1. Introduction & Data Controller Identity
This Privacy Policy describes the policies and procedures of Koravio Technologies (“Koravio”, “We”, “Us”, or “Our”) on the collection, use, storage, disclosure, and protection of personal data and confidential business information when you visit our website, utilize our software platforms, or deploy our autonomous AI sales agents and workflow automations (the “Services”).
Depending on the jurisdiction and context of processing:
- As a Data Fiduciary / Controller: Koravio acts as the Data Fiduciary (under the India Digital Personal Data Protection Act, 2023) or Data Controller (under the EU General Data Protection Regulation) solely regarding personal data collected directly from our website visitors, registered account users, billing contacts, and demo applicants.
- As a Data Processor & Technical Intermediary: Koravio operates strictly as a Data Processor and technological intermediary within the meaning of Section 79 of the Information Technology Act, 2000 when hosting, synchronizing, or transmitting Customer Data (including prospect lists, customer records, CRM contacts, and communications) strictly under the direction and contractual instructions of our business customers.
2. Categories of Data Collected
We collect information only to the extent necessary to provide reliable, secure enterprise software and autonomous agent workflows.
A. Information You Voluntarily Provide
- Account & Profile Details: Full name, business email address, corporate telephone number, job title, company name, and physical office location.
- Billing & Financial Information: Company GSTIN, PAN number, billing address, and transaction identifiers. (Note: Credit card numbers and bank credentials are processed directly by certified, PCI-DSS compliant payment gateways such as Razorpay or Stripe; Koravio never stores raw payment card numbers).
- Customer Inquiries & Communications: Transcripts of emails, chat messages, support tickets, and scheduling inquiries sent to our desk.
B. Third-Party Integration Tokens & Credentials
- OAuth Access Tokens: When you connect communication channels (such as Google Workspace, Microsoft 365, LinkedIn, WhatsApp Cloud API, or CRM tools), we receive encrypted OAuth tokens and authorized scopes necessary to synchronize messages and dispatch cadences on your instruction.
- Hardware Vault Encryption: All integration tokens and webhook secrets are stored in hardware security vaults encrypted via AES-256 at rest.
C. Technical, Telemetry & Log Data
- Automated Telemetry: IP address, device type, operating system version, browser user-agent, API execution latency, webhook delivery statuses, and error logs generated during software operation.
3. Lawful Basis & Specific Purposes of Processing
Koravio processes data strictly under recognized lawful bases, including:
- Performance of a Contract: Providing, maintaining, and supporting the Services; executing workflow pipelines; generating 1-to-1 personalization hooks; and synchronizing CRM updates as specified in our contractual agreement.
- Legitimate Interests: Securing our infrastructure against cyber threats, detecting fraud, monitoring API throughput, and preventing abuse of our systems.
- Legal & Regulatory Compliance: Fulfilling tax obligations (such as Indian GST reporting), corporate accounting requirements, and responding to mandatory judicial subpoenas.
- Explicit Consent: Sending marketing newsletters or product updates where you have explicitly opted in (which you may withdraw at any time).
4. Zero AI Foundation Model Retraining Guarantee
When our autonomous agents (such as Writer Agent or Reply Agent) synthesize personalized openers or contextual answers, customer prompts and context are transmitted through zero-retention enterprise API endpoints with encryption in transit. Your corporate context is isolated within your dedicated tenant and erased from runtime inference buffers immediately after execution.
5. Third-Party Sub-Processors & Data Sharing Restrictions
We do not sell, rent, lease, or trade personal data to third-party advertisers, data aggregators, or marketing brokers under any circumstances.
We share data only with trusted enterprise sub-processors under strict confidentiality and data protection agreements:
- Cloud Hosting & Content Delivery: Cloudflare Inc., Amazon Web Services (AWS), and Vercel Inc. for secure content delivery, edge caching, and server compute.
- Official Communication Endpoints: Meta Platforms, Inc. (Meta WhatsApp Cloud API), Google LLC (Google Workspace APIs), and Microsoft Corporation (Graph APIs) to transmit approved customer communications.
