Privacy Policy.

heybuffy.com (“Buffy”, “we”, “us”, “our”) is operated by Flashmonk Private Limited, a company incorporated under the laws of India. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it when you use any of our three products:

Buffy Search — an AI-powered conversational search engine for end users at heybuffy.com. Buffy Pulse — a brand LLM-visibility and ranking analytics platform for businesses. AskBuffy.ai — an agentic AI chatbot that brands embed within their own platforms for their customers.

This policy applies wherever you are in the world. We process personal data in line with India’s Digital Personal Data Protection Act 2023 (DPDPA) and, where applicable to your region, the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and equivalent legislation.

Please read this policy before using our services. Continued use constitutes acknowledgement of the practices described here.

2.1 Information you give us.

Account information: name, work email address, organisation name, role.

Brand and project setup: brand URL, brand name and aliases, declared competitors, products, target markets, and any other content you enter when configuring Buffy Pulse or an AskBuffy.ai deployment.

Billing information: legal entity name, billing address, GSTIN where applicable, and billing identifiers returned by our payment processor. We do not store full card or bank-account details on our own systems.

Communications: the content of emails, support tickets, demo requests, and feedback you send us.

2.2 Information collected automatically.

Usage data: pages and features accessed, dashboard interactions, search queries entered into Buffy Search, session identifiers, timestamps, and error logs.

Device and technical data: browser type and version, operating system, IP address, language settings, referring URLs.

Cookies and similar technologies: see Section 9.

2.3 Data processed on behalf of Brands (AskBuffy.ai).

When a Brand deploys AskBuffy.ai on their platform, that Brand is the Data Controller for their customers’ interactions. Flashmonk acts as the Data Processor and processes end-user conversation data solely in accordance with the Brand’s instructions and a Data Processing Agreement (DPA). If you are an end user of a Brand’s AskBuffy.ai chatbot, please refer to that Brand’s privacy notice.

2.4 What we do not collect.

Special categories of sensitive personal data unless you voluntarily include it; Full payment card or bank-account numbers; Personal data from children under 13.

We use the information we collect: To provide the service; To operate accounts; To improve the service (aggregated/de-identified where possible); To personalise your experience; For safety and integrity; To comply with law.

For users in the EEA or UK, the lawful bases we rely on are performance of a contract (operating the service and billing), legitimate interests (security, analytics, product improvement), legal obligation (tax and regulatory compliance), and consent (optional marketing communications and non-essential cookies).

We do not sell your data. We share information only with: AI model providers (queries to third-party LLM APIs; no account/billing details); Cloud and infrastructure providers; Analytics tooling (processor); Payment processor; Brands (AskBuffy.ai); Professional advisors; Legal and safety.

Corporate transactions: in connection with a merger, acquisition, or sale of assets, we will notify you at least 30 days before a transfer.

We are headquartered in India; your data may be processed in India and any country where our infrastructure or sub-processors operate. Transfers from the EEA/UK rely on Standard Contractual Clauses (SCCs) or the UK IDTA. For Indian residents, cross-border transfers comply with the DPDPA 2023.

Account and profile data: while active + up to 90 days after closure.

Buffy Search query data: up to 13 months rolling, then anonymised.

Buffy Pulse brand data: while subscription active; deleted within 90 days of termination unless export requested.

AskBuffy.ai conversation data: per DPA; default 90 days.

Billing and tax records: as required by law (India: 8 years from end of relevant financial year).

Support and email correspondence: up to 3 years from last contact.

Security and audit logs: up to 12 months.

Depending on where you live, you may have the right to: Access, Correction, Erasure, Portability, Restriction, Object, Withdraw consent, and Complain.

California (CCPA/CPRA): right to know, opt out of sharing, and non-discrimination (we do not sell).

Indian residents (DPDPA): right to nominate.

To exercise any of these rights, email [email protected]. We will verify your identity before responding and aim to respond within the timelines required by applicable law (generally 30 days).

We maintain safeguards including role-based access controls and org-scoped isolation; least-privilege personnel access with audit logging; MFA for admin/infra; regular security assessments, dependency patching, and vulnerability scanning; and breach detection and response including notification within 72 hours where required.

If you believe your account has been compromised, please contact us immediately at [email protected].

We use the following categories of cookies: Strictly necessary; Performance and analytics; Functional.

We do not use third-party advertising or tracking cookies on heybuffy.com or any of our product domains.

We show a cookie banner on first visit; you can change preferences via Cookie Settings in the footer; and we honour DNT for analytics cookies.

Buffy Search: queries are sent to LLM APIs in real time; retained up to 13 months then anonymised; not used to train third-party LLMs without explicit consent.

Buffy Pulse: insights are derived from analysis of LLM outputs and public sources; no personal data of brand customers.

AskBuffy.ai: we act as Data Processor; conversation data is not used for our own product development without the Brand’s written consent.

Important: AI-generated outputs can contain errors or inaccuracies (commonly known as “hallucinations”). We do not warrant the accuracy or completeness of AI-generated content.

Our services are intended for adults and businesses. They are not for under 13s. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it promptly.

Brands deploying AskBuffy.ai for minors are responsible for compliance with COPPA and equivalent laws.

For material changes, we will notify registered users by email or in-product notice at least 14 days before they take effect. Minor changes are effective when posted. The “Last updated” date reflects the latest revision.

Email: [email protected]. Postal: Flashmonk Private Limited, 5th Floor, North Wing, Vaishnavi Tech Park, Sarjapur Main Road, Bellandur, Bengaluru, Karnataka 560103.

Grievance Officer (India / DPDP Act): Sugath Surendran — [email protected]. Grievances are acknowledged within 48 hours and resolved within 30 days.

© 2025 Flashmonk Private Limited. All rights reserved.