything else here. Support and grievance correspondence — while it may still be needed to deal with a dispute. In concrete terms:

Account data — for as long as the workspace is open, and for 90 days after it closes, after which it is deleted or irreversibly anonymised. Sign-in and security logs — 180 days from the event. Billing and tax records — 8 years, as Indian tax and company law require (including section 128 of the Companies Act, 2013). Support and grievance correspondence — 3 years, matching the ordinary limitation period for a related dispute. When a period ends we delete the data or irreversibly anonymise it, and require our processors to do the same.

Who else sees it We use a small number of service providers to run the product — hosting, email delivery, messaging, error monitoring and payment processing. They act on our instructions, are bound by contract, and may not use your data for their own purposes. We also disclose personal data where the law requires it, and we tell you when we are permitted to.

The service providers we use as at the date of this notice are:

Amazon Web Services (AWS) — cloud hosting, database and file storage, in the Asia Pacific (Mumbai) region in India. Amazon Cognito (AWS) — sign-in and identity management, in the Asia Pacific (Mumbai) region. Amazon SES (AWS) — delivery of transactional email such as verification, password-reset and notification messages. Cloudflare, Inc. — content delivery, DNS and network security in front of the service; it routes and protects traffic through a global edge network. Anthropic — the AI provider behind the assistant, insight and drafting features, which processes the text sent to those features in the United States. Meta Platforms / WhatsApp — delivery of WhatsApp messages, where your business uses that channel. We do not currently use a payment processor, because paid subscriptions are not yet offered. We will update this notice before that changes.

Where data is stored Your personal data is stored in India, in Amazon Web Services' Asia Pacific (Mumbai) region.

Two service providers process limited data outside India: our AI provider (Anthropic) processes the text sent to AI features in the United States, and Cloudflare routes and protects network traffic through a global edge network. Section 16 of the DPDP Act permits transfer of personal data outside India except to a country the Central Government restricts, and no such restriction applies to these transfers as at the date of this notice.

Security, and what happens if it fails We take reasonable security safeguards to prevent a personal data breach, as section 8(5) requires: encryption in transit, access limited to the people who need it, administrative access that is logged, and backups.

No safeguard is perfect. If a personal data breach affects your data, we notify the Data Protection Board of India and the affected people in the form and time the law requires, and we tell you what happened, what we have done, and what you should do.

Children The service is sold to businesses and is not intended for anyone under 18. We do not knowingly open accounts for children, and we do not track, behaviourally monitor or advertise to children, which section 9 of the DPDP Act forbids. If you believe a child holds an account, tell us and we will close it.

Google user data (Gmail and Google Calendar) gobazo lets each person connect their own Google account, and lets a workspace administrator connect a shared support mailbox. Connecting is always optional, is done by the person who owns the account, and asks only for the access the features they switch on need. This section explains exactly what we access, why, what we keep and how to stop it.

What we access, and why

Read your Gmail (gmail.readonly). To show your emails inside gobazo (your inbox, search and the message reader), to turn emails arriving in a connected support mailbox into tickets and tasks for your team, and to write an optional morning summary of your unread email that only you see. Send email as you (gmail.send). Only to send an email you wrote, or a draft you reviewed and approved, when you press Send. gobazo never sends email on its own, and never deletes or changes the mail in your mailbox. Read your calendar (calendar.readonly). To show your Google Calendar events in your gobazo agenda next to your tasks, and to find free time when you ask. Manage your calendar events (calendar.events). Only to create, change or delete an event when you ask for it, for example scheduling a meeting from a task. You see and confirm the event before it is saved. Files gobazo creates in your Drive (drive.file), where used. Only the spreadsheets gobazo itself creates for you, such as a daily order sheet. gobazo cannot see any other file in your Drive. What we store, and for how long

Your Google sign-in tokens, encrypted, until you disconnect the account. Email headers and a short preview (sender, subject, date, first line) for the last 14 days, so your inbox opens quickly. We do not store the full body of your emails; it is fetched from Google each time you open a message. Calendar events in a rolling window (30 days back, 90 days ahead), refreshed from Google so moved or deleted events disappear. Your morning summary text, and any email you chose to turn into a ticket or task, which stays with that ticket under the retention rules above. AI features

When you ask gobazo's assistant to summarise your inbox, draft a reply or plan an event, the email headers, previews or message text needed for that one request are sent to our AI provider (Anthropic) to produce the answer, and are not kept by it for any other purpose. Nothing the AI drafts is sent or saved until you approve it.

Limited Use

gobazo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google user data only to provide and improve the features described above, which you can see in the product. We do not use Google user data for advertising, including retargeting or personalised ads. We do not sell Google user data, and we do not transfer it to anyone except as needed to provide these features (such as our hosting and AI providers, acting under contract on our instructions), to comply with the law, or as part of a merger or acquisition after telling you. We do not use Google user data to develop, improve or train generalised or foundation AI or machine-learning models. No person at gobazo reads your Google user data unless you ask us to for support and give your permission, it is needed for security (for example investigating abuse), or the law requires it. Stopping access and deleting data

You can disconnect a Google account at any time in gobazo (Settings, then Apps / Mail & Calendar, then Disconnect). We then stop all access, delete the stored tokens, and delete the stored email headers, previews and calendar events for that account within 30 days. You can also revoke gobazo's access from your Google Account at myaccount.google.com/permissions. To ask for deletion of anything else we hold, write to mohit.dhawan@consenko.com.

Product usage data. We collect pages visited, buttons used and masked screen recordings. These are linked to an internal account number and your workspace, never your name or email, and your IP address is not stored. We use them only to improve the product. They are processed by PostHog Inc. (United States) as our data processor. This data may leave India. On our website this happens only with your consent, which you can withdraw at any time. You may ask us to delete your usage data by writing to mohit.dhawan@consenko.com

Changes to this notice A published notice is never edited in place. A change is a new version with its own effective date, and the previous version stays on record so anyone can see exactly what they agreed to and when. Material changes are announced before they take effect.

Grievance Officer Our Grievance Officer under section 13 of the DPDP Act is Mohit Dhawan, reachable at mohit.dhawan@consenko.com, or by post at 2nd Floor, B-30, Block B, Sector 4, Noida, Uttar Pradesh 201301.

If we do not respond, or you are not satisfied with our response, you may complain to the Data Protection Board of India. Please come to us first: the Act expects this route to be used before the Board is approached, and most problems turn out to be a mistake we can fix the same week.