Privacy Policy

1. Who we are and scope of this Policy

This Privacy Policy describes how Pyvot Consultancy & Analytics Private Limited (“Pyvot”, “Mynt”, “we”, “us”, or “our”) processes personal data through the Mynt website, web and mobile applications, integrations, customer support, communications, and related services (collectively, the “Service”).

Our registered office is at 3rd Floor, Unit 303, Arch Square, X2, Block EP & GP, Salt Lake, Sector V, North 24 Parganas, West Bengal 700091, India. For privacy questions or requests, contact contact@pyvot.in.

This Policy applies to individual users, business customers, authorised workspace users, website visitors, and people who communicate with us. It does not govern independent processing by third-party websites, services, or customer organisations.

2. Our role

For account, website, billing, support, security, and product-operation information, Mynt generally acts as the entity determining why and how personal data is processed.

For Customer Data submitted to a business workspace, the business customer may determine the purposes and means of processing and Mynt may act on its instructions. In that case, users should also review the organisation’s privacy notices and direct organisation-specific requests to its administrator.

3. Information we collect

3.1 Account and profile information

When you create or manage an account, we may collect your name, email address, phone number, organisation, role, profile details, account settings, and authentication information. If you use Google Sign-In, Google may provide your name, email address, profile image, and Google account identifier as shown on the consent screen.

3.2 Gmail data

If you separately connect Gmail, Mynt may receive read-only access to the Gmail data covered by the exact scope displayed on Google’s consent screen. Depending on that scope and the feature you use, this may include message metadata, sender and recipient information, subject lines, message bodies, threads, labels, and attachments.

Mynt does not use the Gmail read permission to send, modify, move, label, archive, or delete messages. We access Gmail data only after you authorise the connection and only to provide the user-facing feature you request.

3.3 Content you provide

We collect prompts, instructions, files, spreadsheets, text, images, reports, feedback, configurations, and other content that you upload, paste, enter, or generate through the Service. Uploaded files and spreadsheets are user-provided content; the current Google integration does not request Google Drive or Google Sheets access.

3.4 Usage, device, and technical information

We may collect device type, operating system, browser type, app version, language, approximate location derived from IP address, IP address, timestamps, pages or features used, performance data, diagnostic logs, crash information, security events, and identifiers used for authentication, fraud prevention, and analytics.

3.5 Payment and transaction information

For paid plans, we collect subscription details, billing contact information, invoices, payment status, tax information, and transaction references. Payments are processed by Razorpay. Mynt generally does not receive or store full card or bank credentials entered directly into Razorpay’s payment interface.

3.6 Communications

We collect information you provide when you contact us by email, telephone, support channels, or WhatsApp, including the content of the communication and related contact details. We may also record your communication preferences and delivery status for reports and notices.

3.7 Information from organisations and other users

A business customer or workspace administrator may provide information about authorised users, assign roles, upload Customer Data, or direct us to create or manage accounts. Other users may include information about you in files, emails, reports, or shared workspace content.

4. How we use information

We use personal data for the following purposes:

• create, authenticate, administer, and secure accounts;
• provide, personalise, maintain, troubleshoot, and support the Service;
• process user-requested AI features, including analysing uploaded files or spreadsheets, extracting information, and preparing reports or insights;
• provide Google Sign-In and the optional read-only Gmail integration;
• deliver reports and communications by email or WhatsApp at your request or according to settings you choose;
• process subscriptions, payments, invoices, taxes, renewals, cancellations, and fraud checks;
• monitor performance, diagnose errors, prevent abuse, protect users, and maintain security;
• analyse product usage and improve the reliability, usability, and functionality of the Service without using private customer content or Google user data to train general-purpose AI models;
• respond to enquiries, requests, complaints, and legal claims;
• comply with legal, regulatory, accounting, tax, and contractual obligations; and
• send promotional communications where permitted, with an option to unsubscribe.

5. Google user data: access, use, storage, and sharing

5.1 Permissions requested

Mynt requests only the Google permissions needed for features you choose to use. The production Service uses Google Sign-In and may request read-only Gmail access. The exact data and permissions are displayed on Google’s consent screen before access is granted.

