Privacy policy

Controller

CodeCubica sp. z o.o., ul. Długa 29, 00-238 Warszawa, Poland, publishes this website and operates Fynesia. Contact: hello@fynesia.com.

This policy covers the fynesia.com website and the Fynesia application: the web app, the desktop app and the companion app, together with every mailbox, calendar, document source and chat account you connect to them.

For the data your firm connects, your firm decides what is connected and why, and Fynesia processes it on its instructions under the agreement signed with it. For this website and for your user account, CodeCubica is the controller.

On this website

Only what you type into the pilot-request form: your name, work email, firm and, if you write one, your message.

Our server also records standard technical logs, including the IP address of the request, for security purposes.

This site uses Google Analytics to measure its audience, and only once you have accepted it: nothing is sent to Google before that, and you can withdraw at any time from the cookie settings in the footer. Your language choice is stored in your own browser and never leaves it.

Your Fynesia account

When your firm is onboarded we create an account with your name, work email and firm. Signing in is handled by Firebase Authentication, a Google service; Fynesia never stores your password.

We keep technical logs of the app’s use, including IP addresses and the actions taken, for security and to diagnose faults.

What you connect to the app

Fynesia works on what you connect: mailboxes (Outlook, Gmail, Yahoo and others over IMAP), calendars, document sources (Google Drive, OneDrive, Zoom), chat accounts (Telegram, WhatsApp) and the meetings you record with the companion app.

Only the folders or labels you tick are indexed; Spam and Trash never are. Messages, attachments, events, documents and transcripts are stored so that you can search them, so that the assistant can answer from them, and so that your contacts and deals can be built from them.

A new mailbox is never shared with your firm automatically. What you share is a window onto your mailbox, not a copy, and closing the connection closes the window.

Google user data

If you connect a Google account, Fynesia asks Google only for the permissions each feature needs, and you can refuse any of them. Here is what each one is used for.

Gmail (read, compose, send and manage your mail): to read the messages and attachments in the labels you chose to index; to keep read and unread marks in step between Gmail and Fynesia, which is why Google words the permission as managing your mail; and to send, as you, the messages you write or approve in Fynesia. Fynesia never deletes mail in your Gmail account, never changes the content of a message, and never sends anything without an action from you.

Google Calendar: to show your events and your availability, and to create or update the events you make in Fynesia. An event on a Google calendar gets its Google Meet link from Google itself.

Google Drive: to import the files you pick, and nothing else in your Drive. Google Meet: to create a meeting link for events on calendars that are not Google’s. Your Google email address and name: to show which account is connected.

Fynesia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: Google user data is used only to provide and improve the features you see in Fynesia. It is never used for advertising, never sold, never used to train general artificial-intelligence or machine-learning models, and never read by a person at Fynesia unless you ask us to for support, it is needed for security, or the law requires it. It is passed only to the processors listed below, to the extent each feature requires.

You can withdraw Google’s permission at any time from your Google account. Removing the account in Fynesia discards our copy of the token, so Fynesia stops reaching your Google data from that moment.

How the assistant uses AI

To answer your questions, summarise, draft, extract contacts and deals, and transcribe recordings, Fynesia sends the relevant text or audio to OpenAI’s API. OpenAI processes it as our processor, under its API terms, and does not use it to train its models.

A contractual commitment: your email, documents and recordings never train a model, ours or anyone else’s. Every answer cites the message or file it came from, and nothing is sent to anyone without you.

Why we use it

To provide Fynesia under the agreement with your firm, to answer a pilot request, to keep the service secure, and to meet our legal obligations.

Legal basis: performance of a contract, or of steps taken at your request before one; our legitimate interest in running and securing the service; and your consent where we ask for it, as with audience measurement on this website.

Who processes it

The Fynesia team, only when needed to support you or to keep the service running. We do not sell your data, and we do not use it for advertising.

OVHcloud hosts Fynesia and stores your data on servers in the European Union. OpenAI processes text and audio for the assistant and for transcription, and may do so outside the European Union under the European Commission’s standard contractual clauses. Google provides Firebase Authentication for sign-in and, on this website and only with your consent, Google Analytics.

Diagnostic traces of the assistant’s work are stored on our own servers in the European Union. They are read only to investigate a bug or a security problem, and are deleted with your data.

The services you connect, Microsoft, Google, Yahoo, Zoom, Telegram, Meta and your IMAP provider, receive only the requests needed to sync your data and to carry out the actions you take.

How long we keep it, and how to delete it

What you connect stays in Fynesia for as long as you keep it there. For a mailbox, Settings offers two choices: Remove mailbox, which stops the sync and discards the token but keeps the indexed emails searchable, and Remove mailbox and indexed emails, which deletes the messages, the threads and everything derived from them. Neither touches your mailbox at your provider. Disconnecting a calendar or a document source stops the sync and keeps what was already imported; documents and recordings can be deleted one by one.

There is no self-service account deletion yet. Write to hello@fynesia.com and we delete your account and everything held for it, Google user data and stored files included, within 30 days, and confirm once it is done. The same applies when your firm leaves, or when you leave your firm: your mailbox data stops syncing at once and is deleted on request.

Pilot requests made on this website are kept for up to 24 months after our last exchange. Technical logs are kept for a short period for operational and security purposes.

Security

Data is encrypted in transit and at rest. Outlook and Google connect by a token you can revoke; we never hold your password. IMAP passwords are stored encrypted and used only to reach your mailbox. Each firm’s data is isolated from every other firm’s, with role-based permissions inside your own.

Your rights

You may ask for access to your data, its correction or its deletion, object to its use, or ask for it in a portable format.

Write to hello@fynesia.com and we will answer within one month.

You also have the right to lodge a complaint with the Polish data protection authority (UODO).

Changes to this policy

When this policy changes, the new version is published here with its date. If a change affects how Google user data or your connected data is handled, your firm’s administrator is told before it takes effect.