Privacy Policy
Effective date: 20 October 2026 · Last updated: 19 October 2026
1. Who we are and what this policy covers
This Privacy Policy explains how Kinnow Tech Private Limited ("Kinnow", "we", "us", "our") collects, uses, shares and protects personal data when you visit kinnow.ai, use the Kinnow Enterprise Reasoning Platform and its mobile or web applications, or otherwise interact with us (together, the "Services").
Kinnow Tech Private Limited is a company incorporated under the Companies Act, 2013, with CIN U58200KA2026PTC227038 and its registered office at 3rd Floor, Site No. 74, Mass Complex, 15th Cross Road, Sarakki Industrial Layout, Dollar Layout, 3rd Phase, J. P. Nagar, Bengaluru, Karnataka 560078, India.
This policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), the Information Technology Act, 2000 and the rules made under it, to the extent applicable.
2. Our two roles: Data Fiduciary and Data Processor
Kinnow handles personal data in two different capacities, and your rights depend on which one applies.
Where we are the Data Fiduciary. We decide why and how personal data is processed for our own purposes. This covers website visitors, people who sign up or request a demo, account administrators and users (for account, billing, security and support purposes), partners such as Chartered Accountant practices and resellers, job applicants, and people who contact us.
Where we are the Data Processor. Our business customers upload and generate data inside the Services - for example, ledgers, invoices, vendor and customer records, employee and payroll records, inventory, compliance filings and documents ("Customer Data"). The customer organisation decides what Customer Data is processed and why, and is the Data Fiduciary for it. We process Customer Data only on that customer's documented instructions, under our agreement with them.
If you are an employee, vendor, customer or other contact of a Kinnow customer, please direct requests about your data to that organisation first. We will assist them in responding as required by law and our agreement.
3. Personal data we collect
We collect only what we need to provide, secure and improve the Services.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, work email, phone number, designation, organisation name | You, your organisation's administrator, or a partner who onboards you |
| Account and access | Login credentials (stored in hashed form), roles, permissions, multi-factor authentication settings | You and your administrator |
| Business and billing | GSTIN, PAN of the organisation, billing address, purchase orders, payment status, credit purchases and usage | You or your organisation |
| Usage and device | IP address, browser and device type, operating system, pages and features used, timestamps, error logs | Collected automatically when you use the Services |
| Communications | Support tickets, emails, call notes, feedback, survey responses | You |
| Inputs to AI features | Questions, instructions, uploaded files and the results generated for you | You, while using the Services |
| Demo requests | Email, company name and website, industry, what you would like Kinnow to fix first, and the company name, one-line description and location shown on your company's own public website | You, and the public home and about pages of your company's own website |
| Partner and applicant data | Firm details of CA practices and resellers; CVs and interview notes of job applicants | You or the partner firm |
When you ask for a demo, we may read the public home page and "about" page of your company's own website (the address in your email, or the website you give us) to prepare the walkthrough. We note the company name, a one-line description and its location. We read only those two pages, take nothing from social networks or data brokers, keep the result in our own CRM for the people preparing your demo, and do not send it to you or anyone else. You can ask us to erase it by writing to [email protected].
We do not knowingly collect sensitive financial instruments such as card numbers or bank passwords. Payments are handled by licensed third-party payment processors, who receive card or bank details directly.
Customer Data (see Section 2) may contain any category of personal data the customer chooses to store, including employee, payroll and identity records. That data is governed by the customer's own privacy notice and our agreement with them.
4. How we use personal data
We use the personal data for which we are the Data Fiduciary to:
- create and manage accounts, authenticate users and enforce access controls;
- provide, operate, maintain and support the Services, including AI features you choose to use;
- meter usage, issue invoices, process payments and manage credits;
- detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms;
- improve the reliability, performance and usability of the Services, using aggregated or de-identified information wherever practicable;
- send service notices, security alerts and changes to our terms;
- send product updates and marketing, where you have consented or where permitted by law - you can opt out at any time;
- manage partner programmes and evaluate job applications; and
- comply with legal obligations, including tax, accounting, corporate and regulatory record-keeping, and respond to lawful requests from authorities.
We do not sell personal data. We do not use Customer Data to advertise to you or to anyone else.
5. AI features and your data
The Services include artificial-intelligence features that read, summarise, draft, reconcile, classify and recommend actions on information in your workspace. When you use them, we apply the following commitments.