- Payment Processing: Razorpay Software Private Limited and Stripe Inc. for processing commercial subscription invoices under PCI-DSS Level 1 compliance.
- Statutory & Legal Authorities: Disclosed only when strictly compelled by a valid, unappealable court order or statutory requirement under Indian law.
6. Security Architecture, Vaults & Technical Safeguards
Koravio employs multi-layered technical, physical, and administrative security measures designed to protect information against accidental loss, unauthorized access, destruction, and disclosure:
- Bank-Grade Encryption: All sensitive customer data, API credentials, and database records are encrypted using AES-256 at rest and transmitted using TLS 1.3 over public networks.
- Tenant Isolation: Logical data segregation prevents cross-tenant access between different customer accounts.
- Role-Based Access Control (RBAC): Employee access to production databases is strictly restricted on a least-privilege basis, requiring hardware MFA and immutable audit logging.
- Continuous Vulnerability Monitoring: Regular automated security vulnerability assessments and code audits to safeguard against threats.
7. International Data Transfers
Koravio operates globally with primary cloud infrastructure located in secure, ISO 27001 and SOC-2 certified data centers. If data originating from the European Economic Area (EEA), the United Kingdom, or other jurisdictions with cross-border transfer restrictions is transferred to servers outside those territories, such transfers are governed by standard contractual clauses (SCCs) approved by the European Commission or equivalent statutory transfer mechanisms.
8. Data Retention & Permanent Deletion SLA
We retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.
Customer Data Deletion on Request: Upon account termination or receipt of a formal written deletion request submitted to hello@koravio.in, Koravio will permanently purge all Customer Data, OAuth tokens, and database records from active production servers within thirty (30) days, subject only to statutory tax retention periods required by Indian law.
9. Individual Data Subject Rights (DPDP Act, GDPR & CCPA)
Depending on your location and applicable law, you possess fundamental privacy rights regarding your personal data:
- Right of Access & Summary: You have the right to request a summary of the personal data Koravio holds concerning you.
- Right to Correction & Rectification: You may request the correction of inaccurate, misleading, or incomplete personal data.
- Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data when it is no longer necessary for the purpose it was collected.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.
- Right of Grievance Redressal: You have the right to file a grievance with our designated Grievance Officer regarding any data processing concern.
To exercise any of these rights, please submit a written request to hello@koravio.in. We respond to all verified requests within thirty (30) calendar days.
10. Cookies & Tracking Technologies Policy
Our website uses cookies and similar technologies solely for functional operation and aggregate traffic analysis:
- Strictly Necessary Cookies: Essential for session management, security authentication, and remembering your user preferences.
- Performance & Analytics Cookies: Measure aggregate visitor counts, page load speeds, and navigation patterns without identifying individual visitors.
We do not employ third-party cross-site behavioral advertising cookies or sell your browsing history. You may configure your web browser to block or delete cookies at any time; however, certain interactive features of our dashboard may become inaccessible.
11. Statutory Grievance Redressal Officer (Mandated under Indian Law)
In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, Koravio Technologies has designated a formal Grievance Redressal Officer to handle data privacy concerns, statutory notices, and compliance inquiries:
Grievance Redressal Officer — Data Protection
Statutory Response Timeline: All formal grievances received by the Grievance Officer will be acknowledged within 24 hours and addressed within thirty (30) calendar days as mandated by applicable law.
12. Changes to this Privacy Policy & Contact Desk
We may revise this Privacy Policy periodically to reflect technological updates, regulatory changes, or operational enhancements. When changes are made, we will update the “Last Updated” date at the top of this document. We encourage you to review this policy periodically to stay informed about our data protection standards.
If you have any questions or require custom Data Processing Agreements (DPAs) for enterprise compliance, please reach out to our privacy desk:
Koravio Technologies Privacy Desk:
Email: hello@koravio.in · Telephone: +91 78059 25267
Indore, Madhya Pradesh, India