Privacy Policy & Terms of Use

(Doc. No: ISMS-PL-PP)

Copyright Notice:

The present document or drawing is property Mysa  and shall not, under any circumstances, be totally or partially, directly or indirectly, transferred, reproduced, copied, disclosed or used, without its prior written consent, for any purpose and in any way other than that for which it is specifically furnished or outside the extent of the agreed upon right of use.

Revision History

PRIVACY POLICY

ACCEPTANCE OF TERMS

This privacy policy governs the manner in which Mysa Innovations Private Limited including its affiliates and subsidiaries (“Company”) collects, uses, maintains and discloses information collected from users (each, a “User”) of the name [www.mysa.io](https://www.mysa.io) website and services offered by the Company (“Website”). This privacy policy applies to the Website and all services offered by the Company. You agree to and are bound by the terms and conditions set forth below and in any modified or additional terms that the Company may publish from time to time (collectively, the “Privacy Policy”).

If the User does not agree to all of the terms and conditions contained in the Terms of Use and this Privacy Policy, do not access or use this Website.

PERSONAL INFORMATION

The personal information collected, received, processed, stored, dealt or handled by the Company includes, [name, contact details, location, unique identifiers, email address].

The Company may collect personal information from Users in a variety of ways, including, but not limited to, when Users visit the Website, registers on the Website,  seeks information in connection with other activities, services, features or resources the Company makes available on the Website. Users may be asked for, as appropriate, name, email address, mailing address, phone number.

The Company will collect personal identification information from Users only if they voluntarily submit such information to the Company. Users can always refuse to supply personal information, except that it may prevent them from engaging in certain Website related activities.

NON-PERSONAL INFORMATION

The Company may collect non-personal information about Users whenever they interact with the Website. Non-personal information may include the browser name, the type of computer and technical information about Users means of connection to the Website, such as the operating system and the internet service providers utilized and other similar information.

USE OF THE INFORMATION COLLECTED

The Company uses the User’s personal information for the following purposes:

to identify the User once it registers on the Website;
to create the User login and administer the User accounts;
to contact the User and respond to User questions or requests;
to send the User communication regarding the services and products;
to provide access to desirable content and products based on the User’s preferences;
to provide better usability, troubleshooting and site maintenance;
to understand which parts of the Website are visited and how frequently;
to screen the orders for potential risks or fraud; and
to improve and optimize the Website (for example, by generating analytics about how the User’s browse and interact with the Website, and to assess the success of the Company’s marketing and advertising campaigns).

SHARING OF USER’S PERSONAL INFORMATION

The Company may share the User information with these third parties for those limited purposes provided that the User have given the Company permission. If the User access those links, the User will leave the Website. The Company does not control those sites or their privacy practices, which may differ from the Company. The Company does not endorse or make any representations about third-party sites.

The Company is not responsible for examining or evaluating, and does not warrant the offerings of, any businesses or individuals or the content of their website. The Company does not assume any responsibility or liability for the actions, products, services, and content of any other third parties. User should carefully review the legal statements and other conditions of use of any website which the User accesses through a link from this Website. The User linking to any other off-site websites is at the User’s own risk.

The Company never collects or maintains information at the Website from those the Company knows are under the age of 18 (eighteen) years. No part of the Website is structured to attract anyone under the age of 18 (eighteen) years.

The Company may use third-party service providers to help the Company operate its business and the Website or administer activities on the Company’s behalf, such as sending out newsletters or surveys.

IDENTITY THEFT
There may be instances when the User receive a seemingly legitimate looking e-mail asking the User personal information from the User such as the User’s credit card details, bank account details, one-time passwords, contact information, etc. The Company will never ask for such information from you via e-mail.

Such activities are usually carried on by unauthorized individuals and are illegal in nature. They are called phishing or identity theft. In case of any suspicion of such activity or on receiving such an e-mail the User should be certain it was not sent by the Company. The Company advises the User to not respond to such mail and to take whatever action you see fit.

WEB BROWSER COOKIES

A cookie is an element of data that a website can send to the User’s browser, which may then store it on the User’s system. The Company uses cookies in some of its pages to store visitors' preferences and record session information. The information that the Company collects is then used to ensure a more personalised service level for the Users.

The User can adjust the settings on its browser so that the User will be notified when it receives a cookie, or to disable the cookies associated with the Website. The User should refer to its browser documentation to check if cookies have been enabled on the User’s computer or to request not to receive cookies.

The Website may use “cookies” to enhance User experience. User's web browser places cookies on their hard drive for record-keeping purposes and sometimes to track information about them. User may choose to set their web browser to refuse cookies or to alert the User when cookies are being sent. If they do so, note that some parts of the Website may not function properly.

DATA RETENTION

The Company will retain the User information only for as long as is necessary for the purposes set out in this policy. The Company will retain and use the User’s information to the extent necessary to comply with the Company’s legal obligations (for example, if the Company is required to retain the User’s data to comply with applicable laws), resolve disputes, and enforce the Company’s legal agreements and policies.

