Privacy policy

This Privacy Policy explains how Phyto Nex LLP, a limited liability partnership registered in India under the Limited Liability Partnership Act, 2008 with its registered office at 1209 Orange Street, Wilmington, DE 19801 and its principal place of business at 312, Thiruvalluvar Street, Vellakinar Pirivu, Gnanambika Mills, Coimbatore North, Coimbatore, Tamil Nadu 641029, India ("Phyto Nex AI", "we", "us" or "our"), collects, uses, discloses and protects personal data. It applies to our website at phytonexai.com, the Phyto Nex AI web application, our connectors to expense and ERP platforms, the messages our software prepares for delivery through Slack, Microsoft Teams and email, and our sales, support and marketing activities.

Phyto Nex AI is business software. We sell to companies (our "customers"), and our customers use Phyto Nex AI to audit the expense reports their employees and contractors submit. Because of that, we play two different roles depending on the data involved, and this policy describes both.

When we act as a controller

We decide why and how personal data is processed for our own business purposes: running our website, managing customer accounts and billing, responding to sales and support enquiries, sending product and marketing communications, and securing our services. For this data, Phyto Nex LLP is the controller (or "business" under California law, and "data fiduciary" under India's Digital Personal Data Protection Act, 2023).

When we act as a processor

When a customer connects Phyto Nex AI to its expense platform, the expense reports, receipt images, card transaction records and related employee information we receive are processed on that customer's behalf and under its documented instructions. For this "Customer Data", the customer (usually the employer) is the controller and Phyto Nex AI is a processor, service provider or data processor. Our handling of Customer Data is governed by our agreement with that customer, including the Data Processing Addendum available at /legal/dpa. If you are an employee of one of our customers, section 5 of this policy was written for you.

This policy took effect on January 15, 2026 and was last updated on September 1, 2026. Questions can be sent to privacy@phytonexai.com at any time.

The categories below describe everything we collect. We do not buy personal data from data brokers, and we do not combine Customer Data with data from other customers or from third-party enrichment services.

Account and contact data (controller)

• Name, business email address, job title, company name, phone number and country of the people who sign up for a trial, administer a workspace or contact us.
• Login credentials (stored as salted hashes) or single sign-on identifiers from your identity provider, multi-factor authentication enrolment status and workspace role (administrator, AP reviewer, approver, read-only auditor).
• Billing contact details, billing address, tax identifiers such as a GSTIN or VAT number, and invoice history. Payment card details for subscription billing are collected and stored by Stripe, Inc.; we see only the card brand, last four digits and expiry month.

Employee expense data processed on behalf of customers (processor)

• Expense report metadata pulled through read-only connectors: submitter name, employee ID, email address, department, cost centre, manager, report ID, submission and approval timestamps, expense category, amount, currency, merchant and business purpose text.
• Line items extracted from receipts and folios: room rate, taxes, resort fees, minibar, room service, in-room entertainment, alcohol, tips, parking, mileage and similar charge lines.
• Policy evaluation results generated by Phyto Nex AI: which rule was triggered, the amount at issue, duplicate match scores and reviewer decisions.
• Message drafts, the AP reviewer's edits and approval, and the employee's reply or corrected submission returned through Slack, Microsoft Teams or email.

Receipt images

Receipts, hotel folios, itemized restaurant checks, ride and airline receipts and mileage logs are imported as image or PDF files from the customer's expense platform. These files can incidentally contain information beyond the expense itself, such as the names of dining companions, loyalty program numbers or a partial home address on a fuel receipt. We process this information only as part of the receipt and do not extract it into separate fields unless the customer's policy rules require it (for example, attendee names for client entertainment).

Card transaction data and PAN masking

Where a customer connects a corporate card feed through Ramp, Brex, SAP Concur or Navan, we receive transaction records. Primary account numbers (PANs) are truncated to the last four digits at the point of ingestion, before anything is written to storage. Phyto Nex AI never stores, logs or displays a full card number, card verification code or PIN, and our systems are designed so that a full PAN cannot reach persistent storage even if a source platform sends one.

