Privacy Policy

1. Two roles, kept separate

For your own account data — your name, email, phone, billing details — we decide how it is used, so we are responsible for it.

For lead and customer data inside your workspace, you decide. You choose who to contact and why; we hold and process it on your instructions. If one of your leads asks what you hold about them, that request belongs to you, and we will help you answer it.

2. What we collect

Account and profile data you give us:

• Name, email address, phone or WhatsApp number, and password (stored only as a salted hash).
• Your business name, workspace name and your role in it.
• Billing information — handled by Razorpay; we receive a payment reference and status, never your full card number.
• Content you put in: leads, customers, notes, call outcomes, statuses, files you upload.
• Technical data needed to run and secure the service: IP address, browser and device type, timestamps, and error logs.
• Product usage — which pages and features are used — so we know what to fix and what to build.

3. Why we use it

Each purpose is tied to something you asked for:

• To provide the service — authenticate you, show your workspace, assign leads, run the AI features you use.
• To bill you and keep records required by tax and accounting law.
• To send transactional email you need: verification, password reset, invitations, receipts, alerts you configured.
• To keep the platform secure — detect abuse, investigate incidents, enforce our terms.
• To support you when you write in, and to improve the product.
• We do not sell personal data, and we do not run third-party advertising trackers on the product.

4. AI processing

Where you use an AI feature, the specific content needed for that task is sent to our AI provider to generate the output — a score, a draft note, a draft reply. It is processed to answer that request and returned to you.

We do not use your workspace content to train general-purpose models, and our providers are engaged under terms that prohibit training on our customers' data. If you would rather not use AI features at all, they can be left switched off.

5. Who we share it with

We use a small number of processors, each for a specific job:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and delivery.
• Razorpay — payment processing for Indian customers.
• Resend — transactional email delivery.
• Cloudflare R2 — storage for files you upload.
• Our AI provider — generating the AI output you request.
• Platforms you connect yourself, such as WhatsApp, Meta or Google, receive only what is needed to perform the action you asked for.
• We also disclose data where the law requires it, and to professional advisers under confidentiality.

6. Where your data is held

We host in regions chosen to keep Indian customers' data close to them. Some processors above operate globally, so data may be processed outside India under contractual protections. If your organisation has a data localisation requirement, write to us before you sign up and we will tell you plainly whether we can meet it today.

7. Cookies and local storage

We keep this minimal. There are no advertising or cross-site tracking cookies on AbhiKai.

• A session cookie that keeps you signed in — strictly necessary.
• A small preference entry remembering your light or dark theme.
• Security cookies used by our bot-protection check on the signup and login forms.
• Marketing pages set no cookies at all until you sign in.

8. How we protect it

Technical measures we actually have in place:

• Every workspace is isolated by row-level security in the database, so one business's queries cannot return another's rows.
• Access is scoped by role, enforced server-side — a salesperson cannot reach a colleague's leads by editing a URL.
• Encrypted in transit with TLS, and encrypted at rest by our infrastructure providers.
• Passwords are never stored in plain text. Secrets and API keys are server-side only.
• Uploaded files sit in private storage and are served through short-lived signed links.
• No security is absolute. If a breach affects your data we will tell you and the relevant authority without undue delay.

9. How long we keep it

Your workspace data is kept while your account is active. After you delete your account we retain it for 30 days so you can recover from a mistake, then delete it from live systems; backups age out within a further 90 days.

Records we must keep for tax, accounting or fraud-prevention reasons are held for as long as the law requires, even after deletion of the rest.

10. Your rights

For data we hold about you as our customer, you can ask us to:

• Give you a copy of it, or tell you what we hold.
• Correct it if it is wrong or incomplete.
• Delete it, where we are not required to keep it.
• Withdraw consent for anything you consented to, and stop non-essential email.
• Nominate someone to exercise these rights if you are unable to.
• Email us with Data request in the subject line. We will verify who you are and respond within 30 days. If you are a lead of one of our customers, contact that business directly — they hold the relationship, and we will help them respond.

11. Grievances

If you are unhappy with how we have handled your data or a request, write to us with Grievance in the subject line and it will be escalated. If we cannot resolve it, you may complain to the relevant data protection authority in India.

We will name a designated grievance officer here as required once the account thresholds under Indian data protection rules apply to us.

12. Children

AbhiKai is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child's data has reached us, tell us and we will delete it.

13. Changes to this policy

We will update this page when our processing changes, and the date at the top tells you which version you are reading. For material changes affecting your rights we will notify you by email or in the product.