The Company encourages the User to review the information and inform about any discrepancies and information found to be inaccurate shall be corrected or amended. Please reach out to the Company at mail@mysa.io in case the User would like to review the information collected by the Company. The User shall at all times, take adequate necessary precautions, at the User’s end, to preserve the integrity and security of the User’s data which shall include and not be limited to the User personal information. All information disclosed by the User shall be deemed to be disclosed willingly and without any coercion.

LOG DATA

The Company want to inform the User that whenever you use the Website or avail the services, the Company collects data from the User device called log data (“Log Data”). This Log Data may include information such as the User device’s internet protocol (“IP”) address, device name, operating system version, configuration of the app when utilising the Website services, the time and date of the User’s use of the Website service, and other statistics for the purposes of audit trials, trouble shooting, and other purposes.

INFORMATION SECURITY
The Company works to protect the User’s information from loss, misuse or unauthorized alteration by using industry-recognized security safeguards, coupled with carefully developed security procedures and practices. The Company maintains electronic and procedural safeguards of all information. The Company uses both internal and external resources to review the Company’s security procedures. The security practices and procedures contains managerial, technical, operational and physical security control measures that are commensurate with the personal information being collected, received, processed, stored, dealt or handled and the nature of the business of the Company.

SEND TO MYSA CHROME EXTENSION

“Send to Mysa” is a Chrome extension published by the Company. It runs inside a User’s own Gmail account in the Chrome browser and lets the User forward invoices and receipts to the Company’s ingestion addresses (for example, yourcompany@invoice.mysa.io), and see the status of bills and reimbursements they have submitted. This section explains how the extension accesses, uses, shares, stores, protects, retains and deletes Google user data. Where this section differs from any other part of this policy, this section applies to Google user data.

1. Data Accessed

With the User’s permission, the extension accesses:

●The Gmail page the User has open: to show the Send to Mysa button and identify which email(s) the User has selected, including the sender’s name and email address and Gmail message and thread identifiers.

●Read Gmail: to read the emails the User chooses to send to Mysa, including their attachments, sender, subject and date; to read status-update emails and upload-result files sent by the Company (from mysa.io and mysa.one addresses), including when they appear in an email thread the User has opened; to read the emails the User has previously sent to a Mysa address (the recipient, subject, date and the names and sizes of attached files), to suggest which Mysa company the User belongs to and to warn the User about files that were already sent to Mysa; and, only for senders the User has turned on for auto-send, to check for new emails with attachments from those senders.

●Send email as the User: to forward the selected email or its attachments to the Mysa ingestion address the User has configured.

●Chrome identity: only to obtain the sign-in token Chrome issues for the two Gmail permissions above.

The extension does not access the User’s contacts, calendar, Drive or any other Google data.

2. Data Usage

Google user data is used only to provide features the User can see and control:

●forwarding the emails or attachments the User selects to the User’s Mysa ingestion address, and merging attachments into a single PDF when the User asks;

●where the User has turned on auto-send for a specific sender, checking once an hour for new emails with attachments from that sender and forwarding them; auto-send can be turned off or deleted for any sender at any time;

●suggesting the User’s Mysa company from addresses the User has already sent documents to;

●warning the User before they send a document they appear to have sent before, including sends made before the extension was installed;

●showing the status of submitted bills and reimbursements, read from the Company’s own status emails in the User’s mailbox; and

●showing the results of bulk uploads, read from the result files the Company emails back.

Google user data is not used for advertising, is not sold, is not used to build user profiles, and is not used to train artificial intelligence or machine-learning models. The Company does not access the User’s mailbox; it receives only the emails that are forwarded to it, either by the User directly or through auto-send for senders the User has turned on.

3. Data Sharing

The extension sends Google user data to one place only: the Mysa ingestion addresses the User has configured, as an ordinary email sent from the User’s own Gmail account, exactly as if the User had forwarded it by hand. Those documents then become part of the User’s Mysa account and are handled under the rest of this policy. Apart from that, Google user data is not shared with, sold to or transferred to any third party. The extension contains no analytics, advertising or other third-party code. The general statements about sharing information with third parties elsewhere in this policy do not apply to Google user data.

4. Data Storage & Protection

The extension has no server of its own and makes no call to any Company system. Gmail data is processed only inside the User’s browser and travels only between the browser and Google’s Gmail API over encrypted (HTTPS) connections. Sign-in tokens are issued and held by Chrome’s built-in Google sign-in; the extension does not store them itself.

The extension keeps a small amount of data in Chrome’s extension storage:

●the Mysa tenant(s) the User has set up, and the User’s remembered choice for each sender (the sender’s email address, document type, whether to merge attachments and which tenant to use). These use Chrome sync, so they follow the User’s own Google account when Chrome sync is turned on;

●a log of documents sent (each email’s sender name and address, subject line, Gmail message and thread identifiers, and file names, sizes and digital fingerprints, including, once after the extension is first connected, a record of documents the User sent to Mysa in the previous year, rebuilt from the User’s Sent mail), a list of recent automatic sends, and the User’s auto-send settings (each sender’s name, document type, optional subject filter and recent send times). These are used only to detect duplicates, run auto-send and show the User their history, and they stay in that browser only.

