Privacy Policy
Last updated: 29 October 2026
Fornax Labs ("Fornax Labs", "we", "us") builds AI agents for advisory and professional firms. Our first product, Sugamkar, reads client messages from email, WhatsApp and web forms and turns them into tracked work for the firm's team. This policy explains what personal data we collect, why, who we share it with, how long we keep it and what choices you have. It applies to our website at fornaxlabs.xyz, our pilot programme, and our services, including messages sent or received through the WhatsApp Business Platform.
In short: we collect only what we need to run the service. We mask sensitive identifiers before any AI processes a message. We never sell personal data, never use WhatsApp message content for advertising, never message anyone on WhatsApp without their consent, and never send a reply to a client without a person at the firm approving it.
1. Who we are and our role
Our role depends on whose data it is:
- Website visitors and pilot applicants. For data you give us through our website, pilot form or by email, Fornax Labs decides why and how it is used. We are the data controller (called "data fiduciary" under India's Digital Personal Data Protection Act, 2023).
- Customer firms' client data. When a firm (for example a mutual fund distributor, insurance broker, CA or law firm) uses our service, the firm is the controller of its clients' messages and details. Fornax Labs processes that data on the firm's behalf and on its documented instructions (as a data processor). If you are a client of one of our customers, that firm is your first point of contact for questions about your data, and we will help them respond.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Pilot and enquiry details | Name, work email, phone or WhatsApp number, firm name, type of firm, channels used, and anything you write in the message box | You, through the website form, email or a call |
| Client messages | Message text, attachments (such as documents or images), sender name and phone number or email address, timestamps, and delivery and read status | Our customers' clients, through email, WhatsApp and web forms connected by the customer |
| Workspace and account data | Names and work emails of the firm's team members, roles, rules, routing and approval settings, tasks and their status | Our customers and their team members |
| WhatsApp profile data | WhatsApp phone number, profile name, and message metadata supplied by WhatsApp | WhatsApp Business Platform |
| Usage and technical data | Activity and audit logs (which action happened, when, and by whom), IP address, browser and device type, error logs | Collected automatically when you use our website or service |
We do not ask clients to send, and our service is not designed to collect through WhatsApp, full payment card numbers, full financial account numbers, passwords, PINs, one-time passcodes or government ID numbers. If such details arrive in a message anyway, we mask them before AI processing (section 5) and customer firms are told not to request them over WhatsApp.
3. How we use data
- To provide the service: receive client requests, recognise what each one is, create tracked tasks, route them to the right person, prepare draft replies and wait for approval before anything is sent.
- To respond to pilot applications and enquiries, and to schedule calls.
- To keep the service secure, prevent abuse and fraud, and keep audit logs that customers rely on.
- To fix problems, support customers and improve reliability and accuracy of the service for the customer that the data belongs to.
- To meet legal obligations and respond to lawful requests.
Our legal bases: your consent (for example, when you submit the form or opt in to receive WhatsApp messages); performance of a contract with our customers; our legitimate interests in running and securing the service; and compliance with law. Under the DPDP Act we process personal data for the purposes you consented to or for other lawful uses the Act allows.
We do not sell personal data. We do not use client message content for advertising or profiling, and we do not use one customer's data to serve another customer.
4. WhatsApp Business Platform
Our service lets customer firms send and receive WhatsApp messages using the WhatsApp Business Platform, which is provided by WhatsApp LLC and Meta Platforms, Inc. and its affiliates ("Meta"). This section applies whenever you message, or are messaged by, a firm using our service on WhatsApp.
How messages are handled
- Messages sent to a firm's WhatsApp Business number are delivered to us through the WhatsApp Business Platform, so that we can show them to the firm's team and turn them into tracked tasks.
- Meta acts as our service provider and as an independent controller for its own purposes. WhatsApp's own handling of your data is described in the WhatsApp Privacy Policy and the WhatsApp Business Terms of Service. Messages to a business account are not covered by WhatsApp's end-to-end encryption once they reach the business's systems; the firm and its service providers, including us, can read them.
- We use the message content only to provide the service to the firm you contacted. We do not use WhatsApp message content, phone numbers or profile data for advertising, and we do not share it with Meta for advertising or to build profiles.
Opt-in and opt-out
- We never message anyone on WhatsApp without their consent. We message a person only on behalf of a customer firm, and only after that person has opted in to receive messages from the firm on WhatsApp (for example, by messaging the firm first or by agreeing on a form or in writing). Customers must keep a record of that consent, and we do not send messages to numbers that have not opted in.
- Messages outside the 24-hour customer-service window use pre-approved message templates, as WhatsApp requires.
