Privacy Policy

We collect only what we need for the purposes in section 3. Here is every category, with where it comes from.

We don’t ask for sensitive data such as health, financial account or government ID details through our website. Please don’t include them in form messages.

Each purpose below lists the data it uses and the legal basis we rely on. Where we rely on consent, you can withdraw it as easily as you gave it.

We don’t make decisions about you that have legal or similarly significant effects using automated processing alone.

When an organisation uses GYCO, it decides what data the platform processes and why. That organisation is the Data Fiduciary, and Futurecraft acts as its Data Processor under the customer agreement and our Data Processing Agreement.

Private deployment

GYCO runs in the customer’s own cloud or on-premise environment. Business data, documents and dashboards stay inside that environment. FutureCraft staff access a deployment only when the customer authorises it, for example to provide support, and that access is logged.

No model training on customer data

We don’t use prompts, uploaded documents, query results or generated outputs from a customer’s workspace to train, fine-tune or improve any model, ours or a third party’s.

Product telemetry

If a customer enables it, GYCO sends us limited technical telemetry such as error reports, performance metrics and feature usage counts. It contains no business content. Customers can switch telemetry off at any time.

We never sell personal data or share it for cross-context advertising. We share it only with:

• Service providers who host our website, run our CRM and email tools, process payments and help with analytics. They act on our instructions under written contracts. See our list of sub-processors.
• FutureCraft group companies, where needed to deliver services, under the same protections as this policy.
• Event partners, only for co-hosted events, and only when the registration form tells you so.
• Authorities, when the law requires it or to protect the rights and safety of our users and the public.
• A successor business, if FutureCraft is involved in a merger or acquisition. We’ll tell you before your data becomes subject to a different policy.

Our website data is stored in India / region. Some service providers may process it in other countries, such as the United States. We transfer data only to countries permitted under Indian law, and for visitors in the EU or UK we use Standard Contractual Clauses or an equivalent safeguard.

We keep personal data only as long as its purpose requires, then delete or anonymise it.

We use encryption in transit and at rest, role-based access controls, access logging, regular security testing and staff training. Our practices are aligned with ISO/IEC 27001 / SOC 2.

If a personal data breach affects you, we’ll inform you and the Data Protection Board of India as the law requires, describing what happened, the likely impact and what we’re doing about it.

You can exercise any of these rights by emailing our Grievance Officer (section 12). We may ask you to confirm your identity first.

If you’re in the EU, UK or California, you also have the rights given by your local law, including data portability and objecting to processing based on legitimate interest.

GYCO is a business product. Our website isn’t meant for anyone under 18, and we don’t knowingly collect their data. If you think a child has given us personal data, contact us and we’ll delete it.

For any question, request or complaint about your personal data, contact our Grievance Officer.