Scoped processing. AI features process only the data needed to complete the task you or your organisation has requested, within the permissions of the user who requested it.
No cross-customer training. We do not use one customer's Customer Data to train or fine-tune any AI model that is made available to another customer.
Third-party AI providers. Where we use third-party technology to deliver an AI feature, we engage those providers under written contracts that restrict them to processing data for the purpose of delivering the Services, prohibit them from using Customer Data to train their own general-purpose models, and require appropriate security safeguards.
Service improvement. We may use aggregated and de-identified information about how features perform - for example, error rates, latency and whether a suggestion was accepted - to improve the Services. Such information does not identify you or your organisation.
Human oversight. AI outputs are suggestions. Actions with financial, legal, tax or statutory consequences are subject to the review and approval controls your organisation configures.
To protect the security and integrity of the Services, we do not publish details of the models, prompts, methods, configurations, workflows or internal logic used to deliver AI features. This does not limit any right you have under applicable law to information about the processing of your personal data.
6. Grounds for processing and consent
We process personal data on one of the following grounds under the DPDP Act:
- Consent - for example, marketing communications and non-essential cookies. Consent is free, specific, informed and unambiguous, and you can withdraw it at any time as easily as you gave it. Withdrawal does not affect processing already carried out.
- Legitimate uses - where you have voluntarily provided data for a specified purpose and have not objected (for example, sharing your contact details to request a demo), where processing is needed to comply with law or a court order, or for other legitimate uses recognised under Section 7 of the DPDP Act.
- Contract with our customer - for Customer Data, we process on the instructions of the customer, who is responsible for establishing a lawful basis.
7. How we share personal data
We share personal data only as described below, and only to the extent necessary.
Service providers (sub-processors). We use carefully selected providers for cloud hosting and storage, AI and computing infrastructure, email and messaging, customer support, analytics, payments and security. Each is bound by a written contract requiring confidentiality, security and processing only on our instructions. Customers may request our current list of sub-processors under a confidentiality agreement.
Within your organisation. Information you enter may be visible to other authorised users in your organisation according to the roles your administrator sets.
Partners you authorise. If your organisation engages a CA practice, reseller or implementation partner through Kinnow and grants them access, they will see the data that access allows.
Integrations you enable. If you connect the Services to a third-party application (for example, accounting, banking, tax or messaging systems), data flows to and from that application as you configure it, and is then governed by that provider's terms.
Legal and safety. We may disclose data where required by law, regulation, court order or a lawful request from a government authority, or to protect the rights, property or safety of Kinnow, our users or the public.
Corporate transactions. If Kinnow is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred subject to confidentiality obligations and this policy.
8. Where your data is stored and cross-border transfers
We host the Services in the relevant country. Each company account is hosted in its region: India accounts in India, and each other edition in its own region when it launches. Some service providers may process data outside the country where your account is hosted, for example for support, security monitoring or AI processing. Any transfer outside India is made in accordance with the DPDP Act and will not be made to any country or territory the Central Government has restricted. Where an enterprise agreement specifies data-residency commitments, those commitments apply.
9. How long we keep personal data
We keep personal data only as long as needed for the purpose it was collected for, or as required by law.
| Data | Retention |
|---|---|
| Account and contact data | For the life of the account, then up to 12 months for support, dispute and audit purposes |
| Customer Data | For the term of the customer agreement. After termination, available for export for 30 days, then deleted or de-identified within 90 days, except backups, which roll off on their normal cycle |
| Billing, invoicing and tax records | As required by Indian tax and company law, generally 8 years |
| Security and access logs | At least 1 year, as required by the DPDP Rules |
| Marketing preferences | Until you withdraw consent or unsubscribe |
| Job applications | Up to 12 months after the hiring decision, unless you agree to a longer period |
Where you have not engaged with the Services for an extended period, we may notify you before erasing data that is no longer needed, as provided under the DPDP Rules.
10. How we protect personal data
We use reasonable security safeguards appropriate to the nature of the data, including encryption in transit and at rest, role-based access controls, multi-factor authentication options, logical separation of customer environments, logging and monitoring of access, regular backups, vulnerability management, and confidentiality obligations for staff and contractors. Access to Customer Data by Kinnow personnel is limited to what is necessary to provide support, maintain security or comply with law.
No system is perfectly secure. You are responsible for keeping your credentials confidential and for configuring user permissions in your organisation appropriately.