Website, device and cookie data

When you visit our website we collect IP address, browser type, operating system, referring URL, pages viewed, approximate location derived from IP address (city level) and interaction events. Some of this is collected through cookies and similar technologies, as described in our Cookie Policy at /legal/cookies. Inside the web application we record security logs (sign-in events, IP address, user agent, administrative changes) to protect your workspace.

Communications

If you email us, open a support ticket, attend a webinar, request the free 50-receipt audit or speak with our sales team, we keep the content of those communications, call notes and any files you send, along with your stated preferences for future contact.

We use personal data for the purposes listed below and for no other purpose without first telling you or, where required, asking for your consent.

• Providing the service: connecting to expense and ERP platforms, extracting line items from receipts, evaluating them against the customer's configured policy, detecting duplicates and split transactions, and preparing pushback drafts for human review.
• Account administration: creating workspaces, authenticating users, enforcing role-based permissions, billing, collecting payment and issuing GST or VAT invoices.
• Support and success: answering questions, troubleshooting connector errors and helping administrators tune policy rules.
• Security and integrity: detecting abuse, preventing unauthorized access, investigating incidents and keeping audit trails that customers rely on for their own compliance.
• Improving the service: measuring aggregate performance (for example OCR field accuracy and false-positive rates per rule) using de-identified, aggregated statistics. We do not use Customer Data to train foundation models or any model offered to other customers.
• Marketing to business contacts: sending newsletters such as The Spend Controller, webinar invitations and product announcements, subject to your preferences and applicable consent rules.
• Legal compliance: meeting tax, accounting, export control and record-keeping obligations, responding to lawful requests and enforcing our agreements.

Customer Data is used only to provide the service to the customer that supplied it, as instructed by that customer.

Where the EU General Data Protection Regulation or the UK GDPR applies to processing for which we are the controller, we rely on the following legal bases under Article 6(1):

Where we rely on legitimate interests, we have balanced those interests against your rights and concluded that the processing is expected, proportionate and does not override your interests. You may request a copy of that assessment by writing to us.

For Customer Data, the customer as controller is responsible for establishing a legal basis. Most of our customers rely on contract performance (reimbursing employees under an employment contract), legal obligation (keeping substantiation records for tax purposes) and legitimate interests (preventing expense fraud).

If your employer uses Phyto Nex AI, your expense reports and receipts are reviewed by our software on your employer's behalf. This section explains what that means for you in plain terms.

What our software looks at

Phyto Nex AI reads the expense reports you have already submitted to your company's expense platform (for example SAP Concur, Expensify, Ramp, Brex or Navan). It does not have access to your personal email, personal bank accounts, browsing history, location or any device. Our connectors are read-only, which means Phyto Nex AI cannot change, approve, reject or delete anything in your expense platform.

What you see

If a line item appears to be outside your company's policy, an AP or finance team member at your company reviews the finding and may send you a message through Slack, Microsoft Teams or email asking you to correct, explain or remove the item. Every one of these messages is reviewed and approved by a person at your employer before it is sent. Phyto Nex AI never sends a pushback message automatically, never denies a reimbursement on its own and never changes your corporate card limits.

No profiling for employment decisions

Phyto Nex AI does not score, rank or profile employees, and it does not produce performance, trustworthiness or risk ratings about individuals. Findings relate to specific expense lines and are tied to your employer's written policy. Our contracts prohibit customers from using Phyto Nex AI as the sole basis for any disciplinary or employment decision, and the product does not offer features designed for that purpose.

How to exercise your rights

Because your employer controls this data, requests to access, correct or delete your expense information should go to your employer, usually your finance, HR or privacy team. If you write to us directly, we will forward your request to your employer within five business days and help them respond. We will not disclose your expense data to you directly without your employer's authorization, because doing so could expose information about colleagues who appear on the same receipts.

