Privacy Policy

Buckhy is operated by Zettaura Innovations Private Limited (“Zettaura”, “we”, “us”), 4, Bharat Naagr, Coimbatore, Tamil Nadu, India – 641015. This policy applies to Buckhy Chat (app.buckhy.com), Buckhy Mail (mail.buckhy.com), the Buckhy developer platform (developers.buckhy.com) and our related websites — together, the “Services”.

Your Buckhy account is a Zettaura account and may be shared across Zettaura products you choose to use. Questions about this policy go to support@buckhy.com.

• Account information. Name, email address, phone number used for sign-in codes, organisation details, passkey public keys and security settings.
• Connected mailbox data. When you connect Google Workspace or Gmail, Microsoft 365 or Outlook, or another IMAP/SMTP provider, we store the access tokens or app password you provide (encrypted) and process the messages, attachments, folders, labels and contacts needed to display, monitor, triage and draft mail for you.
• Hosted domain data. Domain names, the DNS records we prepare for you (MX, SPF, DKIM, DMARC), the scoped DNS tokens or hosted-zone authorisations you grant, and mail sent and received through Buckhy-hosted addresses.
• AI interaction data. Your prompts, Buckhy’s replies and generated files are stored in your shared Buckhy conversation. Saved memories follow your account’s memory preferences. Separate action audit records contain operational metadata and outcomes, not copies of email bodies.
• Billing data. Plan, invoices and payment status. Card details are collected and processed by our payment provider and never stored by us.
• Usage and device data. IP address, browser and device type, approximate location, the pages and actions you use, diagnostics, and aggregate analytics (see “Cookies and analytics”).
• Support data. Messages and attachments you send to our support team.

• To provide, operate and secure the Services, including delivering, storing and displaying your mail.
• To carry out the instructions you give Buckhy — every draft and action stays approval-first unless you have explicitly configured an automation.
• To protect you and the platform: fraud and abuse prevention, step-up verification for sensitive changes, and audit logging.
• To bill you, issue invoices and comply with tax and accounting law.
• To provide support and communicate service notices. Marketing messages are sent only where you have opted in.
• To understand usage in aggregate and improve the Services.
• To comply with legal obligations and enforce our terms.

Buckhy’s AI features — monitoring, triage and drafting — are built so that your mail stays yours. The following safeguards apply whenever content is processed by AI:

• Feature-specific processing. Content is processed only for the Mail features you use. Background AI organization is optional: enabling it processes readable mail folders to derive categories, contacts, files, subscription details and supported reminders using part of your shared Buckhy allowance. Spam, Trash and Drafts are excluded. Existing categories remain available while processing is paused. Legacy settings without the current account's consent remain paused until you enable organization. You can pause processing or clear derived data in Smart mail preferences; emailed reminders remain optional.
• Minimum necessary. Only the messages, threads or fields needed for that action are sent to the model.
• Enterprise model hosting. Models run on Microsoft Azure OpenAI Service under enterprise terms: your content is used only to generate the response you requested, is encrypted in transit, and is not used to train or improve the providers’ models.
• Injection screening. Before a model reads an email, Azure AI Content Safety checks it for hidden instructions aimed at AI. Flagged emails are kept from the model, and Buckhy makes no changes in a chat turn that read them.
• Approval-first. In Mail chat, sending, scheduling, destructive changes, mailbox creation and changes to signatures or smart-workspace settings require an explicit review and confirmation. Routine navigation, drafting and organisation can happen visibly when requested, within the mailbox permissions you configured. An uncertain send is not automatically repeated.
• Audited. Mail action acknowledgements and outcomes are recorded separately from conversation content. Short-lived execution receipts expire; operational audit records contain metadata rather than email bodies.
• Shared conversation and memory controls. Mail chat uses your Buckhy account's conversation storage and memory preferences. Its workspace-scoped Mail history supports reopening and managing saved conversations; opening history does not replay completed mail actions. Authorized searches can read selected emails and accessible Buckhy conversation excerpts; this is not an automatic analysis of every message in your account.
• Never for advertising. Your content is never used to build advertising profiles or sold to anyone.

The Buckhy Setup Companion connects only the DNS settings tab you explicitly select. It checks that page for the approved domain and uses visible control labels and the current setup step to guide ownership verification and hosted email setup. You remain responsible for clicking, editing and saving records at your provider. Mail-routing and domain-policy changes require an explicit cutover review and step-up approval in Buckhy.

• When you ask a setup question, Buckhy receives that question, the selected server-approved DNS record, the current step, relevant mailbox and routing metadata, and a limited list of DNS control labels. These are processed by the AI providers described above. The companion does not send full-page screenshots, browser history, cookies, passwords, one-time codes or unrelated input values.
• Complete sign-in, MFA and passkey prompts privately before connecting the tab. Detected authentication pages stop observation. Pause, manual control and disconnect are available during setup; guidance never submits DNS changes automatically.
• The companion keeps temporary setup details in browser session storage. Disconnecting, closing the connected setup tab, or restarting the browser clears the session. Setup questions and answers are not stored in the domain activity audit; record checks, preparation, cutover approval and activation outcomes are recorded without page content or DNS values. The approved DNS snapshot is retained with the domain to detect stale or changed cutover plans.
• Do not enter passwords, recovery codes, API keys or other credentials into setup chat. The companion has no permission to read your browser's stored passwords or passkeys.