11. Personal data breaches
If we become aware of a personal data breach affecting data for which we are the Data Fiduciary, we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act and DPDP Rules, including the nature of the breach, its likely consequences, the steps we are taking and what you can do to protect yourself.
Where the breach affects Customer Data, we will notify the affected customer without undue delay and provide the information they reasonably need to meet their own obligations.
12. Your rights
Subject to applicable law, you have the right to:
- Access a summary of the personal data we process about you and the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared;
- Correct, complete or update inaccurate or incomplete personal data;
- Erase personal data that is no longer needed, unless we must keep it to comply with law;
- Withdraw consent where processing is based on consent;
- Nominate another individual to exercise your rights in the event of your death or incapacity; and
- Grievance redressal through our Grievance Officer (Section 17), and, if unresolved, through the Data Protection Board of India.
To exercise these rights, write to [email protected] or use the settings in your account. We may need to verify your identity before acting. We will respond within the time prescribed by law, and in any case within 90 days. Requests about Customer Data will be routed to the relevant customer organisation.
You have a duty under the DPDP Act not to provide false information, impersonate another person, or file frivolous complaints.
13. Children
The Services are designed for businesses and are not intended for anyone under 18 years of age. We do not knowingly collect personal data from children. If we learn we have collected a child's personal data without verifiable parental consent, we will delete it. Customers must not upload children's personal data except where they have obtained verifiable consent from a parent or lawful guardian as required by law.
14. Cookies and similar technologies
| Type | Purpose | Can you turn it off? |
|---|---|---|
| Strictly necessary | Sign-in, security, load balancing | No - the Services will not work without them |
| Preferences | Language, display settings | Yes |
| Analytics | Understanding website and product usage in aggregate | Yes |
| Marketing | Measuring campaigns on our public website | Yes, and only set with your consent |
Our public website uses Google Tag Manager and Google Analytics to understand usage in aggregate. You can block them through your browser settings or a content blocker, and the website works without them. You can manage other non-essential cookies through your browser settings.
Our own visit counter
Alongside Google Analytics, kinnow.ai counts visits with a small script of our own. It sends the counts to Kinnow's own marketing system, the same product we sell, so that we can see which pages and sources bring people to us. It sets no cookie. It keeps one random code in your browser's local storage (under the name kinnow_aid) so that the pages one browser visits are counted as one visitor.
For each page it records the page address without anything after a "?", the name of the website you came from (not the page), any campaign tags in the link (utm_source, utm_medium, utm_campaign), and whether you clicked a main button, started or sent a form, or opened the assistant. It does not record what you type, your IP address or your browser details, and it does not record your screen.
If you later give us your email address through a form on this website, we link the visits made with that browser to your contact record, so that we can see which pages led you to us. Nobody who has not told us who they are can be identified from these counts. To have the visits linked to you removed, write to [email protected].
The counter does nothing if your browser sends Do Not Track or Global Privacy Control. To stop it on this browser, stop counting this browser, which also deletes the code; to switch it back on, count this browser again. Clearing your browser's site data deletes the code too.
15. Users outside India
Kinnow is based in India and the Services are operated from India. If you access the Services from another country, your data will be processed in India and in the other locations described in Section 8. Where local law gives you additional rights - for example, the EU or UK General Data Protection Regulation, or the UAE Personal Data Protection Law - we will honour those rights to the extent they apply to our processing. Customers in those jurisdictions may request a data processing agreement that reflects local requirements.
16. Changes to this policy
We may update this policy to reflect changes in the Services or the law. We will post the revised policy on kinnow.ai with a new "Last updated" date. If a change materially affects how we process your personal data, we will notify account administrators by email or in-product notice at least 30 days before it takes effect, and seek fresh consent where the law requires it.
17. Grievance Officer and contact
If you have a question, complaint or request about this policy or your personal data, contact our Grievance Officer:
Grievance Officer: Ashish Chawla, Kinnow Tech Private Limited
Address: 3rd Floor, Site No. 74, Mass Complex, 15th Cross Road, Sarakki Industrial Layout, Dollar Layout, 3rd Phase, J. P. Nagar, Bengaluru, Karnataka 560078, India
Email: [email protected]
Privacy requests: [email protected]
We will acknowledge your grievance within 48 hours and aim to resolve it within 30 days, and in any event within the period prescribed under applicable law. If you are not satisfied with our response, you may approach the Data Protection Board of India.