Privacy Policy

1. Data we collect

• Account data: the name, email address and mobile number of the agency users you register.
• Client contact data: the name, email and mobile number of your clients' points of contact, which you provide in order to invite them to a workspace.
• Content: workspaces, tasks, comments, files and related content that you and your clients upload to the Service.
• Payment data: when you subscribe, payment is processed by Dodo Payments, which acts as our Merchant of Record. We receive limited transaction details (such as status, amount and a payment/subscription identifier) but do not store full card details.
• Usage and device data: log data, device and browser information, and product analytics used to operate, secure and improve the Service.

2. How we use data

We use personal data to provide and secure the Service, authenticate users, process subscriptions and payments, send service and onboarding emails, provide customer support, comply with legal obligations, and improve the product.

3. Legal basis and consent

We process personal data to perform our contract with you, with your consent where required, and for other lawful purposes under the DPDP Act. You may withdraw consent as described in Section 7.

4. Sharing and sub-processors

We do not sell personal data. We share it with service providers ("data processors") who help us operate the Service, under appropriate safeguards:

• Supabase — database, file storage and authentication (hosted in India, ap-south-1 region).
• Resend — transactional email delivery.
• Dodo Payments — payment processing (Merchant of Record).
• PostHog — product analytics.
• Sentry — error monitoring.
• Vercel — application hosting.

We may also disclose data where required by law or to protect our rights, users or the public.

5. Where data is stored

Primary application data and files are stored in India (ap-south-1). Some sub-processors may process limited data outside India under appropriate safeguards.

6. Retention

We retain personal data for as long as your account is active and as needed to provide the Service. On deletion, content is soft-deleted and removed from storage after a grace period (approximately 30 days), unless longer retention is required by law.

7. Your rights

Subject to the DPDP Act, you may request access to, correction of, or deletion of your personal data, and may withdraw consent. The Service provides data export and deletion tools, and you can also contact us using the details below. We respond to verified requests within a reasonable time.

8. Security

We use industry-standard measures including encryption in transit, access controls and per-tenant data isolation. No system is perfectly secure, and we cannot guarantee absolute security.

In the event of a personal data breach, we will act promptly to contain and remediate it, and will notify the Data Protection Board of India and affected users where required under the DPDP Act.

9. Children

The Service is not directed to children under 18, and we do not knowingly collect their personal data.

10. Changes

We may update this Policy from time to time and will notify you of material changes through the Service or by email.

11. Grievance Officer / contact

For privacy questions or to exercise your rights, contact our Grievance Officer: Kajal Khatwani, Kalythe Growth Studio — Email: kalythegrowthstudio@gmail.com — Address: 51/6 Old Rajinder Nagar, New Delhi 110060.