• You can ask your employer which policy rule a flag was based on and request a human re-review.
• You can reply to any pushback message with an explanation, which is attached to the finding for the reviewer.
• You can ask your employer to correct an OCR error, and corrected values replace the extracted values in the audit record.

Phyto Nex AI uses machine learning for optical character recognition of receipts, for classifying charge lines (for example distinguishing room rate from minibar on a hotel folio) and for matching receipt text to clauses in a customer's written expense policy. We use a large language model to prepare a first draft of the polite pushback message an AP reviewer may choose to send.

• No solely automated decisions with legal or similarly significant effects. Within the meaning of Article 22 GDPR, Phyto Nex AI does not make decisions about individuals. It surfaces findings; a person at the customer decides whether to act.
• Human review of every outgoing message. Drafts are visible only to authorized reviewers until a reviewer approves, edits or discards them.
• No model training on Customer Data. We do not use receipts, expense reports, message drafts or employee replies to train or fine-tune foundation models, and we do not permit our model providers to do so.
• Zero data retention. Language model requests are sent to Anthropic, PBC under zero data retention terms, which means prompts and outputs are not stored by the provider after the response is returned.
• Minimized prompts. Model requests include only the line items, policy clause and context needed for the specific draft. Card numbers are already truncated and are never included.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose personal data only in the following situations:

• Subprocessors: vendors that host our infrastructure, deliver messages, provide support tooling or process subscription payments under written contracts that impose obligations at least as protective as ours. The current list, including each vendor's purpose and location, is published at /legal/subprocessors.
• Delivery destinations chosen by the customer, such as the customer's own Slack workspace or Microsoft Teams tenant, when an AP reviewer approves a message.
• Professional advisers such as auditors, lawyers and insurers, under duties of confidentiality.
• Authorities, where we are required to do so by law or by a valid legal process. We review each request, narrow it where possible and notify the affected customer unless legally prohibited.
• A successor entity in a merger, acquisition or sale of assets, subject to this policy and with notice to customers.

Customers choose where their Customer Data is stored when their workspace is provisioned: in the United States (AWS us-east-1, N. Virginia) or in India (AWS ap-south-1, Mumbai). Customer Data at rest stays in the selected region. Some subprocessors and our support teams may access data from other countries, and our own account and marketing data is held in the United States.

Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the following safeguards:

• The European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module 2 and Module 3 as applicable, incorporated into our DPA.
• The UK International Data Transfer Addendum issued by the Information Commissioner's Office for transfers from the United Kingdom.
• The Standard Contractual Clauses as adapted for the Swiss Federal Act on Data Protection for transfers from Switzerland.
• For transfers from India, we transfer personal data only to countries not restricted by notification of the Central Government under section 16 of the DPDP Act, 2023.

We supplement these mechanisms with encryption, access controls and a documented process for assessing and challenging government access requests.

We keep personal data only as long as necessary for the purpose it was collected, or as required by law. Customers can configure retention for receipt images within the range shown below.

When a subscription ends, we delete Customer Data from production systems within 30 days, after giving the customer the export window described in our Terms of Service. Copies in encrypted backups expire within 35 days after deletion.

Phyto Nex AI maintains a security program audited annually against SOC 2 Type II criteria and certified to ISO/IEC 27001:2022. Highlights include:

• Encryption of data at rest with AES-256 and in transit with TLS 1.2 or higher, with keys managed in AWS Key Management Service.
• Read-only OAuth scopes or API credentials for every expense and ERP connector.
• Truncation of card PANs to the last four digits at ingestion.
• Single sign-on and multi-factor authentication for all staff, least-privilege access and quarterly access reviews.
• Independent penetration testing twice a year and continuous vulnerability scanning.

