Privacy Policy

01 Overview & Scope

This Privacy Policy explains what personal data krtiq collects through krtiq.com and the krtiq application (together, the "Service"), why we collect it, how it's used and shared, and the choices available to you. It applies to visitors, registered Users, and members of an Organization on the Service.

This Policy does not, by itself, describe how krtiq handles the substantive content of the contracts and documents you upload for processing — that's covered by the Customer Content provisions in the Terms of Service, and by Section 3 and Section 5 below where that content contains personal data (for example, the names of signatories on a contract).

02 Who We Are

krtiq is presently operated as an unincorporated business based in India, pending formal company registration. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), krtiq acts as the Data Fiduciary for personal data collected through the Service. Contact details are in Section 16.

03 Information We Collect

Account & organization data

Name, email address, and password or authentication credentials when you register; your role and Organization membership; billing contact and transaction details when you subscribe to a paid Plan.

Customer Content

The documents, contracts, and files you upload or import, and any personal data they contain (such as the names, titles, or contact details of contract signatories and counterparties). We process this as your processor to provide the Service — see the Terms of Service for how ownership and licensing of this content works.

Usage & device data

Log data such as IP address, browser type, pages viewed, actions taken, and timestamps, collected automatically as you use the Service, for security, debugging, and product-improvement purposes.

Communications

Any information you provide when you contact us for support, request a demo, or otherwise correspond with us.

04 How We Use It

• To provide, operate, and maintain the Service, including generating Output from your Customer Content;
• To authenticate you, secure your account, and prevent fraud or abuse;
• To process billing and communicate about your subscription;
• To respond to support requests and other communications;
• To send Service-related notices — for example, about obligation deadlines you've asked to be notified about;
• To monitor, debug, and improve the Service, including through de-identified, aggregated usage analysis;
• To comply with legal obligations and enforce our Terms of Service.

We do not use your account or Customer Content for advertising, and we do not sell personal data to any third party.

05 AI & Model Providers

krtiq currently uses Microsoft Azure OpenAI Service to generate extractions, classifications, and conversational responses. Under our arrangement with that provider, data submitted through the Azure OpenAI Service is not used to train, retrain, or improve the underlying foundation models, and is not shared with other Azure OpenAI customers. We may add or change AI model providers over time; where we do, we apply the same no-shared-training standard as a baseline requirement.

Output generated this way is stored as part of your Organization's data in the Service and is handled with the same protections as your Customer Content.

06 Third-Party Connectors

The Service supports optional Connectors to Gmail, Outlook, Google Drive, and Microsoft 365, which let you import documents directly from those accounts. As of the effective date of this Policy, these Connectors are still in development and are not enabled for general use — this section describes how they are designed to work once they are.

Where you authorize a Connector, krtiq requests only the access scopes needed to list and retrieve documents from the connected account, and uses the data obtained solely to import that content into your Organization's repository. You can revoke access at any time through the connected provider's own account permissions or from within krtiq.

krtiq's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Microsoft Graph (Outlook, Microsoft 365) is handled under equivalent restrictions and is used solely to provide the Connector functionality you request.

07 Legal Basis

Under the DPDP Act, krtiq processes personal data on the basis of your consent — given when you register for the Service, connect a third-party account, or otherwise voluntarily provide data — or, where applicable, on the basis of a "certain legitimate use" recognized by the Act, such as performing a contract with you or complying with a legal obligation. You may withdraw consent at any time as described in Section 13, though this may limit your ability to use parts of the Service that depend on that data.

08 Cookies

Essential cookies

We set a small number of cookies without asking, because the Service cannot function without them: they keep you signed in, hold your session securely, and remember interface preferences such as which workspace you last opened. These are never used to profile you or to follow you to other sites.

Optional analytics cookies

On krtiq.com we would like to count page visits and see which pages help people understand the product. This is handled by PostHog, processed on EU infrastructure, and it is off until you accept. Nothing analytics-related loads, and no analytics cookie is written, unless you choose Accept on the cookie notice. Declining changes nothing about how the product works.

Changing your mind

You can revisit the choice at any time from the "Cookie settings" link in the site footer. Withdrawing consent stops further analytics collection and clears the analytics cookies already set in your browser.

We do not use advertising cookies or cross-site tracking of any kind.

09 How We Share Data

We share personal data only with:

• Infrastructure and processing providers who host, store, or process data on our behalf under contract, currently including Supabase (database, authentication, and file storage), Microsoft Azure (AI model processing, hosting), and PostHog (website analytics, EU region, only where you have consented);
• Other members of your Organization, according to the roles and permissions your Organization administrator configures;
• Professional advisors such as accountants or, if ever needed, lawyers, bound by confidentiality;
• Authorities, where required by law, court order, or to protect krtiq's or others' rights, safety, or property; and
• A successor entity, in connection with the corporate transition described in Section 3 of the Terms of Service, or any future merger, acquisition, or sale of the business, subject to that successor being bound by materially equivalent privacy commitments.

We do not sell personal data, and we do not share Customer Content across Organizations.

10 International Transfers

Because our infrastructure and AI processing providers operate internationally, personal data may be processed outside India, including in jurisdictions whose data protection laws differ from India's. Where the DPDP Act restricts transfers to specific jurisdictions, we will comply with those restrictions. We take contractual and technical steps with our providers to protect data wherever it is processed.

11 Data Retention

We retain account and Customer Content data for as long as your account is active, and for up to 30 days after account closure to allow for export, as described in the Terms of Service. We may retain limited data for longer where required to comply with law, resolve disputes, or enforce our agreements, and residual copies may persist briefly in backups until they age out of our normal backup rotation.

12 Security

We use reasonable technical and organizational measures designed to protect personal data, including encryption of data in transit, access controls, and rate limiting on the Service's public endpoints. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. As an early-stage, single-operator product, our security practices are actively evolving; if you become aware of a vulnerability, please report it to the email in Section 16.

13 Your Rights

Subject to applicable law, including the DPDP Act, you may:

• Request access to, or a copy of, the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your personal data, subject to the retention needs described in Section 11;
• Withdraw consent to processing that relies on consent, at any time;
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity, as provided under the DPDP Act.

To exercise any of these rights, contact us using the details in Section 16. We will respond within the timeframe required by applicable law.

14 Children's Privacy

The Service is intended for business use by individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

15 Changes to This Policy

We may update this Policy from time to time. If a change is material, we will provide reasonable notice before it takes effect, in the same manner as described for the Terms of Service. The "Effective" date at the top of this page reflects the latest version.

16 Grievance & Contact

For privacy questions, data requests, or grievances under the DPDP Act, contact us at info@krtiq.com. We aim to acknowledge grievances promptly and resolve them within the timeframe required by applicable law.