Privacy Policy

Data We Collect

• Account data: Name and email address, from Google sign-in.
• Trade queries: What you type or say in Chat Hub, and the product, destination and budget in it.
• Subscription status: Plan (Free, Starter or Growth) and the payment confirmation ID from Razorpay.
• Inventory data: Products, quantities and grades you enter or upload.
• Documents and photos: Anything you upload for us to read, such as a ledger, invoice, visiting card or list.
• Voice: Audio you record is turned into text. We keep the text, not the audio.
• Truck tracking: If a driver taps Start on a tracking link, the driver's phone sends its location every 2 minutes while the page is open, along with the vehicle number and the route you entered. Tracking runs only after that tap, and the driver can stop it by closing the page.
• Desk and CRM data: For desk customers, the contacts, deals, notes and documents their team adds. That can include details of people who are not our users, such as their buyers. The customer decides what goes in and is responsible for having the right to add it.
• Usage signals: Which pages and features are used, with a coarse place (city and country) and the browser type. No IP address is stored.

We do not collect biometric data, or location other than the truck tracking above and the coarse place above.

How We Use Your Data

• To answer your trade queries and read what you upload.
• To match your inventory to buyers and opportunities.
• To show a truck's position and send arrival and delay alerts to the person who added it.
• To manage your subscription and send transactional emails.
• To improve our service using aggregate, anonymised query patterns.

Your data is never sold. It is never used for advertising. We opt out of AI training wherever a provider lets us.

One organisation's data is never shown to another. Desk data stays inside that desk. It enters a shared market figure only if the customer chooses that in writing, and then only as an aggregate of at least five contributors.

AI Agents and the API

The MCP server (kalpsetu.co.in/mcp) and the ERP API need no account and read no one's data. For each call we keep the tool or endpoint, the arguments sent, whether it worked, a coarse place (city and country, from our host's location headers) and the caller's user agent. No IP address is stored. We use this to see which questions get asked and to keep the service working.

Who Processes Your Data

These companies process data for us. Several are outside India, so your data may be handled in the United States or elsewhere.

• Google: sign-in only. We receive your name and email and nothing else from your Google account.
• Razorpay: payments. Card data never touches our servers.
• Airtable: our database, in the United States.
• Vercel: hosts the site and runs our servers.
• Resend: sends our email.
• Anthropic (Claude): answers queries and reads uploaded documents. Its terms bar training on our data, and it deletes API data within 30 days, subject to its usage-policy and legal exceptions.
• Sarvam AI: speech to text, text to speech, translation, query understanding, and filling in text from uploaded documents that Claude could not read. Sarvam's policy lets it use content to improve its models unless a customer opts out, and we have turned this off for our account. By default it keeps content for 30 days after last access, and it may process data outside India.
• Perplexity AI: live market searches. Your query, or the trade terms from it, may be sent.
• OpenStreetMap services: truck route and place names. Coordinates of a tracked truck are sent to these public services. No name or vehicle number goes with them.

We check these companies' privacy and data terms every day and update this page if a change affects you.

Data Retention

• Account, trade and inventory data is kept while your account is active.
• When you close your account or ask us to delete it, your personal data is deleted within 30 days. Tell us at the address below.
• Voice recordings are not stored by us. Only the text is kept.
• Driver positions are removed 90 days after a trip ends. The trip record stays, without them.
• A desk customer's data is kept for the length of their contract and deleted on their written request.
• Aggregate data with no personal identifiers may be kept longer.

Your Rights — DPDP Act 2023

Under India's Digital Personal Data Protection Act 2023, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Erase your personal data (right to be forgotten).
• Withdraw consent at any time (this may affect your ability to use the service).
• Nominate a person to exercise these rights on your behalf.

To exercise any of these rights, email: parth@kalpsetu.co.in. We will respond within 30 days. If you are a driver, or a person listed in a customer's desk, you can write to us too.

Cookies & Local Storage

We use browser localStorage to maintain your session (login state, language preference). No advertising cookies. No third-party tracking cookies.

Security

All data in transit is encrypted via TLS. API credentials are stored in environment variables and never exposed in frontend code. We apply rate limiting, HMAC signature verification on payment webhooks, and input sanitisation on all user inputs.

Contact

Data protection and grievances: Parth Patel, Director, parth@kalpsetu.co.in
KalpSetu Technologies Private Limited · 3rd Floor, Regus, Vadodara, Gujarat 390001