Our Security Policy at /legal/security-policy describes these controls in more detail. No system is perfectly secure, but if we become aware of a personal data breach affecting you, we will notify the relevant customer and, where required, authorities and affected individuals.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the following rights regarding personal data for which we are the controller:

• Access: to obtain confirmation of whether we process your data and a copy of it.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to request deletion where there is no overriding reason to keep it.
• Restriction: to ask us to limit processing while a dispute is resolved.
• Portability: to receive data you provided in a structured, machine-readable format.
• Objection: to object to processing based on legitimate interests, and to object at any time to direct marketing.
• Withdrawal of consent: without affecting processing carried out before withdrawal.
• Complaint: to lodge a complaint with your local supervisory authority, the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner.

To exercise these rights, email privacy@phytonexai.com. We respond within one month, extendable by two further months for complex requests, and we may need to verify your identity first. Our representative in the European Union under Article 27 GDPR is Kirchner Datenschutz GmbH, Rosenthaler Strasse 51, 10178 Berlin, Germany, who can be contacted on matters related to our processing.

This section applies to California residents and supplements the rest of this policy. In the preceding 12 months we have collected the following categories of personal information as a business. For Customer Data, we act as a service provider and process it only for the business purposes specified in our customer contracts.

We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16. We use sensitive personal information only for purposes permitted under section 7027(m) of the CCPA regulations, such as authenticating you.

California residents may request to know what we collect, use and disclose; request deletion; request correction; and opt out of sale or sharing (which we honor automatically through Global Privacy Control signals). We will not discriminate against you for exercising these rights. You may submit a request by email or through an authorized agent, and we will verify the request by matching information you provide with information in our records.

Where we process the digital personal data of individuals in India as a data fiduciary, the Digital Personal Data Protection Act, 2023 and the rules made under it apply. Where we process Customer Data on behalf of an Indian customer, we act as a data processor and the customer is the data fiduciary.

Your rights as a data principal

• To obtain a summary of the personal data we process about you and the processing activities undertaken.
• To obtain the identities of other data fiduciaries and data processors with whom your data has been shared.
• To correct, complete, update or erase your personal data.
• To withdraw consent at any time, with the same ease with which it was given.
• To nominate another individual to exercise your rights in the event of death or incapacity.
• To have a readily available means of grievance redressal before approaching the Data Protection Board of India.

Where our processing relies on consent, you may give, manage, review or withdraw it directly with us or through a consent manager registered with the Data Protection Board of India.

Grievance Officer

In accordance with the DPDP Act and Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, our Grievance Officer is Meenakshi Raghunathan, Head of Privacy and Grievance Officer, Phyto Nex LLP, 312, Thiruvalluvar Street, Vellakinar Pirivu, Gnanambika Mills, Coimbatore North, Coimbatore, Tamil Nadu 641029, India. Email: privacy@phytonexai.com. Phone: +91 80 4123 7815 (Monday to Friday, 10:00 to 18:00 IST) or toll-free 1800-419-6620. We acknowledge grievances within 48 hours and resolve them within 30 days of receipt.

Phyto Nex AI is a business service intended for use by organizations and their adult workforce. We do not knowingly collect personal data from anyone under 18, and our website is not directed to children. If you believe a child has provided personal data to us, contact us and we will delete it promptly.

We review this policy at least annually and whenever our practices change. The "last updated" date at the top of this page shows when it was most recently revised. If we make material changes, such as adding a new purpose for processing Customer Data, we will notify customer administrators by email and in the application at least 30 days before the change takes effect. Previous versions are available on request.

For any question about this policy or our privacy practices, please contact us:

• Privacy team and Grievance Officer: privacy@phytonexai.com
• Security matters: security@phytonexai.com
• General support: support@phytonexai.com
• Post: Phyto Nex LLP, Attn: Privacy, 312, Thiruvalluvar Street, Vellakinar Pirivu, Gnanambika Mills, Coimbatore North, Coimbatore, Tamil Nadu 641029, India
• Registered office: 1209 Orange Street, Wilmington, DE 19801, United States
• Phone: +91 80 4123 7815 or toll-free in India 1800-419-6620