Privacy Policy

Karyagrah is a WhatsApp Business SaaS platform operated by Karyagrah, a company registered in India.

For the personal data of your own customers, contacts, employees and members that you put into the platform, you decide why and how it is used and Karyagrah acts on your behalf as a data processor. For your account and billing details, and for visitors to our website, we are responsible for the data ourselves.

Registered Address:
Delhi

Contact Email: support@karyagrah.com

2.1 Information You Provide

• Account Information: Name, email address, phone number, company name when you register.
• Billing Information: Company and GST details, and payment details processed securely by our payment partners (Razorpay and Cashfree). We do not store card numbers on our servers.
• WhatsApp Business Account Details: Meta/Facebook Business account ID, WhatsApp Business Account (WABA) ID, and phone number IDs you connect. If you connect Instagram or a Facebook Page, the account or Page ID, name and access token.
• Contact and Conversation Data: Customer names, phone numbers, usernames, messages, photos, voice notes, files and conversation history you import or receive through WhatsApp, Instagram, Messenger or your website chat.
• Organisation Data You Add: If you use business modules, the information you enter about your own employees, members, appointments, orders, inventory and tasks. Some of it can be sensitive (for example attendance, payroll, or the last digits of an ID number), and sensitive identifiers are stored encrypted.
• Profile & Settings: Any configuration, templates, bot flows, AI agent instructions, knowledge-base content, lists, follow-ups or preferences you set up in the platform.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, button clicks, and navigation paths within the platform.
• Log Data: IP address, browser type, operating system, referring URL, and timestamps of requests.
• Call Records: If you use calling, the number, time, duration, direction and outcome of each call, and whether the customer has allowed calls. We do not record call audio.
• Cookies & Similar Technologies: We use necessary cookies for secure sessions and, only with your permission, analytics storage to understand site visits and improve the service.
• Device Information: Browser version and screen resolution for compatibility purposes. If you use our mobile app, a device identifier and push-notification token so we can send you alerts.

2.3 Information from Third Parties

• Meta (WhatsApp, Instagram, Messenger): Messages, delivery and read statuses, the profile name or username of the person writing, comment text on your posts, and call events, received through the platform's official interfaces and only for the accounts you connect.
• Payment partners: Payment confirmation and transaction IDs for billing.
• Google: If you connect Google Calendar or Google Sheets, the information described in the section on Google services below.
• Google Analytics: Website usage and engagement information, only when you consent to analytics.
• Services you connect: If you connect a store, CRM, courier or payment gateway, the data that service sends us for the connection to work (for example orders, products or tracking updates).

We use the information we collect to:

• Create and manage your account and provide platform services.
• Process payments and manage your subscription plan.
• Send and receive messages on your behalf through WhatsApp, Instagram and Messenger, and place or receive calls where you use them.
• Generate replies and take actions with the Sahayak AI agent, if you turn it on.
• Send follow-up reminders, scheduled messages and notifications you set up.
• Store and display conversation history in your team inbox.
• Send transactional emails (account activation, password reset, billing alerts).
• Respond to your support queries.
• Monitor platform health, performance, and prevent abuse.
• Comply with legal obligations.

We do not use your data for advertising, and we do not sell your personal information or your customers' data to any third party.

We handle personal data in line with India's Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under it, and, where it applies to you, the GDPR. We rely on:

• Contract: Processing necessary to deliver the services you subscribed to.
• Consent: Optional website analytics and marketing communications, where you have opted in. You can withdraw consent at any time.
• Legitimate interests and legal uses: Security monitoring, fraud prevention, and improving the platform.
• Legal obligation: Compliance with applicable laws, such as tax and accounting rules.

Because you decide how your customers' data is used, you are responsible for having the consent or other lawful basis that the law requires for it, and for telling your customers how you use their data.

We do not sell your data. We share it only in the following limited circumstances:

• Hosting and infrastructure: Amazon Web Services (servers and database in Mumbai, India; uploaded files and database backups in Amazon S3, USA), email delivery (SMTP), and monitoring tools.
• Payments: Razorpay and Cashfree process subscription and top-up payments.
• Meta Platforms: To send and receive messages and calls on WhatsApp, Instagram and Messenger we transmit the necessary data to Meta through its official interfaces.
• AI and voice providers (only if you use Sahayak): OpenAI, and, for voice features, Deepgram or Sarvam, process the content needed to produce a reply. See the section on AI features.
• Google: If you connect Google Calendar or Google Sheets, or accept analytics.
• Integrations you connect: Stores, CRMs, couriers, payment gateways and automation tools receive data only as needed for that connection, on your instruction. Their use of it is covered by their own policies.
• Legal Requirements: If required by law, court order, or governmental authority, we may disclose information as legally required.
• Business Transfer: In the event of a merger, acquisition or asset sale, your data may be transferred. We will notify you before your data is transferred.

All of these parties are bound by confidentiality or contract terms. We do not share data with advertisers or data brokers.

If you turn on the Sahayak AI agent, the message a customer sends, any photo or voice note, the parts of your knowledge base and recent chat that are relevant, and your agent's instructions are sent to an AI provider (currently OpenAI) so it can write the reply. Voice notes and spoken replies may be processed by a speech provider (Deepgram or Sarvam, or OpenAI). We send only what is needed for that reply.