None of this data is sent to or stored on Company servers.

5. Data Retention & Deletion

The send log keeps only the most recent 2,000 entries, the list of automatic sends keeps the most recent 50, and each auto-send setting keeps its 40 most recent send times; older entries are deleted automatically. Other settings are kept until the User changes or removes them. The User can:

●remove remembered senders, tenants and auto-send settings from within the extension;

●delete the data the extension stores in their browser by removing the extension from Chrome;

●clear data held through Chrome sync from their Chrome sync settings; and

●revoke the extension’s access to their Google account at any time at https://myaccount.google.com/permissions.

For help, or to request deletion of documents already forwarded to Mysa, the User can contact support@mysa.io. Such requests are handled under the deletion procedure in this policy.

Limited Use

Send to Mysa’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

DISCLAIMER

The Company makes no representation as to providing or storing back-up copies of any information submitted to the Company. The User shall be solely responsible to ensure that the User maintain back-up copies of such information and in the event of any malfunctioning or failing of the Website for any reason whatsoever (including on account of maintenance), the User may be required to resubmit such information.

Although, the Company takes appropriate steps to maintain the security of information the Company collects from the User, the Company assumes no responsibility of whatsoever nature as to make good the losses and damages the User may incur, due to privacy and/or security breach of the User information. The Company shall not be liable for any loss or damage sustained by reason of disclosure (inadvertent or otherwise) of any information and/or omission or inaccuracy with respect to any information so disclosed and used whether or not in pursuance of a legal process or otherwise.

USE OF THE WEBSITE

The User understands that, except for information, products or services clearly identified as being supplied by the Company, and does not operate, control or endorse any information, products or services on the internet in any way. Except for the Website, identified information, products or services, all information, products and services offered through the Website or on the internet generally are offered by third parties that are not affiliated with the Company. The User also understand that the Company cannot and do not guarantee or warrant that files available for downloading through the Website will be free of infection or viruses, worms, Trojan horses or other code that manifest contaminating or destructive properties. The User are responsible for implementing sufficient procedures and checkpoints to satisfy the User particular requirements for accuracy of data input and output, and for maintaining a means external to the Website for the reconstruction of any lost data.

The User assume total responsibility and risk for the User’s use of the Website and the internet. The Company provides the Website and related information “as-is” and does not make any express or implied warranties, representations or endorsements whatsoever (including without limitation warranties of title or non-infringement, or the implied warranties of merchantability or fitness for a particular purpose) with regard to the service, or on the internet generally, and the Company shall not be liable for any cost or damage arising either directly or indirectly from any such transaction. It is solely the User’s responsibility to evaluate the accuracy, completeness and usefulness of all opinions, advice, services, merchandise and other information provided through the service or on the internet generally. The Company does not warrant that the service will be uninterrupted or error-free or that defects in the service will be corrected. You understand further that the pure nature of the internet contains unedited materials some of which are sexually explicit or may be offensive to you. The User access to such materials is at the User risk. The Company has no control over and accept no responsibility whatsoever for such materials.

GENERAL

This privacy policy shall all be governed and construed in accordance with the laws of India applicable to agreements made and to be performed in India. You agree that any legal action or proceeding between the User and the Company for any purpose concerning this policy or the parties’ obligations hereunder shall be brought exclusively in a court of competent jurisdiction in New Delhi. The Company’s failure to insist upon or enforce strict performance of any provision of this policy shall not be construed as a waiver of any provision or right. Neither the course of conduct between the parties nor trade practice shall act to modify any provision of this policy. The Company may assign its rights and duties under this policy to any party at any time without notice to the User.

We retain user data only as long as necessary for our services and legal obligations, as per applicable law. To review, correct or delete your data stored by us, please contact support@mysa.io.

Procedure for handling requests for data deletion

You may request deletion of your personal data at any time by contacting support@mysa.io. All deletion requests are treated as service tickets and processed within 48hrs. You will receive confirmation once your data has been deleted.

The Company provides links to other websites and third-party platforms (“Third-Party Platforms”). Such Third-Party Platforms may collect information about you. The Company is not responsible for the privacy practices or the content of those linked websites and Third-Party Platforms. The Company recommends the User to review the privacy policies of such Third-Party Platforms.

The Website has the discretion to update this privacy policy at any time. The Company encourages Users to frequently check this page for any changes to stay informed about how the Company is helping to protect the personal information it collects. The User acknowledge and agree that it is the responsibility of the User to review this privacy policy periodically and become aware of modifications.

If Users have any questions or comments about the policy outlined above, the User can contact the Company’s Grievance Redressal Officer at the below mentioned details:

Name:         Mr. Mohit Jain
Address:     2nd Floor, Mysa Innovations Private Limited,

     Hanto Tranquil, 1811,

                  13th Cross Rd, Vanganahalli,
                  1st Sector, HSR Layout,
                  Bengaluru, Karnataka 560102.
Email:         mail@mysa.io