This policy explains how [ElevAIte Labs, full legal entity name and registered address to be confirmed] ("ElevAIte Labs", "we", "us") handles personal data in connection with Kredoo (kredoo.in). It is written in plain language. If anything is unclear, write to [privacy@kredoo.in].
1. Two different roles
We handle personal data in two different capacities, and it matters which one applies.
When a business uses Kredoo to talk to its own customers, that business is in charge of the data. If you messaged a clinic, an estate agent, a travel company or a shop on WhatsApp or Instagram and they use Kredoo, then that business decides what is collected about you and why. Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") the business is the Data Fiduciary and we are its Data Processor: we store and process the data only on its instructions, under our Data Processing Agreement. To see, correct or delete your data, or to stop receiving messages, contact that business directly. On WhatsApp you can usually reply STOP. If you cannot reach the business, write to us and we will pass your request on.
When you sign up for Kredoo, visit our website or contact us, we are in charge of the data. For that data we are the Data Fiduciary, and the rest of this policy describes what we do with it.
2. What we collect about our own users and visitors
- Account details: your name, email address, mobile number, business name, role, password (stored only as a one-way hash) and settings.
- Verification records: the code you send us on WhatsApp to prove your mobile number, and when it was verified.
- Billing details: plan, amounts, invoices and payment status. Card and bank details are entered with our payment provider and are not stored by us.
- Records of what you agreed to: which version of our terms, privacy policy and DPA you accepted, when, from which IP address and browser.
- Usage and security logs: IP address, browser and device information, sign-in times, and an audit trail of sensitive actions in your workspace (for example changing a team member's role).
- Website and enquiry data: what you tell us through our contact or get-started forms, and analytics about how visitors use our marketing website (see section 7).
3. What a business's Kredoo workspace contains
So you know what is involved when a business uses Kredoo, a workspace can contain: contacts' names and phone numbers, WhatsApp and Instagram messages and media exchanged with the business, lead details and notes the business adds, booking details, answers given in forms and conversation flows, information about the ad or link that brought a contact in, and call recordings or transcripts where the business uses voice calls. We keep this data to provide the business's inbox, automations, AI replies and conversation history. We do not use it for our own marketing and we do not sell it.
4. How we use our users' data
- to create and run your account and workspace, and to verify your email and mobile number;
- to provide support and send you service messages (for example security alerts, billing reminders and changes to these documents);
- to keep Kredoo secure, prevent abuse and investigate problems;
- to bill you and keep records the law requires;
- to understand how the product is used so we can improve it;
- with your consent, to send you product news, which you can stop at any time.
Our basis for this is your consent, or, where the DPDP Act allows it, a legitimate use such as performing the service you asked for or complying with the law.
5. Who we share data with
We do not sell personal data. We share it only with service providers who help us run Kredoo, under contracts that limit what they can do with it. The current list is in the Data Processing Agreement and includes:
- Meta Platforms (WhatsApp Business Platform and Instagram), to send and receive the messages a business sends through Kredoo;
- hosting providers: Amazon Web Services (Mumbai region, India) and Hostinger (India) [LAWYER TO CONFIRM data centre locations for each environment];
- AI providers such as OpenAI and Anthropic, only when a business turns on AI features (see section 6);
- voice and telephony providers, only when a business uses AI voice calls;
- our payment provider, for subscription payments;
- our email provider, to send verification codes and account emails.
We may also disclose data if the law requires it, to protect people's safety, or as part of a sale or reorganisation of our business (in which case this policy continues to apply).
6. AI processing and data outside India
When a business turns on AI features in Kredoo, the text of the relevant conversation and related details (for example the contact's name, lead fields and the business's knowledge base content) are sent to the AI provider configured for that workspace to generate a reply or draft. These providers, for example OpenAI, may process data outside India, typically in the United States. Each business chooses whether to use AI features.
The DPDP Act allows personal data to be processed outside India except in countries the Government of India restricts by notification. We will not transfer data to a restricted country.
7. Cookies and analytics
The Kredoo app uses your browser's local storage to keep you signed in. Our marketing website uses Google Analytics and Google Ads tags to measure visits and signups. [LAWYER TO CONFIRM whether a cookie notice or consent banner is required for the marketing site.]
8. How long we keep data
- Account data: while your account is open, then deleted or anonymised within [90 days] of closure.
- Workspace data (contacts and conversations): while the workspace is open, and as the business instructs. After a workspace is closed it is deleted within [90 days], except copies in backups, which expire within [35 days] after that. [ENGINEERING TO CONFIRM these periods match actual practice before launch.]
- Billing records and consent records: as long as the law requires (for example tax law), which can be several years.
- Security logs: up to [12 months].
9. How we protect data
Connections to Kredoo are encrypted in transit (HTTPS/TLS). Access tokens, API keys and similar credentials are stored encrypted. Passwords are stored only as one-way hashes. Each business's data is kept separate from every other business's data, and access by our staff is limited to what is needed to run and support the service. [We encrypt stored conversations at rest. LAWYER AND ENGINEERING TO CONFIRM BEFORE LAUNCH: include this sentence only if at-rest encryption of conversations has shipped.]
No system is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Act requires.
10. Your rights
Under the DPDP Act you can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct, complete or update it;
- erase it, where we no longer need it or you withdraw consent (some records, such as invoices, must be kept by law);
- withdraw consent you gave us, as easily as you gave it;
- nominate someone to exercise these rights for you if you die or become incapacitated.
You also have the right to a grievance process. Write to our Grievance Officer at [privacy@kredoo.in] ([name of Grievance Officer to be confirmed]). We will respond within [the period required by the DPDP Rules]. If you are not satisfied, you can complain to the Data Protection Board of India.
For data held in a business's workspace (section 1), send your request to that business.
11. Children
Kredoo is a business tool and is not for anyone under 18. We do not knowingly collect children's data for our own purposes.
12. Changes
Each version of this policy has a version string shown at the top of the page. If we make a significant change, we will tell account holders and, where needed, ask for fresh acceptance in the app.
13. Contact
[ElevAIte Labs, registered address to be confirmed]
Email: [privacy@kredoo.in]