Buckhy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Gmail data only to provide and improve the user-facing features you see in Buckhy: displaying, monitoring, triaging and drafting mail, sending on your approval, and copying or exporting your mail when you ask.
• We do not transfer Gmail data to third parties except to provide those features (for example, to the AI processors named above), to comply with law, or as part of a merger or acquisition with notice to you.
• Humans at Zettaura do not read your Gmail data unless you ask us to for support, it is necessary for security or to comply with law, or the data has been aggregated and anonymised.
• We never use Gmail data for advertising, or to determine credit-worthiness or for lending purposes.
• Microsoft 365 and Outlook data is handled under the same rules, using only the permissions you grant (reading and writing mail, sending on your behalf, and your basic profile).

You can disconnect a mailbox in Buckhy at any time; its tokens are deleted and, for a Google account, Buckhy also revokes its access at Google unless that account is still connected elsewhere in Buckhy. You can also revoke Buckhy’s access from your Google Account permissions or your Microsoft account security settings.

• Service providers. Vetted companies that host, process or deliver the Services on our behalf, listed on our sub-processors page. They are bound by contract to process data only on our instructions.
• Recipients of your mail. When you send mail, recipients and their providers receive it — this is inherent to email.
• Your organisation. If your account belongs to a workspace administered by your organisation, its administrators may see account and usage information.
• Legal and safety. When required by law, or to protect the rights, safety and security of Buckhy, our users or the public.
• Business transfers. In a merger, acquisition or asset sale, with notice to you and under this policy’s protections.

We do not sell personal data.

• Account and workspace data is kept while your account is active.
• When you disconnect a mailbox or delete your account, the associated mail content, credentials and tokens are deleted from our active systems within 90 days.
• Disconnecting a mailbox stops new access and pending scheduled sends. Content you already discussed in a shared Buckhy conversation, and memories saved from your instructions, remain under the separate conversation and memory controls until you delete them or your account. Scheduled messages store the approved content needed to send later; schedule records expire after their retention period.
• Security and audit logs are retained for 90 days after the related account is closed.
• Invoices and payment records are retained for as long as tax and accounting law requires.

• Encryption in transit (TLS) for all connections, and encryption at rest for stored data.
• Mailbox credentials and tokens are encrypted with keys managed in a dedicated key-management service.
• Hosted domains are configured through scoped DNS tokens or authorised hosted zones — never your registrar password.
• Passkeys and one-time codes for sign-in; step-up verification for sensitive changes.
• Audit logging of account, mailbox and AI actions; least-privilege access controls; monitoring and an incident-response process.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately.

Buckhy is operated from India. Our infrastructure runs on Amazon Web Services and Microsoft Azure, primarily in the United States, and our service providers may process data in other countries. Transfers are protected by contractual safeguards, encryption and access controls.

• Access, correct or export your data from your account settings, or by contacting us.
• Disconnect a mailbox or delete your account at any time; deletion follows the retention periods above.
• Withdraw consent for optional processing, such as analytics cookies in regions where consent is required.
• Under India’s Digital Personal Data Protection Act, 2023, you may request access, correction and erasure of your personal data and raise concerns with us.
• If you are in the EEA, the UK or Switzerland you additionally have rights to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority.

To exercise any right, write to support@buckhy.com. We respond within the timelines the applicable law sets.

• Essential. A secure session cookie keeps you signed in, and browser storage remembers your theme and that you have a session.
• Analytics. We use Google Analytics 4 to understand how our websites are used in aggregate (pages viewed, referring sources, device type). Google does not store your IP address, advertising features are disabled, and visitors from the EEA, the UK and Switzerland receive no analytics cookie without consent.
• Usability analytics. We use Microsoft Clarity to understand how the interface is used (clicks, scrolling, navigation) through heatmaps and masked session replays. Your mail content, addresses and other text are masked before capture and never leave your browser through Clarity; it sets no advertising cookies and honours the same regional consent rules as Google Analytics.
• No advertising cookies. Buckhy sets no advertising or cross-site tracking cookies.

You can allow or decline analytics for this browser at any time here; the choice is stored on this device only.

Buckhy is a business tool and is not directed to children under 18. We do not knowingly collect personal data from them.

Each version of this policy carries a version number and effective date. If we make material changes we will notify you by email or in the product before they take effect. Continued use of the Services after the effective date means the updated policy applies.

Zettaura Innovations Private Limited, 4, Bharat Naagr, Coimbatore, Tamil Nadu, India – 641015. Privacy and support: support@buckhy.com. Company enquiries: contact@zettaura.com.