Skip to main content
FixedAsset Pro

Privacy Policy

Version 1.0Last updated October 29, 2026

This version is pending our legal review. If you have a question about it, write to support@globalsynapsetech.com.

1. Who we are and what this policy covers

FixedAsset Pro is provided by Global Synapse Technologies ("we", "us", "our"). This Privacy Policy explains how we handle personal data when you:

  • visit this website, send us a contact, demo or sales enquiry, or download our software;
  • sign up for FixedAsset Pro and create or administer an organisation account;
  • use the cloud web application, the mobile app connected to it, or our support services;
  • buy a subscription and pay our invoices.

For this personal data we decide why and how it is processed, so we act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

What this policy does not cover. The asset registers, documents, employee and vendor details and other business records that our customers enter into the cloud service ("Customer Data") are processed by us on behalf of the customer organisation, which is the Data Fiduciary for that data. We handle it only on the customer's instructions under our Data Processing Agreement. If you are an employee, custodian or vendor of one of our customers and have a question about your data in their FixedAsset Pro workspace, please contact that organisation first; we will help them respond.

Desktop edition. The FixedAsset Pro desktop edition is installed on the customer's own computer or local network server. Data entered into it stays on that customer's systems and is under the customer's control. We do not receive it, unless the customer chooses to send us information, for example with a support request.

2. Personal data we collect

2.1 Website visitors and enquiries

  • Enquiry forms (contact, "Book a demo", "Contact Sales Team"): your name, business e-mail address, and optionally your phone number, organisation, country, company size, use case, the products or asset volumes you are interested in, and your message.
  • Context sent with an enquiry: the language of the page, the page from which you sent it, the referring page and campaign tags in the link (UTM parameters), your IP address and your browser's user-agent string. We use these to answer you in the right language, to understand which pages are useful and to protect the forms from abuse.
  • Browser storage: see section 8 on cookies.

2.2 Signup and account

  • Signup: your full name, e-mail address, a password (stored only as a salted hash), a one-time e-mail verification code (stored only as a hash), the details of the organisation you create (name, country, language, financial-year preferences, first company) and the plan or trial you choose.
  • Acceptance records: the version and fingerprint of the Terms of Service and Privacy Policy you accepted, the time of acceptance, your e-mail address, IP address and user-agent, so that we can show what was agreed.
  • Account profile: name, username, e-mail address, optional profile picture, language and display preferences, the roles and companies assigned to you by your administrator.
  • Authentication data: your password hash, multi-factor authentication settings (authenticator-app secret, hashed recovery codes, e-mail one-time codes), and, where your organisation uses single sign-on, the identifier provided by your organisation's directory or identity provider.

2.3 Usage, security and audit data

  • Sign-in and session records: successful and failed sign-ins, multi-factor checks, blocked attempts, the IP address and device or browser used, and your active sessions.
  • Audit trail: when you create or change a record in the cloud service, the audit log records who made the change, when, the old and new values and the reason given. The audit log is sealed in a hash chain to make it tamper-evident and cannot be switched off. It belongs to your organisation's workspace.
  • AI activity log: if you use the AI assistant or document extraction, your question, the answer, the engine used and related checks are recorded in a hash-chained activity log of your organisation.
  • Technical logs: server and error logs needed to operate, secure and troubleshoot the service.

2.4 Billing and payments

  • The billing contact's name and e-mail address, the organisation's legal name, billing address, tax registration number (such as GSTIN) and the invoices we issue.
  • Payment records: amount, currency, date, status, the payment provider's reference and, for failures, the reason reported by the provider.
  • We do not receive or store card numbers, card security codes, net-banking credentials or UPI PINs. Online payments are made on a page hosted by the payment provider.

2.5 Support

  • The content of support tickets and e-mails you send us, including any attachments.
  • When our support staff access your organisation's workspace to help you, a record of the support session: who opened it, the ticket and reason, its duration and mode, and every action performed during it. This record is also shown in your organisation's own audit trail.