• We do not use your or your customers' content to train our own models, and we do not sell it.
• Each provider handles the content only to return the reply, under its own API terms. Please read their policies if you need more detail.
• Sahayak's memory is off by default. If you switch it on, it stores what a customer told it for the number of days you set (90 by default) so it can help them next time.
• A record of each AI reply (time, cost and the actions taken, such as saving a lead) is kept so you can review it and so your AI wallet is accurate.
• Please tell your customers they are chatting with an AI where the law or the channel requires it.

When you connect an Instagram account or a Facebook Page, Meta gives us the messages and comments sent to it, the sender's name or username, and the account details needed to reply. We use them only to show them in your inbox, run your bots and Sahayak, and keep your conversation history. Disconnecting the account in the platform stops us receiving anything new. You can ask us to delete the history at any time.

For WhatsApp calls, call audio is relayed in real time between your team member's browser and WhatsApp and is not recorded or stored by us. We keep the record of the call (number, time, duration, outcome) and of whether the customer allowed calls, so your team can see the history.

If you choose to connect Google Calendar, we ask Google for permission to read when you are busy and to create, update and delete the calendar events that Karyagrah makes for your own bookings, tasks and follow-ups. If you connect Google Sheets, we write the data you choose to export to a spreadsheet. We use this only to provide those features to you, we do not use it for advertising, and we do not share it with anyone else. You can disconnect at any time from the platform, or remove access in your Google Account.

Karyagrah's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The platform's servers and database run on Amazon Web Services in Mumbai, India. Uploaded files (such as images, documents and voice notes) and database backups are stored in Amazon S3 in the United States (N. Virginia). AI and voice providers and Meta may process data in other countries. Where data leaves India we rely on the security and contract commitments of these providers, and on the transfer rules of the law that applies.

We retain your personal data for as long as your account is active or as needed to provide services. Specifically:

• Account data: Retained while your account exists and for 90 days after deletion.
• Conversation & message data: Retained for the duration of your subscription and up to 30 days after termination.
• Billing records: Retained for 7 years as required by Indian financial regulations.
• Log data: Automatically deleted after 90 days.
• Media files received on a number that is also used on the WhatsApp Business app: automatically deleted after 20 days.
• Call records, AI wallet records and AI reply records: Kept with your account, and with billing records where they are part of an invoice or statement.

We use the following categories of cookies and browser storage:

• Strictly Necessary: Security, captcha, login sessions, device protection and remembering your privacy choice. These cannot be switched off because the requested service would not work reliably without them.
• Analytics (optional): Google Analytics and Karyagrah's first-party visit analytics help us understand page visits, referral sources and site performance. They remain off unless you choose to allow analytics.

Necessary session storage lasts only as long as required for the relevant security or login function; the protected device identifier can last up to one year. If you allow analytics, Google Analytics may set _ga and _ga_* cookies for up to two years, subject to browser limits. Karyagrah's visit identifier remains in browser storage until you withdraw consent or clear site data, while campaign attribution is limited to the browser session.

We do not use third-party advertising cookies and we do not sell analytics data. You may reject optional analytics without losing access to the website or platform. You can change or withdraw your choice at any time.

We implement industry-standard security measures to protect your data:

• All data is transmitted over HTTPS with TLS encryption.
• Message content and the access tokens that connect your accounts are encrypted at rest.
• Passwords are hashed using bcrypt and are never stored in plain text.
• Every company and branch is separated, access is controlled by roles, and sensitive actions are written to an audit log.
• Webhooks from Meta are signature-checked, so only genuine traffic reaches your inbox.
• Database access is restricted to authenticated services only.
• API keys and secrets are stored as environment variables, never in code.
• Regular security reviews and dependency audits.

While we take all reasonable precautions, no method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it immediately to support@karyagrah.com.

You have the following rights regarding your personal data:

• Access: Request a summary of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your account and associated data.
• Portability: Request your data in a machine-readable format.
• Objection and restriction: Object to certain types of processing, or ask us to restrict it.
• Withdraw consent: Withdraw any consent you gave, at any time.
• Nominate someone to exercise these rights for you if you are unable to.

To exercise any of these rights, email us at support@karyagrah.com. We will respond within 30 days. If you are a customer of one of our business users (for example you messaged a shop that uses Karyagrah), please contact that business first, because it decides how your data is used; we will help it respond.

Grievance Officer. If you have a complaint about how your data is handled, write to the Grievance Officer of Karyagrah at support@karyagrah.com, with the subject "Grievance". We acknowledge complaints within 2 working days and aim to resolve them within 30 days.

Karyagrah is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

Our platform may contain links to third-party websites (e.g., Meta, Google, Razorpay). We are not responsible for the privacy practices of these external sites and encourage you to review their privacy policies.

We may update this Privacy Policy periodically. When we make significant changes, we will notify you via email or a prominent notice on the platform. The "Last updated" date at the top of this page will always reflect the most recent version. Continued use of Karyagrah after changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: