Privacy Policy

1. Who we are

Fyfolio (“Fyfolio”, “we”, “us”) runs fyfolio.com, a service for creating a link-in-bio page with links, products, bookings, payments and a contact form. This policy explains what personal data we handle when you use Fyfolio — as a page owner (“you”) or as a visitor to someone’s page — and the choices you have.

We follow India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. For anything in this policy, contact us at [email protected].

2. What we collect

When you create and use an account

• Account details: your name, email address and username. If you set a password we store only a one-way hash of it, never the password itself. If you use Google sign-in we store your Google account ID, name and email.
• Your page: everything you add — bio, location, photo, links, social handles, design choices, products and prices, booking hours, your UPI ID and payee name, and integration settings.
• Sign-in sessions: for each logged-in device, the time, browser (user agent) and IP address, so you can see and end sessions and so we can protect accounts.
• Plan and billing: your plan, its end date, and records of each payment (amount, date, Razorpay order, payment and subscription IDs). We never see or store your card, UPI PIN or bank login — payments are handled by Razorpay.
• Messages with us: emails you send to support.

When someone visits a Fyfolio page

• Visit statistics: that a page view or link click happened, the referring site (for example Instagram), and the device type (mobile or desktop). We do not store visitors’ IP addresses with these statistics and do not build profiles of visitors.
• What visitors choose to send: the contact form (name, email, phone, message), a booking (name, email, phone, note, chosen time) or a UPI payment request (name, email, phone, note, amount). This goes to the page owner, who decides how to use it.

3. How we use it

• To run your account and show your public page.
• To send you sign-in codes, receipts, booking and payment notifications, and replies from your Inbox.
• To process plan payments and autopay, and to keep the records the law requires.
• To show you statistics about your page.
• To keep Fyfolio secure — rate limits, fraud prevention and enforcing our Terms.
• To answer support requests and tell you about important changes to the service.

4. Why we’re allowed to

We process your data because you asked us to provide the service (your consent when you sign up and use it), to complete payments you start, to meet legal obligations such as tax and accounting record-keeping, and for legitimate uses like security. You can withdraw consent at any time by deleting your account — see Delete your data.

5. Who we share it with

We don’t sell your data and we don’t show ads. We share data only with services that help us run Fyfolio, and only what they need:

Your public page is public. Anything you publish on it can be seen by anyone with the link and may be indexed by search engines.

Integrations you turn on: on the Business plan you can add your own Google Analytics or Meta Pixel to your page, or a webhook that sends your leads, bookings and payments to a URL you choose. Data sent that way is handled under those services’ own policies.

We may also disclose data when required by law or a valid order from an authority.

6. Data you receive from your visitors

Leads, messages, bookings and payment requests from your page belong to you, the page owner. You’re responsible for using them lawfully — for example, only contacting people about what they asked for. UPI payments from your visitors go directly from their bank to yours; Fyfolio does not hold that money.

7. Cookies

Fyfolio itself uses one essential cookie, fy_session, to keep you logged in (it holds a random token; we store only its hash). A short-lived cookie is also used during Google sign-in. We use no advertising or tracking cookies.

If a Business-plan page owner adds Google Analytics or Meta Pixel to their page, those tools may set their own cookies for visitors to that page.

8. How long we keep it

• Account and page data: while your account exists. When you delete it, it’s removed from the live database straight away.
• Backups: database backups are kept for 14 days, so deleted data disappears from them within 14 days.
• Sign-in codes: expire after 10 minutes. Sessions: expire after 30 days or when you log out.
• Payment records: kept for up to 8 years after the payment, as required by Indian tax and accounting law, even after the account is deleted.

9. Security

All traffic uses HTTPS. Passwords are hashed with scrypt, sign-in codes and session tokens are stored only as hashes, and access to the servers and database is restricted. No system is perfectly secure, but if we ever learn of a breach affecting your data we’ll tell you and the authorities as the law requires.

10. Your rights

You can:

• See and correct your data at any time in your dashboard (My Page, Settings), or ask us for a copy.
• Download your leads as a CSV from Settings.
• Delete your account and data — instantly from Delete your data.
• Withdraw consent and complain to us (see Grievance officer below) or to the Data Protection Board of India.
• Nominate someone to exercise these rights for you in case of death or incapacity, by emailing us.

11. Children

Fyfolio is not meant for children under 18. If you’re under 18, use Fyfolio only with a parent or guardian’s consent. If we learn we hold a child’s data without that consent, we’ll delete it.

12. Grievance officer

For complaints about your data or content on Fyfolio, write to our Grievance Officer at [email protected] with the subject “Grievance”. We acknowledge complaints within 24 hours and resolve them within 15 days.

13. Changes to this policy

If we make important changes we’ll update the date above and, for significant ones, email you before they take effect.