2.6 Downloads

  • When a signed-in user requests a download link for an installer, we record the request in the organisation's audit trail. Public downloads are rate-limited by IP address to prevent abuse.

3. How we use personal data

We use personal data only for the following purposes:

  1. To answer enquiries and arrange demonstrations you request.
  2. To create and run your account, verify your e-mail address, authenticate you and keep your sessions secure.
  3. To provide the service your organisation subscribed to, including notifications and e-mails it sends (for example password resets, approval requests, reminders and reports).
  4. To bill and collect payment, issue tax invoices, send renewal and payment reminders, and keep accounting records.
  5. To provide support, including support sessions you or your organisation request.
  6. To protect the service and our customers, for example by rate-limiting, detecting abuse of signup and enquiry forms, investigating security incidents and enforcing our Terms.
  7. To comply with law, including tax, accounting and information-security obligations, and to respond to lawful requests from authorities.
  8. To improve the service, using aggregated information that does not identify you.
  9. To tell you about changes to the service, these policies or your subscription. We send marketing messages only where you have agreed or where the law otherwise allows, and every such message lets you opt out.

We do not sell personal data. We do not use personal data or Customer Data to train language models.

4. Grounds for processing

Under the DPDP Act we process personal data:

  • on the basis of your consent, given for example when you send an enquiry form, sign up, accept the Terms or allow usage analytics on this website; and
  • for certain legitimate uses permitted by section 7 of the DPDP Act, for example where you have voluntarily provided data for a specified purpose (such as an enquiry or a support request) and have not said that you do not consent, or where processing is necessary to comply with law or a court order.

Where your organisation creates your account, it provides your data to us and is responsible for informing you.

You may withdraw consent at any time by writing to support@globalsynapsetech.com or, for website analytics, through the cookie preferences page. Withdrawal does not affect processing already carried out, and we may not be able to continue providing a service that depends on that data.

5. Who we share personal data with

We share personal data only as needed for the purposes above, with:

  • Infrastructure and hosting providers who host the servers, databases, file storage and backups of the cloud service.
  • E-mail delivery providers through which the service sends e-mails such as verification codes, notifications and invoices.
  • Payment service providers that process online payments on their own hosted pages. The service is built to work with Razorpay and Stripe; the provider offered for a payment is shown on the payment page. Bank transfers are processed by the banks involved.
  • Professional advisers such as auditors, chartered accountants and lawyers, under a duty of confidentiality.
  • Authorities, courts and regulators where required by law, or to protect the rights, property or safety of our customers, users or us.
  • A successor business in the event of a merger, acquisition or sale of all or part of our business, subject to this policy.

Service providers act on our instructions and are bound by contract to protect the data. Our current list of service providers is available on request.

Integrations chosen by your organisation. If your organisation's administrator connects the service to another system (for example an ERP, a directory or single sign-on provider) or enables a third-party cloud AI provider, the relevant data is sent to that system on your organisation's instructions and under its agreement with that provider. Cloud AI is off unless an administrator enables it and confirms a warning; sending document text to a cloud AI provider needs a second confirmation.

6. How long we keep personal data

We keep personal data only for as long as needed for the purposes for which it was collected, and then delete or anonymise it, unless the law requires us to keep it longer. In particular:

  • Enquiries are kept while we deal with your request and for a reasonable period afterwards for follow-up. You can ask us to erase an enquiry at any time.
  • Account data is kept while your organisation's account is active, and deleted with your organisation's workspace after the end of the subscription, as described in our Terms of Service.
  • Audit logs form part of your organisation's records and are kept for as long as the organisation's workspace exists.
  • AI activity logs are kept for the period configured by your organisation; the default is 365 days, after which they are purged automatically.
  • Invoices, payment and tax records are kept for the period required by tax and accounting laws.
  • Acceptance records of our Terms and policies are kept for as long as they may be needed to establish what was agreed.
  • Security logs are kept for the period required by applicable law and our security needs.
  • Backups are encrypted and overwritten on a rolling schedule; deleted data disappears from backups when those backups expire.