5.2 Purpose and user benefit

Google Sign-In is used to authenticate your account and populate basic profile information. Gmail data is used only to provide visible productivity features you request, such as extracting tasks, dates, amounts, or other information, and generating reports or insights for you.

5.3 No automatic connected-account actions

Mynt does not send emails or take other actions in your connected Google Account through the Gmail read permission. Any Service action that could affect an external account must be initiated or expressly approved by you and must use a separately authorised permission.

5.4 Limited Use and prohibited uses

Mynt’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide or improve the user-facing feature for which you granted access;
• Google user data is not sold, rented, or transferred to data brokers;
• Google user data is not used for advertising, retargeting, personalised marketing, surveillance, credit decisions, lending, or unrelated profiling;
• Google Workspace APIs and Google user data are not used to develop, improve, or train general-purpose or non-personalised AI or machine-learning models;
• Google user data is not combined with analytics data for advertising purposes; and
• human access to Google user data is limited to cases where you give specific consent, access is necessary for security or abuse investigation, access is required by law, or access is strictly necessary to provide support you request.

5.5 Revoking access

You can disconnect Google through Mynt settings where available or revoke Mynt’s access from your Google Account’s third-party access controls. Revocation invalidates or disables the relevant access token and may stop connected features from working. You may also request deletion through our public Data Deletion Request page at https://pyvot.in/data-deletion or by contacting contact@pyvot.in.

Because Google records one grant per Google account for Mynt, revoking it also resets your consent for “Sign in with Google” to Mynt, so Google may ask you to consent again the next time you sign in with Google.

6. AI processing

Mynt Assistant is the feature in the Mynt app that answers questions you type about your business. It uses AI models to check your question, work out what it asks, build the database query that answers it, and word the answer.

To answer a question, Mynt sends only the following to the AI providers listed below:

• the question you type, with a short summary of your earlier messages in the same chat; and
• the rows of your own business data needed for the answer, such as sales, payouts, commissions, and outlet or brand names. These rows can include figures Mynt extracted from the Zomato and Swiggy settlement statements in the Gmail account you connected.

With these, Mynt sends its own instructions and the database query built for your question. Mynt never sends an AI provider your emails or attachments themselves, your passwords or sign-in details, or any other customer’s data. This use of data derived from Gmail is limited to Mynt Assistant, a feature you choose to turn on, and follows the Limited Use requirements in section 5.4.

The AI providers that receive this data, what each one does, and the terms that govern it:

• Anthropic (Claude API) runs every AI step of Mynt Assistant first and receives the data described above. Under Anthropic’s Commercial Terms, Anthropic may not train its models on content sent through its API. It keeps that content for a limited period for security and abuse monitoring (by default up to 30 days, and longer only if its automated systems flag it as violating its Usage Policy or the law requires it) and then deletes it, as described in How long do you store my organization’s data?
• Google (Gemini API, Paid Services) compares each question you type with a list of common questions, so that Mynt can answer familiar questions consistently. It receives the text of your question only. Under Google’s Gemini API Additional Terms of Service for Paid Services, Google does not use prompts or responses to improve its products, and logs them for a limited period only to detect and prevent violations of its Prohibited Use Policy and for legal compliance.
• OpenAI (API) is Mynt Assistant’s backup provider: when Anthropic cannot complete one of these steps, OpenAI completes that step instead and receives the data described above for it. As described in OpenAI’s Data controls in the OpenAI platform, data sent to the OpenAI API is not used to train or improve OpenAI models, and abuse-monitoring logs are kept for up to 30 days unless the law requires longer.

These providers do not use your data to train their AI models, and keep it only for the limited periods described above. Mynt itself does not use customer data, private User Content, or Google user data to train general-purpose AI or machine-learning models.

Before Mynt Assistant works on a question, Mynt screens it for text written to make the Assistant ignore its instructions. The screening runs on Mynt’s own servers with Llama Prompt Guard 2, a model published by Meta, and sends nothing to Meta or any other third party. If the screening flags a question, Mynt either refuses it or asks Anthropic to check it once more, and refuses it if it fails that check. The AI providers listed above receive the question in any case, to answer it.

