Privacy Policy

1. Who is responsible for your data

For data about visitors to our website, people who sign up, and the contacts and payers of our customers, Vijayastra decides why and how the data is processed and is the Data Fiduciary under the DPDP Act.

Our customers use Karnovate to run their own businesses: they put their employees, customers, vendors, invoices and documents into their workspace. For that content the customer is the Data Fiduciary and we are its Data Processor: we process it only to provide the Services and on the customer's instructions, as set out in our Terms of Service. If your data is in a customer's workspace (for example, you are an employee of a company that uses Karnovate HRM), please contact that company first; we will help them respond.

2. Personal data we process

Depending on how you use the Services, we process the following:

• Account data: your name, work email address and password when you create an account. Passwords are stored only as salted hashes; we cannot read them.
• Company data: your company name, industry, website, registered address, pincode, state and district, and the name, email and phone number of its primary contact.
• Billing and verification data: the billing contact's name and mobile number, the GSTIN, PAN and authorised signatory details you give us to verify your company before payment, invoices, and the subscription, plan and payment status.
• Payment data: payments are processed by Razorpay. We receive payment, order, mandate and customer references and the outcome of each payment, and the last digits or type of the method used. We do not receive or store full card numbers, CVVs, UPI PINs or net-banking credentials.
• Usage and device data: IP address, browser and device type, pages and features used, sign-in times, and security and audit logs created when you use the Services.
• Communications: emails, support requests and feedback you send us, and verification codes and notifications we send you.
• Demo and early-access requests: your name, work email, mobile number, company, company size, the products you are interested in, your message, the page you sent it from and the campaign that brought you to the site. We use them to contact you about Karnovate, and send product news only if you tick the box for it.
• Website analytics: how visitors use karnovate.com, collected with Google Analytics (see section 6).
• Calculator inputs: figures you enter in our free GST, TDS, payroll and income-tax calculators are worked out in your browser and are not stored by us.

3. Why we use it

We process personal data only for the following purposes, and only as much as each needs:

• To create and secure your account and workspace, verify your email address, and sign you in.
• To provide, maintain and support the Karnovate products you subscribe to.
• To price your package, take payments, run free trials and renewals, raise GST invoices and keep the accounting and tax records the law requires.
• To verify a business before it pays, and to prevent fraud, abuse and security incidents.
• To send service messages: verification codes, trial and renewal reminders, payment receipts, security alerts and changes to our terms.
• To understand how the website and products are used so we can improve them.
• To meet legal obligations and respond to lawful requests from authorities.

4. Consent and legitimate uses

Where we rely on your consent, we ask for it clearly, for a specified purpose, and you can withdraw it at any time with the same ease, by writing to us or our Grievance Officer. Withdrawing consent does not affect processing that already happened, and we may be unable to continue a service that depends on it.

We also process personal data for the legitimate uses the DPDP Act allows without fresh consent, such as data you provide voluntarily for a specified purpose (for example, to sign up or pay), to comply with a law or a court order, and to respond to a medical emergency or a threat to safety.

5. Who we share it with

We do not sell personal data. We share it only with service providers that process it for us under contract, with confidentiality and security obligations, and only as much as each needs:

• Our hosting provider, Webyne, which runs our servers, databases and backups on private servers in India.
• Razorpay Software Private Limited, which processes payments, subscriptions and e-mandates as a payment aggregator regulated by the Reserve Bank of India.
• Email and SMS delivery providers, which send verification codes, notifications and receipts.
• Google, which provides Google Analytics on our website.
• Professional advisers, such as auditors and lawyers, under a duty of confidentiality.
• Government, regulatory and law-enforcement authorities, when the law requires us to.
• A buyer or successor of our business, if Vijayastra is merged or acquired, subject to this Policy.

6. Cookies and Google Analytics

The Karnovate products use cookies and browser storage that are strictly necessary to sign you in, keep your session secure and remember your progress through sign-up.

