Privacy policy

This policy explains how Kanishu Technologies ("we", "us") handles personal data when you visit our website, create an account, buy a subscription or use our products. Our registered address is U-001, Mantri Paradise, Arekere Gate, Bannergatta Road, Bangalore - 560076.

Two roles we play

• For your account and billing — the details you give us to sign up, buy and manage subscriptions — we decide why and how the data is used. Under the DPDP Act we are the data fiduciary.
• For the data your organisation puts into our products — tickets, assets, contacts, policies, vendor records and the like — your organisation decides what goes in and why. We process it only on your organisation's instructions, to run the product for you. Your organisation is the data fiduciary and we are its data processor. Requests about that data are best made to your organisation; we help them respond.

What we collect

• Account details: your name, work email, organisation name, and (if you give them) your GSTIN and state, so we can issue correct tax invoices.
• Billing records: what you bought, when, and what you paid. Payments are taken by Razorpay; we never see or store your full card, UPI or bank details — only the payment reference Razorpay gives us.
• Sign-in and security data: passwords (stored only as one-way hashes), multi-factor authentication settings, sign-in times and IP addresses, used to keep your account safe and to block abuse.
• Activity history: each product keeps a history of who added, changed or deleted what, so your organisation can audit its own records.
• Messages you send us, for example a support request.

We use only the cookies needed to keep you signed in and to protect forms against forgery. We do not use advertising or cross-site tracking cookies.

Why we use it

• To create and run your account and provide the products you subscribe to.
• To take payment, issue tax invoices and keep the accounting records the law requires.
• To send service emails: sign-in links, invoices, renewal reminders, and notices about your subscription.
• To keep the service secure, investigate misuse and meet legal obligations.
• To answer your questions and improve the service.

We rely on your consent, given when you sign up, and on the legitimate uses the DPDP Act allows, such as meeting a legal obligation. We do not sell personal data, and we do not use it for advertising.

Who we share it with

Only with the service providers we need to run the service, each bound to use the data only for us:

We name our hosting provider on request. If we change it, or move email to a separate mail service, this policy is updated before the change.

AI features. Our products can use artificial intelligence (for example, to summarise a ticket or explain a finding) only if your organisation switches it on and connects its own account with an AI provider (OpenAI, Anthropic or Google). The request then goes from our servers to that provider under your organisation's own agreement with them; we don't use a Kanishu account for it. Only the kinds of data your organisation allows are sent; until it allows some, none of its records are. We keep a note of each request (who, which feature, which provider, the outcome), never its text or the answer. Our products work fully with AI switched off.

We may also disclose data when the law requires it, for example to a court or a government authority acting lawfully. Some providers may process data outside India; where they do, it is only as the DPDP Act permits.

How long we keep it

• Account details: while your account is open, and afterwards only as long as needed to deal with a question about it.
• Invoices and billing records: 8 years, as tax and company law require.
• Your organisation's product data: while the subscription is active, and for 30 days after it ends (so it can be renewed or exported — after the first 7 days as a full copy your account holder downloads from Kanishu Hub); then it is deleted. Your organisation can ask us to delete it sooner.
• Logs (errors, requests, security events): at least 180 days, as Indian law (CERT-In) requires, and no longer than our published period (today 180 days). They hold ids and network addresses, not the contents of your records.
• Backups: daily backups are kept for up to 60 days. Data deleted from the service disappears from backups within 60 days, as older backups expire.

How we protect it

Each customer's product data is kept in its own separate database. Connections are encrypted (HTTPS). Passwords are hashed, stored secrets are encrypted, and staff access to the platform needs multi-factor authentication. Read more on our Security page. If a personal data breach occurs, we will inform affected people and the Data Protection Board of India as the law requires.

Your rights

Under the DPDP Act you can:

• ask what personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it, unless the law requires us to keep it;
• withdraw your consent at any time (this won't affect what we did before you withdrew it, and we may no longer be able to provide the service);
• name a person you trust to act on these rights for you, should you ever be unable to do so yourself;
• complain to our Grievance Officer, and then to the Data Protection Board of India if you are not satisfied.

To exercise any of these, email our Grievance Officer (below). We answer requests within 30 days. If you are not satisfied with our answer, you can contact our Grievance Officer, and then the Data Protection Board of India.

Children

Our products are for businesses. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

If we make a significant change, we will email account holders before it takes effect. The date at the top shows when this policy was last updated.