Privacy Policy

• Account data: name, work email, job title, department, profile photo, and how you sign in (password, authenticator app, or your company's single sign-on). It comes from you or from the administrator who created your account. We never see or store your password; sign-in is handled by our authentication provider.
• Workspace content your organization adds: leads, contacts, companies, deals, notes, activities, emails, meeting transcripts, call recordings, files, quotes, invoices, tasks and messages. It comes from your organization's people, from tools they connect, and from forms and booking pages they publish.
• Content from connected tools, only after someone connects them: calendar events, email with your CRM contacts, Slack or Teams channels you map, WhatsApp messages.
• Public company information (a company's own website, public registries, recent news) when account research is switched on. We do not research individuals and do not use social networks.
• Support conversations: messages you send our support assistant or team, with card numbers, keys and passwords removed from chats automatically.
• Usage and security data: sign-in times, wrong-password counts used to lock an account that is being guessed at, request logs (without request bodies or secret links), IP address, rate-limit counters (hashed), tutorial progress, and an audit log of administrative changes.
• Billing data: your organization's plan, invoices and payment status. Card details go straight to Razorpay; we never store them.

Giving us account and billing data is necessary to use the service; without it we cannot create or bill an account. Everything else is optional.

We don't sell personal data, we don't share it for cross-context advertising, and we don't use it for advertising. Where the law requires consent for a use, we ask for it and you can withdraw it as easily as you gave it. Workspace content is sent to an AI provider only to answer that request, and is not used by us or our providers to train models.

Kairoq uses software, including AI models, to research accounts, score and rank leads and deals, forecast, summarise conversations and draft messages. These are aids to a person's judgment: we do not make decisions that have legal or similarly significant effects on anyone solely by automated means, and a person approves anything that is sent to a customer, deleted, exported or reassigned. Scores, forecasts and suggestions show their reasons so they can be checked and overridden.

If you are the subject of such a score in a business's workspace, you can ask that business for human review of it, and to object to it. Our AI transparency page explains what each feature does, which providers are involved and what its limits are.

Customers can upload call recordings and connect meeting tools so Kairoq can transcribe and summarise them. A recording can contain the voice and words of people who are not our users. The customer who uploads it is responsible for telling the people on the call and for getting any consent the law requires (several US states and many countries require every party's consent to record), and our Acceptable Use Policy requires it. Transcripts and email bodies are encrypted with a key unique to the customer.

Customers can also switch on open and click tracking for email they send. It uses a tiny image and tracked links, and it is off by default for new workspaces. Where the law (for example the EU ePrivacy rules) requires the recipient's consent for it, the customer must obtain it.

We share personal data only with: (1) sub-processors, a short list of service providers (hosting, database and sign-in, email delivery, payments, AI models, transcription) each bound by a data processing agreement and used only for the purpose described, listed with what each does, what it sees and where on our Sub-processors page; (2) tools your organization connects (Google, Microsoft, Zoom, Slack, Meta for WhatsApp), only when it connects them; (3) the workspace's own administrators, who can see what their members do; (4) authorities, where a valid legal request or the law requires it. We review each request, disclose the minimum, and tell the customer unless we are prohibited; and (5) a buyer or successor, if we are acquired, bound by this policy.

We tell administrators at least 30 days before adding a sub-processor. Our own staff access a customer's data only when needed to run or support the service or when asked, and that access is logged where the customer can see it.

Customer data is stored in India (Mumbai). Some providers (for example AI model providers and transcription) process content outside India, including in the United States, when answering a request; that processing is limited to the request.

Personal data of people in the EU, EEA, UK or Switzerland is transferred to India and onward only under a lawful mechanism: an adequacy decision where one exists; otherwise the European Commission's standard contractual clauses (Module 2, and Module 3 with our sub-processors), the UK International Data Transfer Addendum, and the Swiss amendments, with supplementary measures (encryption in transit and at rest, per-customer encryption keys for email and transcripts, strict access controls, and the commitments on government requests in the DPA). Under the DPDP Act, personal data may be transferred outside India except to countries the Government of India restricts. You can ask us for a copy of the safeguards.

Every organization's data is isolated in the database itself (row-level security), not only in application code. Email bodies and meeting transcripts are encrypted with a key unique to your organization; connection tokens and payment credentials are encrypted at rest; everything travels over HTTPS. Two-factor authentication, single sign-on, role-based and field-level permissions, lockout after repeated wrong passwords, rate limits and an audit log are built in. An AI assistant can only act through the same permission checks as the person using it, and anything that sends, deletes or exports data waits for human approval. See our Security page.

