Privacy policy

Last updated: 18 October 2026

PhygitAlm is run by DENOUER MMC PRIVATE LIMITED, Bengaluru, India ("we", "us"). This policy explains what personal data we collect when you use PhygitAlm at www.phygitalm.com and our apps, why we collect it, who we share it with, and the choices you have. If you have a question, email support@phygitalm.com.

1. Who this applies to

Customers and their team members - people who register a company on PhygitAlm or are invited to one.
Approvers - people who approve content by email link, including people outside the customer's company.
Contacts - people whose details a customer uploads or collects to run its campaigns (for example, someone who fills in a form on a PhygitAlm web page or receives a campaign email).
Visitors to our website.

2. What we collect

What	Examples	Where it comes from
Account details	name, work email, mobile number, company, role, password (stored only as a secure hash), two-factor settings	you
Billing details	company legal name, billing email and address, tax number, invoices; card or UPI details are handled by our payment provider - we never see or store card numbers	you
Content	campaigns, waves, posts, images, videos, emails, web pages, comments and approvals	you and your team
Connected accounts	for each LinkedIn, Facebook, Instagram or YouTube account you connect: the account or page name and ID, profile picture, the access token the platform gives us, and the results of posts we publish (reach, reactions, comments counts)	the platform, with your permission
Contacts	names, work emails, mobile numbers, company, job title and any other fields a customer imports or collects	our customer
Usage and device	log-ins, pages used, actions taken, IP address, browser and device, time zone	automatically
Support	tickets, messages and files you send us	you

3. Facebook and Instagram data

When you connect a Facebook Page or an Instagram business account, Facebook asks you to allow PhygitAlm to:

see the list of Pages you manage and the Instagram business account linked to each, so you can choose which one to use;
publish posts, images and videos to the Page or Instagram account you chose, only when a share you or your approvers approved is due;
read engagement on those posts (reach, reactions, comments counts) so we can show results in your campaign.

We use this data only to provide these features to you. We do not sell it, use it for advertising, build profiles of people from it, or share it with anyone except the service providers in section 7 who help us run PhygitAlm. You can remove our access at any time in PhygitAlm (Settings → Connectors → Disconnect) or in Facebook (Settings → Security and login → Business integrations). When you disconnect, we delete the stored access token immediately and the page details within 30 days. See www.phygitalm.com/data-deletion to delete everything.

4. YouTube and Google data

When you connect a YouTube channel, Google asks you to allow PhygitAlm to:

upload videos to the channel you choose - only a video wave that you or your approvers approved, with the title, description and visibility (Public or Unlisted) shown in PhygitAlm, at the time you set;
see that channel and its videos - the channel's name, picture and subscriber count, and the number of views, likes and comments on the videos PhygitAlm uploaded, so we can show results in your campaign.

We don't read your other videos, the text of comments, your watch history, your Google profile, contacts, Gmail or Drive, and we never post anything you did not approve.

PhygitAlm uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google's use of data is covered by the Google Privacy Policy (https://policies.google.com/privacy).

Limited Use. PhygitAlm's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular, we use this data only to provide the features above to you. We don't sell it, use it for advertising, use it to build profiles of people, use it to train AI models, or let anyone read it except as needed to run these features, for security, to comply with the law, or with your consent.

You can remove PhygitAlm's access at any time. In PhygitAlm, go to Settings → Connectors → Disconnect on the channel: we revoke our access at Google and delete the stored token immediately. At Google, go to https://myaccount.google.com/permissions and remove PhygitAlm. The channel's details we kept (name, picture and the numbers of our own uploads) are deleted within 30 days of disconnecting, or straight away on request (see www.phygitalm.com/data-deletion).

5. Why we use your data

To provide PhygitAlm: create and run campaigns, publish and schedule content, send emails, run approvals and show results.
To keep accounts secure: two-factor sign-in, checking mobile numbers by text code, detecting abuse.
To bill you and keep records the law requires.
To support you and tell you about changes to the service.
To improve PhygitAlm, using aggregated usage information.

We use AI to draft and change content when you ask it to. Your content is sent to our AI provider only to produce that result; it is not used to train their models.

6. Legal basis

We process personal data to perform our contract with our customer, to meet legal obligations (for example tax records), with consent where the law requires it (for example connecting a social account), and for our legitimate interest in keeping PhygitAlm safe and working. For contacts, our customer decides why their data is used; we process it on the customer's instructions.

Service providers that host and run PhygitAlm for us - cloud hosting and storage, email and text-message delivery, payments, AI content generation, social account connections, calling, error monitoring - under contracts that limit their use to providing their service to us.
Automated voice calls - when we make automated voice calls for a customer, our voice service provider (Bolna) records the call and writes down what was said. We keep the transcript and the call's results with the customer's campaign; the recording is kept by the provider until 30 days after the campaign's calls end, then deleted.
The platforms you connect - for example Facebook, Instagram, LinkedIn or YouTube receive the content you choose to publish.
Google / YouTube receive the videos, titles and descriptions you choose to publish to your channel.
Authorities when the law requires it.

We do not sell personal data.

8. Where it is stored

Our data is stored in India. Some service providers may process data in other countries; when they do, we use contracts that protect it to the standard Indian law requires.

9. How long we keep it

Account and content data: while the customer's plan is active. When a plan ends and isn't renewed, the data is removed from PhygitAlm and a backup is kept for 90 days so it can be restored; then it is deleted.
Access tokens for connected accounts: until you disconnect, the plan ends, or the platform revokes them.
Invoices and tax records: as long as Indian law requires (currently 8 years).
Logs: up to one year.

10. Your rights

You can ask to see, correct or delete your personal data, or to withdraw consent, by emailing support@phygitalm.com or from Need support? in the app. Contacts of our customers can ask the customer directly or write to us and we will pass the request on. We answer within 30 days. Under India's Digital Personal Data Protection Act 2023 you can also complain to the Data Protection Board of India.

11. Security

We use encryption in transit and at rest, two-factor sign-in, role-based access, and keep secrets in a protected key store. Only people who need access to do their job have it.

12. Cookies

We use only cookies that PhygitAlm needs to work. We use no advertising cookies and no third-party tracking or analytics cookies, so there is nothing to switch on or off.

Signing in: keeps you signed in (ends after 14 days without use) and remembers a trusted browser for two-factor sign-in for 30 days if you choose it.
Security: protects forms against forged requests, and remembers your progress for up to an hour while you register.
Landing pages: one first-party cookie counts visits to a customer's landing page, so the customer sees how many people visited and from which campaign. It is not shared with anyone else and is not used to follow you to other sites.

You can delete cookies in your browser at any time; you will then need to sign in again.

Visits to our own website. On the public pages of www.phygitalm.com (not inside the app, and not on our customers' landing pages) we count visits with Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and does not follow you to other sites; it records the page, where you came from, your country and the type of device, and only as totals.

13. Children

PhygitAlm is for businesses and is not meant for anyone under 18.

14. Changes

We will post changes here and, if they are significant, tell customers by email or in the app before they take effect.

15. Contact

DENOUER MMC PRIVATE LIMITED · Bengaluru, India · support@phygitalm.com