Our website, karnovate.com, uses Google Analytics 4, provided by Google LLC, to count visits and understand which pages and calculators are useful. Google Analytics sets cookies (such as _ga) and collects information such as the pages you view, how you arrived, your approximate location, and your device and browser. Google Analytics 4 does not log or store full IP addresses. We use these reports in aggregate and do not use them to identify you. Google processes this data under its own privacy policy, which you can read at policies.google.com/privacy.

You can block or delete cookies in your browser settings, or opt out of Google Analytics on all websites with the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). Blocking analytics cookies does not affect your use of the website.

7. Where your data is stored

The Karnovate products and their data, with backups, are hosted on private servers in India. Some service providers, such as Google for website analytics and our email delivery providers, may process the data they handle for us outside India. We transfer personal data outside India only as the DPDP Act permits, and not to any country the Central Government has restricted.

8. How long we keep it

We keep personal data only as long as the purpose needs it or the law requires, then erase it:

• Account, company and workspace data: for as long as the subscription is active. A subscription ends when it is cancelled (at the end of the period paid for), when a renewal stays unpaid after a 30-day grace period (the workspace is then suspended), or when a free trial ends unpaid (the workspace becomes read-only: you can still sign in, view and export everything). We keep the workspace for 90 days after that; paying in that time restores full access. After 90 days the workspace is closed and its data deleted, except records the law requires us to keep.
• Invoices, payment and tax records: for at least eight years, as the Companies Act, 2013 and the Central Goods and Services Tax Act, 2017 require.
• Free trials taken: when a workspace is deleted we keep a one-way hash of the owner email address, the company email domain and the fingerprint the payment provider gives the card or account used (never the number itself), so the same company cannot start a second free trial. None of these can be turned back into the email address or the card, and they are kept for as long as we offer free trials.
• Security and system logs: for 180 days, as the CERT-In directions under section 70B of the IT Act require, and longer only while an incident is being investigated.
• Sign-ups that are never completed: what you type during sign-up stays in your browser tab until you close it, and email verification codes expire after 10 minutes. A workspace created at sign-up but never paid for or started as a trial is abandoned after 14 days and its data deleted within the following 90 days.
• Demo and early-access requests: for 24 months after we last hear from you, unless you become a customer or ask us to delete them sooner.
• Website analytics: Google Analytics data is kept for up to 14 months.

9. How we protect it

We use reasonable security safeguards to prevent personal data breaches, including encryption in transit (TLS), access controls on the principle of least privilege, separation of each customer's workspace, logging and monitoring, and regular backups. No system is perfectly secure; if a personal data breach happens, we will inform the Data Protection Board of India and each affected person as the DPDP Act requires.

10. Your rights

As a Data Principal under the DPDP Act you have the right to:

• Get a summary of the personal data we process about you and the processing activities, and the identities of the Data Fiduciaries and Data Processors we have shared it with.
• Have inaccurate or misleading data corrected, incomplete data completed, and data updated.
• Have your data erased when it is no longer needed for the purpose it was collected for, unless the law requires us to keep it.
• Withdraw consent you have given, at any time.
• Have your grievances redressed by our Grievance Officer, and then by the Data Protection Board of India.
• Nominate another person to exercise these rights if you die or become incapable.

11. How to exercise your rights

Most account details can be changed in your workspace. For anything else, write to our Grievance Officer (section 13) from the email address on your account. We may need to verify your identity before acting. We respond within 30 days, and sooner where the law sets a shorter period.

You also have duties under the DPDP Act: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.

12. Children

The Services are for businesses and are not meant for anyone under 18. We do not knowingly process the personal data of children. If you believe a child has given us personal data, contact us and we will delete it.

13. Grievance Officer and contact

If you have a question or complaint about how we handle personal data, contact our Grievance Officer:

Email: support@karnovate.com

Address: Vijayastra Technologies Private Limited, Building Number 9, 13th Floor, Madhapur, Shaikpet, Hyderabad, Telangana – 500081, India

We aim to resolve grievances within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

14. Changes to this Policy

We may update this Policy as the Services or the law change. We will post the new version here with a new "Last updated" date and, for material changes, tell account owners by email or in the product before the change takes effect.