Privacy Policy

This Privacy Policy explains how Kafal AI ("Kafal", "we", "us"), a sole proprietorship registered in India (MSME, Udyam registered) with its registered address at 45, Mayapur, Batula, Dasoli Block, Chamoli, Uttarakhand 246472, India, handles personal data. It is written to meet India's Digital Personal Data Protection Act 2023 ("DPDP Act") and the rules under it, and it tells you plainly what we collect, why, who we share it with, how long we keep it and what you can ask us to do.

It covers:

• visitors to our website at https://kafal.ai;
• people who write to us through our forms (book a demo, request a callback, contact, custom solution, AI Call Assistant waitlist), by email or on a call;
• clients who have an account with us, and the team members they add to it;
• End Users: the customers of our clients who talk to a client's AI assistant on WhatsApp or on the client's website. For them we act as a processor, as section 02 explains.

Words such as Assistant, Channel, Knowledge Content, Conversation Data and End Users have the meanings given in our Terms of Service.

The DPDP Act distinguishes between the party that decides why and how personal data is processed (the Data Fiduciary) and a party that processes it on that party's behalf (the Data Processor). We play both roles, for different data.

We are the Data Fiduciary for

• our website and the people who visit it;
• enquiries and leads submitted through our forms, email or calls;
• client accounts: the business, billing and login details of our clients and their team members.

We are a Data Processor for

• End User conversations and any details End Users share with a client's Assistant;
• the Knowledge Content a client uploads, to the extent it contains personal data.

For that data, the client (the business you messaged) is the Data Fiduciary. It decides what its Assistant asks for and does with it, and it is responsible for giving you its own privacy notice and for answering your requests. If you are an End User, please contact the business you messaged first. If you cannot reach them, write to us at [email protected] and we will help you and pass your request to the right business.

Forms and enquiries

When you book a demo, request a callback, contact us, ask for a quote or join the AI Call Assistant waitlist, we collect what you type: your name (optional on some forms), mobile number and/or email address, business name and type, city, your preferred call time, your message, and the page the form was sent from. Our forms also contain a hidden field that only automated bots fill in, which we use to discard spam. If you chat with the assistant on our own website, we keep that conversation and any name, mobile number or email you share in it, and treat it like an enquiry sent through a form.

Account and team data

When you become a client: your business name and details, the name, email and mobile number of each team member, login credentials (passwords are stored only as one-way hashes), your settings and your activity in the dashboard.

Billing data

Your plan, invoices, payment history and the status of your subscription. Payments are handled by our third-party payment gateway partner. We never see or store your full card number, CVV, UPI PIN or bank login; the payment gateway partner shares with us only what we need to confirm a payment (such as a payment ID, the method type and the last digits of a card).

Knowledge Content

The documents, price lists, FAQs and instructions a client gives us to train its Assistant. These may contain personal data (for example, staff names in a brochure); clients are responsible for what they upload.

Conversation Data

Messages between an Assistant and End Users on each Channel, the End User's WhatsApp number or website session identifier, the time of each message, and any details the End User chooses to share (for example, a name and number so the business can call back). This data belongs to the client and is shown only in that client's dashboard.

Technical and security data

When you use our website or dashboard, our servers and Cloudflare record your IP address, approximate location derived from it, browser and device type, the pages you request, timestamps, referring URLs and error logs. We use this to keep the service secure (for example, rate limiting and blocking attacks) and to fix problems. Lead records also keep the IP-derived details needed for abuse prevention. If you use voice mode in a client's assistant, your browser's speech recognition may send audio to the browser maker's speech service under its own policy.

Cookies

See section 06.

We do not knowingly collect special categories of data (such as health, religion, caste, biometric or financial account data) about you, and our Terms prohibit clients from configuring an Assistant to collect such data beyond what is necessary and lawful.

We use personal data to:

• respond to you: call or email you back about your enquiry, normally within 24 hours, and follow up about the demo or quote you asked for;
• provide the Services: create and run your account and Assistant, deliver conversations to your dashboard, send the emails the service needs (confirmations, renewal reminders, security alerts, setup updates);
• secure and improve the Services: prevent spam, fraud and abuse, monitor performance, diagnose errors, and understand how the product is used in aggregate;
• bill you: process payments through our payment gateway partners, issue invoices, handle refunds and keep the accounts the law requires;
• support you: answer your questions and resolve problems;
• comply with the law: meet our obligations under tax, accounting, consumer, telecom and data protection law, and respond to lawful requests from authorities.

What we do not do. We do not sell personal data. We do not share it with advertisers. We do not run advertising or behavioural tracking on our website. We do not use your Knowledge Content or Conversation Data to train AI models that serve other customers. We send marketing emails only if you have asked for them, and every such email includes a way to stop.

Under the DPDP Act we process personal data on one of these bases:

• Consent. When you submit a form, you consent to our using those details to respond to your enquiry, as the note under each form says. You may withdraw consent at any time (section 12).
• Legitimate uses (Section 7 of the DPDP Act). Where you voluntarily give us your data for a specified purpose and have not indicated that you do not consent to its use for that purpose; to perform our obligations under the law; to respond to a medical emergency or a threat to public safety; and for employment-related purposes.
• Performance of our agreement. Providing the Services to a client under our Terms, and the steps needed before entering into that agreement, such as a demo and a quote.
• Legal obligations. Keeping tax and accounting records, responding to lawful orders, and meeting data protection obligations.

Cookies are small files a website stores in your browser. We use only the cookies the site needs to work:

• Session and security cookies (set by our application): keep you logged in to the dashboard, protect forms against cross-site request forgery, and remember a form you submitted for the thank-you message. They expire when the session ends or within a short period.
• Preference cookies and local storage: remember small choices such as the dashboard sidebar layout, and, if you chat with the assistant on our own website, an anonymous token that keeps your conversation open for 24 hours. No third-party service reads them.

No analytics or advertising cookies today. We currently use no analytics or advertising cookies. If we add a privacy-friendly analytics tool later, we will update this policy and, where the law requires it, ask for your consent first.

You can block or delete cookies in your browser settings; the dashboard will not work without the session cookie.

We share personal data only with the providers we need to run the Services (our sub-processors), each bound by contract to protect it and to use it only for the stated purpose:

We may also disclose personal data:

• when the law requires it: to comply with a court order, a lawful request from a government or law-enforcement authority, or a legal obligation;
• to protect rights and safety: to enforce our Terms, to prevent fraud, abuse or security threats, or to protect the rights, property or safety of any person;
• in a business transfer: if our business or a part of it is converted into a company, merged, sold or reorganised, personal data may be transferred to the successor, who must honour this policy; we will tell you if this happens.

We will update this table when a sub-processor changes. Clients receive notice of material changes as described in section 13 of the Terms.

Your data is stored on servers in India (India (Mumbai)). Some of our sub-processors, listed above, process data outside India: for example, generating an AI reply means sending the conversation text to a model provider that may be hosted abroad, and Meta operates WhatsApp globally. We make such transfers only as permitted by the DPDP Act and subject to any countries or territories that the Central Government restricts by notification, and we require those providers to protect the data under contract and by appropriate security measures.

We keep personal data only as long as it is needed for the purpose it was collected for, or as the law requires, and then delete or anonymise it:

Where the DPDP Act requires us to erase data once its purpose is served or when you withdraw consent, we do so unless retention is necessary under the law. Before we delete the data of an account that has been inactive for the period above, we give at least 48 hours' notice to the account email, so you can export or keep it.

We take reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure and alteration, including:

• encryption in transit (HTTPS/TLS) for our website, dashboard, APIs and WhatsApp connection;
• encrypted, access-restricted backups;
• role-based access and the principle of least privilege: each client sees only its own workspace, and our staff access client data only when needed for setup or support;
• key-only access to our servers, a firewall that exposes only the ports the service needs, and regular security updates;
• passwords stored only as one-way hashes; rate limiting and bot protection on public forms;
• monitoring and logging to detect and respond to incidents.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to protect your data and to respond quickly if something goes wrong. Please help by keeping your credentials private and telling us about any suspected problem.

If a personal data breach occurs (a loss, unauthorised access or disclosure of personal data), we will act without undue delay to contain it, assess it and fix the cause. Where the DPDP Act requires it, we will notify the Data Protection Board of India and each affected person in the manner and within the time the rules prescribe, with a description of the breach, its likely consequences and the steps we are taking. For data we process on a client's behalf, we will notify that client without undue delay so it can meet its own obligations to its End Users and to the Board.

As a Data Principal under the DPDP Act, you have the right to:

• Access: ask for a summary of the personal data we hold about you, how we process it, and the other parties we have shared it with.
• Correction, completion and updating: ask us to correct inaccurate or misleading data, complete incomplete data, or update it.
• Erasure: ask us to delete your personal data, unless we must keep it for a specified purpose or under the law.
• Grievance redressal: have your complaint heard by our Grievance Officer (section 16) within the stated time.
• Nominate: name another person who may exercise these rights on your behalf if you die or become incapacitated.
• Withdraw consent: as easily as you gave it; withdrawing does not affect processing that already took place and may mean we can no longer provide a service that depends on it.

How to exercise a right

Email [email protected] with the subject "Data request", tell us which right you are exercising and, where relevant, the mobile number or email you used with us. We may ask you to verify your identity before acting, to protect your data from someone pretending to be you. We respond within 30 days of receiving a verifiable request, and sooner where the rules require. There is no charge, unless a request is clearly unfounded or excessive. Clients can also update their own account and team details directly in the dashboard.

If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner provided under the DPDP Act and its rules.

You also have duties under the DPDP Act: not to impersonate another person, not to suppress material information when giving data for a document issued by the State, not to file false or frivolous grievances, and to give only verifiably authentic information when exercising the right to correction or erasure.

Our Services are for businesses and professionals and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, or that a client's Assistant has collected it, email [email protected] and we will delete it promptly. Our Terms prohibit clients from targeting children or operating a Channel aimed at people under 18.

European Economic Area and United Kingdom. If you are in the EEA or the UK, the GDPR or the UK GDPR may apply. Our legal bases correspond to consent, performance of a contract, legal obligation and our legitimate interests (running and securing the Services). In addition to the rights above, you have the right to data portability, to object to processing based on legitimate interests, to restrict processing, and to lodge a complaint with your local supervisory authority. Transfers to India rely on appropriate safeguards such as standard contractual clauses; ask us for details. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

California. If you are a California resident, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for exercising your rights. We do not "sell" or "share" personal information as those terms are defined in the California Consumer Privacy Act, and we do not use or disclose sensitive personal information for purposes other than providing the Services. To exercise these rights, use the contact details in section 16.

Other countries. Where the law of your country gives you additional rights, you may exercise them by contacting us, and you may complain to your local data protection authority.

We may update this policy as our Services, our providers or the law change. The "Last updated" date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you in advance by email (if we have your address), by a notice in the dashboard or by a clear notice on our website, and where the law requires it we will ask for your consent again.

Our Grievance Officer handles all questions, requests and complaints about personal data under the DPDP Act and the Information Technology Act 2000:

Grievance Officer, Kafal AI
Email: [email protected]
45, Mayapur, Batula, Dasoli Block
District Chamoli
Uttarakhand 246472
India

We acknowledge every grievance within 48 hours and aim to resolve it within 30 days of receipt. You can also reach us through our Contact page.