1. Who we are
Fyliio is a brand of GENLUNO, a sole proprietorship owned by Abhishek Bharti, registered in India under Udyam registration UDYAM-BR-07-0085324 (“we”, “us”). We provide a staff workspace and a WhatsApp collection service for Chartered Accountant (CA) firms in India and accounting firms worldwide. You can reach us on WhatsApp at +91 92347 65818, by phone at +91 92347 65818, by email at support@fyliio.com, or through the contact page.
2. Our role under the DPDP Act
For client names, GSTINs, WhatsApp numbers, messages, and uploaded documents, the CA firm is the Data Fiduciary under the Digital Personal Data Protection Act, 2023. Fyliio is the firm’s Data Processor and handles that data only on the firm’s instructions to run collection cycles. For staff accounts and for enquiries sent to us directly, Fyliio is the Data Fiduciary.
3. What we collect
- Staff: name, email, password hash, firm membership and role, and a session cookie.
- Clients, through the firm: name, WhatsApp number, GSTIN, subscribed services, conversation history, and files sent for an open checklist.
- Enquiries: the pilot form on our home page opens WhatsApp with your details filled in. The details reach us only if you press send in WhatsApp.
- Technical: webhook metadata needed to acknowledge Meta, job status, and classification results (document type, confidence, period). Logs do not contain document content.
- Website visits, only if you accept analytics cookies: pages viewed, approximate location, device and browser, collected by Google Analytics on the public pages and never in the staff workspace.
4. Why we use it
To request documents, receive WhatsApp media, match files to the firm’s checklist, remind clients about missing items, support staff review and packet export, bill for the service, and keep the workspace secure. We do not sell personal data. Client documents are never used to train AI models, ours or our providers’.
5. Notice and consent
The firm decides which clients to message. It must give its clients any notice, and obtain any consent, that the law requires before collecting their documents through Fyliio. For staff accounts, we process data to provide the service the firm has signed up for. We collect only what a collection cycle needs, and staff can correct client records in the workspace.
6. Sharing
We use service providers to run Fyliio, including our payment processor for billing; they are listed in the Data policy. We never share one firm’s data with another firm. We may disclose data when Indian law requires it.
7. Where data is stored
Fyliio’s database runs in Singapore (Amazon Web Services, ap-southeast-1) and document files are held by our file-storage provider, so data is stored outside India. Classification requests to our AI model provider are also processed outside India, and we send only what is needed to classify a file. Each provider and its role is listed in the Data policy.
8. How long we keep it
WhatsApp messages, the files clients send, and reminder records are deleted automatically 90 days after they arrive. The checklist status for each cycle (which items were received and when) stays while the firm’s workspace exists, so staff can show who sent what before a deadline. Earlier deletion is handled on request as described on the Data deletion page.
9. Your rights
Under the DPDP Act you can ask to access, correct, complete, update, or erase your personal data, ask how a grievance was handled, and nominate someone to act for you.
- Clients of a CA firm: contact the firm first, because the firm decides how your data is used. We help the firm respond.
- Staff and firm admins: contact us on the channels in section 1.
10. Security and breaches
Our controls are described on the Security page. If a personal data breach affects your data, we inform the affected firm and, where the law requires, the Data Protection Board of India.
11. Children
Fyliio is a business tool for CA firms and is not directed at children.
12. Cookies
We use essential cookies, and analytics cookies only if you accept them. See the Cookie policy.
13. Grievance Officer and complaints
If you have a complaint about Fyliio, including how we handle personal data, the content we process, or our services, contact our Grievance Officer:
- Grievance Officer: Abhishek Bharti, Proprietor, GENLUNO (operator of Fyliio)
- Email: support@fyliio.com (subject line: “Grievance”)
- Hours: Monday to Friday, 10:00–18:00 IST
What to include: your name, your firm’s name (if any), how to contact you, and a description of the issue with any reference numbers. We may need to verify your identity before acting on a request about personal data.
Our timelines:
- We acknowledge every grievance within 24 hours.
- We resolve it within 15 days of receipt. Where a law sets a shorter period for a particular kind of complaint, we follow that period.
These timelines meet the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (where applicable) and the one-month limit in Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. They are well within the 90-day limit for Data Principal grievances under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
Clients of a CA or accounting firm. For documents and messages your firm collects through Fyliio, your firm is the Data Fiduciary and decides how your data is used. Please raise data requests with your firm first. If you contact us, we pass the request to your firm within 2 business days and help it respond.
If you are not satisfied:
- Personal-data complaints: once you have used this grievance process, you may complain to the Data Protection Board of India under the DPDP Act, 2023.
- Complaints under the IT Rules, 2021, where those rules apply: you may appeal to the Grievance Appellate Committee within 30 days of our decision.
- Customers outside India may also have rights under their local data-protection law. We do not currently offer Fyliio to firms in the European Union, the European Economic Area or the United Kingdom.
14. Changes to this policy
We post material changes to this policy on this page and update the date above.