7. How we protect personal data

The safeguards built into FixedAsset Pro include:

  • encrypted connections (HTTPS/TLS) between your browser or app and the service;
  • passwords stored only as salted scrypt hashes, never in readable form;
  • multi-factor authentication, password policy and account lockout, and optional single sign-on;
  • role-based access scoped by organisation, company and branch, so users see only what they are permitted to see;
  • a tamper-evident, hash-chained audit log of changes, sealed at regular intervals and verified daily;
  • encrypted backups (AES-256-GCM) with restore testing;
  • strictly controlled support access: time-limited, read-only by default, a second approval for any session that can make changes, no data exports, every action recorded and visible to your organisation;
  • secrets such as passwords, codes and API keys excluded from logs.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will act in accordance with section 10.

8. Cookies and browser storage on this website

This website stores only the following in your browser:

  • fam_locale (cookie): remembers the language you chose. Set only when you pick a language.
  • fam.consent (browser storage): remembers whether you allowed usage analytics.
  • fam.motion (browser storage): remembers your motion preference from the footer.

No analytics provider is connected to this website today. If you allow analytics, clicks on calls to action and downloads are recorded by the website's own event hook only, and nothing is sent to a third party. If a provider is added in future, the cookie preferences page and the consent banner will say so before it is loaded. You can change your choice at any time on that page.

The customer workspace uses the cookies and storage that are strictly necessary to keep you signed in and secure.

9. Your rights

Under the DPDP Act you have the right to:

  1. obtain information about the personal data we process about you and the processing activities, and the identities of the other Data Fiduciaries and Data Processors with whom it has been shared;
  2. correction, completion and updating of inaccurate or incomplete personal data;
  3. erasure of personal data that is no longer necessary for the purpose for which it was processed, unless we must retain it by law;
  4. withdraw consent that you have given;
  5. grievance redressal through our Grievance Officer;
  6. nominate another person to exercise your rights in the event of your death or incapacity.

Many of these can be exercised directly in the product: you can update your profile and preferences, and your organisation's administrators can correct or deactivate user accounts. For anything else, write to support@globalsynapsetech.com. We may need to verify your identity before acting on a request, and we will respond within the time required by law.

If other data protection laws apply to you (for example, the EU or UK General Data Protection Regulation), you may also have rights such as objecting to or restricting processing and data portability, and the right to complain to your local supervisory authority. Contact us and we will handle your request in accordance with the law that applies.

You also have duties under the DPDP Act, including not to impersonate another person and not to file false or frivolous complaints.

10. Personal data breaches

If a personal data breach affects personal data for which we are the Data Fiduciary, we will notify the Data Protection Board of India and each affected person as required by the DPDP Act and the rules made under it, describing the breach, its likely consequences, the measures taken and what you can do to protect yourself. For breaches affecting Customer Data, we notify the customer organisation as set out in the Data Processing Agreement.

11. Transfers outside India

Our service providers may process personal data in India or in other countries. We transfer personal data outside India only as permitted under the DPDP Act, and not to any country or territory to which the Central Government has restricted transfers. Information about where the cloud service and its backups are hosted is available on request.

12. Children

Our website and services are intended for businesses and are not directed at children. We do not knowingly process personal data of anyone under 18 years of age. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy to reflect changes in our services or in the law. Each version is numbered and dated on this page. If we make a material change, we will notify account administrators by e-mail or in the customer workspace before it takes effect.

14. Contact and grievance redressal

For any question, request or complaint about personal data, contact us at:

Our Grievance Officer can be reached at support@globalsynapsetech.com; please write "Grievance" in the subject line. We will acknowledge your grievance and respond within the period prescribed under the DPDP Act and the rules made under it.

If you are not satisfied with our response, you may complain to the Data Protection Board of India after exhausting this grievance redressal process.