If a breach affects personal data we hold, we tell the affected customer without undue delay and within 72 hours of becoming aware, and where we are the fiduciary or controller we notify the Data Protection Board of India and the people affected, and the competent EU or UK authority within 72 hours where the GDPR requires it, and report cyber incidents to CERT-In within the 6 hours its directions require. US state breach-notification laws are followed for residents of those states.

Depending on where you live you can: access your personal data and a summary of how it is processed; correct, complete or update it; erase it; restrict or object to processing; take a copy that is portable; withdraw consent; not be subject to a decision based solely on automated processing; nominate someone to exercise your rights if you die or cannot; and complain to us, to the Data Protection Board of India, to your EU or UK supervisory authority, or to your state attorney general. We never treat you worse for using a right, and we charge nothing for a reasonable request.

• If your data is in a business's workspace, contact that business first: its administrators can export or erase a person's data from Settings → Data → Data requests, and we help them answer. If you write to us about such data we pass it to the business without delay.
• For data we hold as the fiduciary or controller (your account and billing data), write to us at the address at the foot of this page. We will confirm it is you (for example by a message to your sign-in email) before we act. You may use an authorised agent; we will ask for proof they act for you.
• How fast: we acknowledge within 24 hours and answer within 30 days (GDPR: one month, extendable by two where the request is complex; CCPA: 45 days, extendable once by 45). If we refuse we say why and how to appeal; you can appeal by replying to our answer, and then complain to the authority above.

For people in India we handle personal data under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, whose obligations are phasing in; we apply them as they take effect. We process personal data for the purposes above, either with your consent (free, specific, informed, unconditional and unambiguous, and as easy to withdraw as to give) or for the "legitimate uses" the Act allows, such as performing a contract you asked for or complying with law.

• Your rights as a Data Principal: to get a summary of your personal data and who it is shared with, to correct, complete, update and erase it, to have grievances redressed, and to nominate another person. Use the contacts at the foot of this page.
• Grievances: write to our grievance officer (named at the foot of this page). We acknowledge within 24 hours and aim to resolve within 15 days. If you are not satisfied you may complain to the Data Protection Board of India, after you have used this process.
• Consent managers: you may give, manage, review and withdraw consent through a consent manager registered with the Board, once such managers operate; we will work with them.
• Your duties: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.
• Processing records needed to show compliance, and the logs the Rules require, are kept for the periods the Rules set.

For account data, Kairoq is the controller. The legal bases are in the table above. For customer content we are a processor and the customer is the controller.

• Contact for data protection: the contact at the foot of this page.
• Supervisory authority: you may complain to the authority in the country where you live or work, or where you believe your rights were infringed (in the UK, the Information Commissioner's Office).
• Retention is in the section below; transfers are covered above.

If you live in California, Colorado, Connecticut, Virginia, Texas or another state with a comprehensive privacy law, you have the rights to know, access, correct, delete and port your personal information, to opt out of its sale, sharing for targeted advertising and profiling in furtherance of significant decisions, and to appeal a refusal. We do not sell or share personal information (as those laws define the words), do not use it for targeted advertising, and do not use sensitive personal information (such as account log-in details) except to provide the service. We do not sell the personal information of anyone under 16.

We honour the Global Privacy Control signal (we do not track across sites, so there is nothing to opt out of), and do not respond differently to "Do Not Track". California residents may also ask which categories of personal information we disclosed to third parties for their direct marketing: none. Where we process a customer's workspace data as its service provider, the customer answers requests about it.

• Workspace data: while the organization's account is active. A workspace that is frozen (trial ended, payment lapsed or plan cancelled) keeps its data for at least 90 days, and we give 30 days' notice before deleting it afterwards. When an owner deletes the organization, everything is erased after a 7-day grace period, including the accounts of people who belonged only to it. Deleted records stay in the recycle bin for up to 90 days.
• Support assistant conversations: 180 days, or until you delete them. Tickets are kept while the organization is a customer.
• Wrong-password counters: 15 minutes. Rate-limit counters: days. Audit log: while the organization is active.
• Backups roll over within our provider's retention window, after which deleted data is gone from them too.
• Invoices and billing records are kept as long as tax and company law requires (in India, typically six to eight years).

We use only what's needed to keep you signed in and remember preferences such as light or dark mode and table layouts. We don't use advertising or cross-site tracking cookies, so no consent banner is needed. Details are on the Cookies page.

Kairoq is a business service and isn't directed at anyone under 18. We do not knowingly collect data from children (under 18 in India, under 16 or the local age of digital consent in the EU, under 13 in the US). A business that enters a child's data into its workspace must have verifiable parental consent where the law requires it. If you believe a child's data was entered, tell us and we will remove it.

We'll post changes here, and tell administrators and ask people to confirm significant ones. For questions or to exercise your rights, write to us at the address below; for a complaint about how we handle personal data, write to the grievance officer named below.