- You can stop messages at any time by replying STOP, by blocking the number in WhatsApp, or by telling the firm or us at the address in section 14. We will stop sending you messages promptly and keep a suppression record so you are not contacted again.
Human approval and no automated decisions
Replies prepared by an agent are not sent until a person at the firm approves them. Agents sort and summarise; they do not recommend financial, insurance, tax or legal products and make no decision about you that has legal or similarly significant effect.
What we ask of customers
Customers must comply with the WhatsApp Business Terms of Service, the WhatsApp Business Messaging Policy and the Meta Commerce Policy, must have a lawful basis and your consent for the messages they send, and must not use the service for prohibited content or for unsolicited marketing.
5. AI processing and masking
- Before a message is analysed by an AI model, we detect personally identifiable information (PII) and sensitive personal information (SPI), such as government ID and tax numbers, financial account numbers, phone numbers and email addresses, and replace them with placeholders. The originals are restored only inside the firm's own workspace.
- Our AI model providers process the masked content only to return a result to us. They are not permitted to use it to train their models for others, and we do not train general-purpose models on customer data.
- Every agent step and decision is logged so the firm can review what happened and why.
6. Who we share data with
We share personal data only as needed to run the service:
- The customer firm that the data belongs to.
- Service providers that act on our instructions under written confidentiality and data-protection terms: cloud hosting and storage, AI model providers (masked content only), email delivery and the WhatsApp Business Platform (Meta).
- Professional advisers and authorities, where required by law, court order or to protect rights, safety and security.
- A successor, if Fornax Labs is involved in a merger, acquisition or sale of assets, subject to this policy continuing to apply.
We do not sell or rent personal data, and we do not share it for third-party advertising.
7. International transfers
Our providers, including Meta and cloud and AI providers, may process data in countries other than your own, including India, the United States and the European Economic Area. Where data leaves your country, we rely on lawful transfer mechanisms and contractual safeguards, and on any restrictions the DPDP Act or other applicable law places on transfers.
8. Retention and deletion
| Data | How long we keep it |
|---|---|
| Pilot and enquiry details | Up to 24 months after our last contact, or until you ask us to delete them |
| Client messages, attachments and tasks | For as long as the customer's account is active, or as the customer instructs. After the account ends, we delete or return the data within 90 days, unless the law requires us to keep it longer |
| Audit and security logs | Up to 12 months, or longer where needed for security or legal reasons |
| WhatsApp opt-out and suppression records | Kept so that we honour your opt-out; only your number and the opt-out date are held |
| Backups | Removed on the normal backup cycle, no later than 35 days after deletion |
A customer can ask us to delete a specific client's messages at any time. Deleted data cannot be recovered.
9. Security
We use measures suited to the sensitivity of the data we handle, including encryption in transit and at rest, masking of PII and SPI before AI processing, role-based access, separation between customers' workspaces, audit logging, and access only for staff who need it. No system is perfectly secure. If a personal data breach affects you, we will notify the affected customer and, where the law requires, the regulator and you, without undue delay.
10. Your rights and choices
Subject to applicable law, you can:
- ask for a summary of the personal data we hold about you and how it is used;
- ask us to correct inaccurate or incomplete data, or to update it;
- ask us to erase your data;
- withdraw consent at any time (this does not affect processing already done);
- stop WhatsApp or email messages by replying STOP or unsubscribing;
- nominate another person to exercise your rights if you die or become incapacitated (under the DPDP Act);
- raise a grievance with us, and if it is not resolved, complain to the Data Protection Board of India or to your local data protection authority.
To exercise a right, email us at the address in section 14 from the email address or WhatsApp number you used, so that we can verify it is you. We reply within 30 days. If your data sits in a customer firm's workspace, we may refer your request to that firm, which controls it, and will help them respond.
11. Cookies and site analytics
Our website does not use advertising or tracking cookies. It stores one preference, your light or dark theme choice, in your browser's local storage. Our hosting provider may log technical information such as IP address and browser type for security and delivery.
12. Children
Our service is for businesses and is not directed at children. We do not knowingly collect data about anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it. Where a customer firm's service involves a minor, the firm is responsible for obtaining verifiable parental consent as the law requires.
13. Changes to this policy
We may update this policy as our service or the law changes. We will post the new version here with a new "last updated" date. If a change is significant, we will tell our customers and pilot participants directly.
14. Contact and grievances
For any privacy question, request, opt-out or complaint, write to us:
- Email: privacy@fornaxlabs.xyz
- Website: fornaxlabs.xyz
We acknowledge grievances within 48 hours and aim to resolve them within 30 days. If you are unhappy with our response, you may complain to the Data Protection Board of India or your local data protection authority.