Your data, plainly.

Kalrava is built and run by Vrushabha Enterprises, which trades under the brand Nirmith AI (“we”, “us”). This policy covers the Kalrava web app at kalrava.nirmithai.com, its website chat widget, and the WhatsApp and social media features run through it.

Company

Vrushabha Enterprises, trading as Nirmith AI

Address

3rd Floor, Lakshmi Arcade, 3, Uttarahalli Main Rd, Friends Colony, Uttarahalli Hobli, Bengaluru 560061, Karnataka, India

Privacy contact

privacy@nirmithai.com

Grievance Officer

Grievance Officer, Vrushabha Enterprises, privacy@nirmithai.com, +91 90353 71220

Kalrava handles two kinds of personal data, and the rules differ.

• Your account data (you, as a Kalrava user): your name, email, workspace, settings and the platforms you connect. For this data we decide how it is used, so under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary.
• Your business's contacts (leads, customers, people who message your business on WhatsApp or website chat). The business that owns the Kalrava workspace decides why this data is collected; it is the Data Fiduciary, and we are its Data Processor. We only use this data to provide Kalrava to that business, under our Terms.

If you are a contact of a business that uses Kalrava, please send privacy requests to that business first. We will help them answer you.

• Account: name, work email, password (stored only as a one-way hash), role, product access, and invitations.
• Workspace content: brand details, products, goals, drafts, images, videos, plans, approvals and activity history.
• Contacts and conversations: names, phone numbers, emails, company details, consent records, and messages exchanged on WhatsApp, email or website chat.
• Calls and meetings: WhatsApp call audio and transcripts, and meeting transcripts from tools you connect (such as Fireflies or Microsoft Teams), only when the feature is on and the people involved have been told.
• Connected platforms: access tokens and the platform data described in section 04.
• Usage and device: sign-in times, IP address, browser type and error logs, used to keep the service secure and working.
• Billing: plan, wallet balance, usage of AI credits and messages. We do not store card numbers.

You can connect your own Google (YouTube), LinkedIn and Meta accounts to a Kalrava workspace. We only ask for the permissions a feature needs, you see them on the platform's own consent screen, and you can disconnect at any time from Integrations in Kalrava or from the platform's settings. Some of these features are being rolled out; this policy already covers them.

Data from a platform is used only for the workspace that connected it, is never moved into another workspace, and is never combined with data from other platforms to build profiles of people. Each platform also handles your data under its own policy: Google, LinkedIn, Meta.

Kalrava's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide and improve the user-facing features you see in Kalrava, such as publishing to and reporting on your YouTube channel.
• We do not transfer it to others, except as needed to provide those features, to comply with law, or as part of a merger or sale with notice to you.
• We do not use it for advertising, and we do not sell it.
• We do not use it to train or improve general-purpose AI or machine-learning models.
• No person reads it unless you ask us to (for example in a support request), it is needed for security or to investigate abuse, it is required by law, or it is aggregated and anonymised for internal operations.

Kalrava uses YouTube API Services. By using the YouTube features you agree to be bound by the YouTube Terms of Service, and Google's use of your data is covered by the Google Privacy Policy. You can revoke Kalrava's access at any time on your Google Account permissions page. When you revoke or disconnect, we delete the YouTube data we stored within 7 days, and we refresh or delete stored YouTube statistics at least every 30 days.

Kalrava uses AI models to draft posts, replies and plans, summarise conversations and meetings, generate images and answer calls. To do this, the relevant text, images or audio are sent to the AI provider chosen for your workspace: Anthropic (Claude), Google (Gemini), OpenAI or xAI for text and images, and Sarvam AI or ElevenLabs for speech.

• We use these providers' business APIs, whose terms do not allow them to train their models on your data.
• If your workspace uses its own API key, your data goes to that provider under your own agreement with them.
• AI chat and call assistants say they are automated, and hand over to a person when asked.
• AI drafts are proposals. Nothing is published or sent outside your business without a person's approval, unless you have chosen a fully automatic setting.

We do not sell personal data. We share it only with service providers that help us run Kalrava, under contract, and only what they need:

Hosting

Our servers and database, rented from a hosting provider; encrypted nightly backups

AI

Anthropic, Google (Gemini), OpenAI, xAI, Sarvam AI, ElevenLabs, as chosen per workspace

Messaging

Meta (WhatsApp Cloud API), Brevo (email)

Meetings

Cal.com (booking), Fireflies (recording and transcripts), Microsoft (Teams), when connected

Social platforms

Google (YouTube), LinkedIn, Meta (Facebook, Instagram), only to do what you asked, such as publishing a post

We may also share data with professional advisers under confidentiality, with authorities when the law requires it, or with a buyer of our business, who must keep this policy's promises. Some providers process data outside India, mainly in the USA and EU. The DPDP Act allows this except to countries the Government restricts.

Platform tokens

Deleted immediately when you disconnect, or when the platform tells us access was revoked

Platform data (posts, stats, comments)

Deleted within 7 days of disconnecting; YouTube statistics refreshed or deleted at least every 30 days

Workspace content and contacts

While your workspace is active; deleted within 30 days after it is closed

Call recordings

90 days, unless your workspace sets a shorter period

Consent and opt-out records

As long as the law requires, so we never message someone who said stop

Backups

Encrypted, kept for 14 days, then overwritten

Security logs

At least 1 year, as the DPDP Rules require

• All traffic uses HTTPS. Platform tokens and API keys are encrypted (AES-256) before they are stored, and never shown in full in the app.
• Each workspace's data is kept apart at the database level, so one business cannot see another's.
• Access is limited by role inside each workspace. Our own staff access data only to support you or keep the service safe.
• If a personal data breach affects you, we will tell you and the Data Protection Board of India, as the DPDP Act and Rules require.

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and who we shared it with;
• correct, complete or update it;
• have it erased, unless the law requires us to keep it;
• withdraw consent at any time, as easily as you gave it (for WhatsApp, reply STOP);
• nominate someone to act for you; and
• complain to our Grievance Officer, and then to the Data Protection Board of India.

Write to privacy@nirmithai.com. We check it is you, do not charge, acknowledge within 48 hours and reply within 30 days. To delete data, see Data deletion.

The Kalrava app sets one strictly necessary cookie to keep you signed in. It does not use advertising or cross-site tracking cookies. The website chat widget stores a visitor ID in the browser so a conversation can continue.

Kalrava is for businesses and people aged 18 or over. We do not knowingly collect data from children. Schools using Kalrava to market to parents are responsible for any parental consent the law requires.

When we change this policy we update the version and date above, and tell workspace owners by email before material changes take effect. Questions: privacy@nirmithai.com · +91 90353 71220 · 3rd Floor, Lakshmi Arcade, 3, Uttarahalli Main Rd, Friends Colony, Uttarahalli Hobli, Bengaluru 560061, Karnataka, India.