Built with Llama. Llama 4 is licensed under the Llama 4 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved.

Mynt Assistant sends nothing to an AI provider until you agree on its consent screen in the app. Your agreement is recorded for your Mynt account, not for a device, and only you can give or withdraw it. You can withdraw it at any time in the app’s Settings, under Privacy, and Mynt Assistant then stops sending your data straight away. We will update this section before adding or changing an AI provider, and Mynt Assistant will ask for your agreement again before it sends anything under the new terms.

Mynt keeps your Mynt Assistant chat history (your questions and its answers) for 90 days and then deletes it; closing your Mynt account deletes it at once.

AI-generated results may contain errors. Check important figures against your reports, and review the Terms of Service for important limitations regarding AI Output.

7. Legal grounds and permitted purposes

Depending on the applicable law and context, we process personal data based on one or more of the following: your consent; performance of a contract or steps requested before entering a contract; compliance with legal obligations; legitimate uses or interests such as security, support, fraud prevention, and service improvement; and the establishment, exercise, or defence of legal claims.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal and may prevent a feature from functioning.

8. How we share information

We do not sell or rent personal data. We may disclose information to the following recipients only as necessary for the purposes described in this Policy:

• Amazon Web Services (AWS), for cloud hosting, infrastructure, storage, security, and related operations;
• Anthropic, as the AI provider for Mynt Assistant, only after you turn the Assistant on and under terms that do not allow it to train on your data (see section 6);
• OpenAI, as the backup AI provider for Mynt Assistant when Anthropic is unavailable, only after you turn the Assistant on and under terms that do not allow it to train on your data (see section 6);
• Google, through the paid Gemini API, to match Mynt Assistant questions with common questions, only after you turn the Assistant on and under terms that do not allow it to train on your data (see section 6);
• Slack, which delivers Mynt’s internal operational alerts about errors and outages in Mynt Assistant to our team; an alert can include your Mynt user, chat-session and request identifiers and technical error messages, but not your business data;
• Razorpay, for payment processing, subscriptions, fraud prevention, refunds required by law, and payment support;
• Google, for Google Sign-In, Gmail authorisation, email-delivery infrastructure, Firebase Analytics where enabled, and Google Play app analytics where enabled;
• WhatsApp and its service providers, when you choose or configure communication or report delivery through WhatsApp;
• professional advisers such as lawyers, auditors, accountants, insurers, and consultants under confidentiality duties;
• business customers and workspace administrators where your account belongs to their organisation;
• courts, regulators, law-enforcement agencies, government bodies, or other parties when disclosure is required by law or reasonably necessary to protect rights, safety, and security; and
• a buyer, investor, affiliate, or successor in connection with a merger, financing, reorganisation, acquisition, or sale of all or part of the business, subject to applicable legal requirements.

We do not send Gmail content, uploaded files, or spreadsheet content to Firebase Analytics, Google Play analytics, Razorpay, or WhatsApp unless you expressly direct the relevant content to be delivered through WhatsApp. Google user data is not shared for advertising or general analytics.

9. Analytics, cookies, and similar technologies

9.1 Cookies and similar technologies

The website and applications may use essential cookies, local storage, and similar technologies for authentication, preferences, security, load balancing, and core functionality.

You can control cookies through browser or device settings, although disabling essential technologies may affect the Service.

9.2 First-party product analytics

First-party product analytics. To understand how Mynt is used and to improve it, we collect usage events from our website (pyvot.in), the Mynt web app and the Mynt mobile app. These cover the pages and screens you view and for how long, the features and buttons you use, and how far you get through sign-up, onboarding and payment. They also record the app and its version, your device type, operating system and browser (major versions only), and your approximate location (country, region and city) worked out from your IP address. The analytics records do not contain your IP address or your browser’s full identifying string; we use them only for a moment to work out your device type and approximate location. Like every request to our servers, a request that carries usage events is also recorded in our load-balancer and web-firewall security logs (your IP address, browser string, the time and the address requested), which we keep as described in section 10.5. These events never contain your name, email address, phone number, anything you type, or any information from your connected Gmail account or your restaurant’s statements (no amounts, outlet or restaurant names, or IDs). When you are signed in, events are linked to you only through a pseudonymous identifier: a keyed one-way hash (HMAC-SHA256) of your account ID. Otherwise they are linked only to random identifiers created on your device for that visit and session. Because this pseudonymous information can still relate to you, we treat it as personal data. We collect and store these analytics ourselves, in our own cloud infrastructure in India (AWS, Mumbai region). They are not shared with, sold to, or processed by any third-party analytics or advertising provider, and only authorised Pyvot staff can view the aggregated reports. Usage events are deleted automatically 13 months after we receive them. When a Mynt account is deleted, the usage events linked to that account’s users are deleted as part of the deletion, including any that arrive in the following day; a user who also belongs to another Mynt account keeps their usage events with that account. Backup copies of usage events expire as described in section 10.3.

IP geolocation by DB-IP (db-ip.com), licensed under CC BY 4.0.

9.3 Google analytics services

Separately from the first-party analytics in section 9.2, where enabled, Firebase Analytics may be used for web or application usage analytics, and Google Play analytics may provide app-installation, performance, and crash information. We configure these services to avoid collecting Gmail message content, uploaded file contents, spreadsheet contents, or other private customer content. Consent controls will be used where required by law.

10. Data retention and deletion

10.1 General rule

We retain personal data only for as long as reasonably necessary to provide the Service, fulfil the purposes described in this Policy, comply with legal and contractual obligations, resolve disputes, and enforce agreements.

10.2 Public data deletion requests and account deletion

You may request deletion of your Mynt account and associated personal data through our public Data Deletion Request page at https://pyvot.in/data-deletion. The page is publicly accessible and does not require you to sign in. You can submit the email address associated with your Mynt account or data, and the request will be recorded for review by authorised Mynt administrators. You may also submit a deletion request by emailing contact@pyvot.in. For security, submitting an email address does not itself trigger automatic deletion. We may verify that you control the submitted email address and may request additional information reasonably necessary to confirm identity, authority, and the scope of the request. This is intended to prevent unauthorised or fraudulent deletion requests. Once a valid request is verified, we will delete or de-identify the applicable account and associated personal data within thirty (30) days, except for information that must be retained for legal, security, fraud-prevention, dispute, tax, accounting, or other lawful purposes. We may retain a limited record of the deletion request and its disposition where reasonably necessary to demonstrate compliance or prevent abuse.

10.3 Backups

Deleted information may remain in encrypted or access-restricted backups for up to ninety (90) days before being overwritten or removed through normal backup cycles. Backup data is not restored for ordinary business use after a valid deletion request, except where necessary for disaster recovery, security, or legal compliance.

10.4 Google access tokens and Gmail data

Google access and refresh tokens are stored encrypted and only while needed to maintain the connection. When you remove a connected mailbox in Mynt, when Mynt support removes it at your request, when you connect a different Google account in its place, or when your Mynt account is deleted, Mynt asks Google to revoke the access you granted and deletes its copy of the tokens. If the same Google account is still connected to another Mynt workspace, access is revoked when the last connection is removed. You can also revoke access at any time from your Google Account’s third-party access page.

Mynt uses Gmail access to find settlement emails from the food-delivery platforms Mynt supports (currently Swiggy and Zomato) and download the settlement statements attached to them. Downloaded statement files, and files you upload yourself, are stored encrypted for up to ninety (90) days after they are received, so that they can be processed again if a platform changes its format, and are then deleted automatically. The settlement figures extracted from them are saved to your account as User Content and are kept until you delete them or close the account. Disconnecting Gmail stops further retrieval but does not delete figures already extracted. Gmail data and saved derivatives subject to an account deletion request are deleted within thirty (30) days, with backup copies expiring within ninety (90) days.

10.5 Financial, security, and support records

Tax invoices, credit notes and refund records, including the amounts and taxes shown on them, are kept after an account is deleted, separated from the deleted account, for at least the period required by Indian tax law. Other billing records, such as subscription and order history, are deleted with the account; the accounting records the law requires are kept in our accounting system. Security logs, abuse-prevention records, support communications, and legal records are retained for as long as reasonably necessary for the relevant purpose and then deleted or de-identified.

10.6 Mynt Assistant chat history

Mynt keeps your Mynt Assistant chat history (your questions and its answers) for ninety (90) days and then deletes it automatically. Closing your Mynt account deletes it at once. Backup copies expire as described in section 10.3. How long an AI provider keeps what Mynt Assistant sends it is set by that provider’s own terms, described in section 6.

10.7 Files Mynt Assistant creates

When an answer is too large to show in the chat, Mynt saves the full result as a file in your account so that you and other authorised users of the account can download it. These files are kept until your Mynt account is closed or a data-deletion request for it is processed (section 10.2), and are then deleted with the account’s other data. Backup copies expire as described in section 10.3.

11. International processing

Mynt is based in India and uses service providers that may process information in India and other countries where they or their subprocessors operate. Those countries may have different data-protection laws.

Where required, we use contractual, organisational, and technical safeguards for cross-border processing and comply with applicable restrictions on transferring personal data.

12. Security

We use reasonable administrative, technical, and organisational safeguards designed to protect personal data. These measures may include access controls, authentication, encryption in transit, encryption at rest where appropriate, logging, monitoring, backup controls, vulnerability management, personnel confidentiality obligations, and vendor due diligence.

Access to private customer content and Google user data is restricted to authorised personnel and service providers with a legitimate need and appropriate obligations. No system is completely secure, and we cannot guarantee absolute security.

If you believe your account or information has been compromised, contact contact@pyvot.in promptly. Do not use the public deletion form to report urgent security incidents.

13. Your choices and rights

Subject to applicable law and verification of your request, you may have the right to:

• access information about the personal data we process and obtain a copy where applicable;
• correct, complete, or update inaccurate personal data;
• request deletion of personal data;
• withdraw consent and disconnect Google or other integrations;
• object to or request restriction of certain processing where applicable;
• request portability of information where applicable;
• opt out of promotional communications;
• nominate another person to exercise rights in circumstances recognised by applicable Indian law; and
• raise a grievance with us and, where available, complain to the competent data-protection authority.

To exercise a data-deletion right, use our public Data Deletion Request page at https://pyvot.in/data-deletion or email contact@pyvot.in. For other privacy rights, you may email contact@pyvot.in from the address associated with your account and describe the request. We may ask for information reasonably necessary to verify identity, authority, and scope before acting on a request. We will respond within the period required by applicable law.

14. Business workspaces

If you use Mynt through an organisation, the organisation may control your workspace account and Customer Data. Its administrators may be able to manage access, view or export workspace information, set retention rules, and delete accounts or content.

Mynt processes organisation-controlled Customer Data in accordance with the customer agreement and lawful instructions. An organisation’s internal processing is governed by its own notices and policies.

15. Children’s privacy

The Service is intended for users aged eighteen (18) or older. We do not knowingly permit children to create accounts or knowingly collect personal data from children through the Service. If you believe a child has provided personal data, contact us so that we can investigate and delete it where appropriate.

16. Third-party services and links

The Service may contain links to or integrations with third-party services. Those third parties process information under their own terms and privacy policies. This Policy does not control their independent practices, including practices of Google, Razorpay, WhatsApp, app stores, or websites you choose to access.

17. Changes to this Policy

We may update this Policy to reflect changes in law, technology, vendors, features, or data practices. We will publish the updated version at https://pyvot.in/privacy and revise the “Last updated” date.

If a change materially affects how we use Google user data or other personal data, we will provide prominent notice and obtain consent where required before applying the new use.

18. Grievance Officer and contact details

For privacy questions, account deletion, data-rights requests, security concerns, or grievances, contact:

Schedule A - Google Data Access Summary

This Schedule summarises the Google data currently requested by Mynt and the related user-facing purpose.

Uploaded files and spreadsheets are provided directly by users and are not accessed through Google Drive or Google Sheets permissions under the current configuration.