Kriyam.ai Privacy Policy

1. Introduction and who we are

This Privacy Policy explains how GEOGO Techsolutions Private Limited ("GEOGO", "we", "us") handles personal data when you use Kriyam.ai, our Document AI service. Kriyam.ai performs optical character recognition (OCR), document parsing, data extraction, automated classification, vision-language-model (VLM) document analysis and digital document forensics.

This policy is issued under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). It applies to our website, web application, APIs and related support services.

Our two roles: Data Fiduciary and Data Processor

Whether we are a Data Fiduciary or a Data Processor depends on who decides why and how your personal data is processed.

When we act as a Data Processor, we process personal data only under a written contract (a Data Processing Agreement) with the enterprise client, as required by Section 8(2) of the DPDP Act. We do not use client data for our own purposes outside that contract.

Data Protection Officer and Grievance Officer

• Name: Suvajit Sengupta, Data Protection Officer and Grievance Officer
• Email: privacy@geogo.in
• Address: GEOGO Techsolutions Pvt Ltd, 208 Jai Sai Sankalp, 5th Main, Malleshpalya, Bangalore 560075, Karnataka, India

This person can answer your questions about how we process your personal data and handles complaints (see Section 12).

2. Key terms in plain language

3. Personal data we collect and process

We process two broad groups of data: what you or your organisation uploads for analysis, and what we need to run your account.

3.1 Customer Content (documents you upload)

Kriyam.ai is built to read whatever documents are sent to it. Depending on what is uploaded, Customer Content may contain:

Aadhaar numbers. We do not use Aadhaar for authentication. Where an Aadhaar number appears in an uploaded document, we mask the first eight digits in outputs and stored extractions by default, in line with UIDAI requirements, unless the enterprise client is legally permitted to receive the full number and instructs otherwise.

3.2 Account and business data

• Account data: name, work email, phone number, organisation, designation, login credentials (stored only as salted hashes).
• Billing data: billing contact, GSTIN, invoices and payment status. Card or bank details are handled by our payment provider, not stored by us.
• Support and communications: emails, tickets, call notes and feedback you send us.

3.3 Technical and usage data

• IP address, browser and device type, operating system, session identifiers.
• API keys and request logs: timestamps, endpoints called, document counts, processing times, error codes.
• Security and audit logs: logins, access to Customer Content, administrative actions.

3.4 Data we do not seek

We do not knowingly collect personal data of children for our own purposes, and we do not buy personal data from data brokers.

4. Why we process personal data and our legal basis

We process personal data only for the specific purposes below. Under the DPDP Act, every purpose rests on either your consent (Section 6) or a legitimate use listed in Section 7.

4.1 What valid consent means here

When we rely on consent, it must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action (Section 6(1)). In practice:

• We show you an itemised notice, in English and on request in any language in the Eighth Schedule to the Constitution, before we collect data (Section 5).
• Consent boxes are never pre-ticked. Each optional purpose has its own toggle.
• We do not make the core service conditional on consent to unrelated purposes such as marketing or model training.
• You can withdraw consent as easily as you gave it (Section 10).
• Once registered Consent Managers are operational, you may also give, manage and withdraw consent through one.

4.2 Responsibility of enterprise clients

Enterprise clients that upload documents about their customers, employees or other individuals are the Data Fiduciaries for that data. They are responsible for giving those individuals a DPDP-compliant notice and obtaining consent or relying on another lawful basis. Our Data Processing Agreement requires clients to confirm this before uploading.

5. AI model training: off by default

We do not use your documents or extracted data to train or fine-tune AI models unless you explicitly opt in. This is the default for every individual and enterprise account.

• Default (opt-out state): Customer Content is used only to deliver results to you. Our OCR, LLM and VLM models are self-hosted, so your documents are not sent to third-party AI model providers.
• Opt-in: An individual user, or an authorised administrator of an enterprise account, may switch on "Help improve Kriyam.ai" in account settings. We will show a separate notice describing what is used, how it is de-identified and how long it is kept.
• What opt-in covers: Before any training use, we remove or mask direct identifiers (names, ID numbers, account numbers, faces, signatures) where technically feasible. We keep training data in India and limit access to named personnel.
• Withdrawing: You can switch it off at any time. We will stop using your Customer Content for new training within 30 days and delete it from training datasets. Models already trained cannot "unlearn" individual records, but they do not store or reproduce your documents.
• Enterprise data: For enterprise accounts, only the client's authorised administrator can opt in, because the client is the Data Fiduciary.
• Aggregate service metrics: We may use non-personal, aggregated statistics (for example, average processing time or overall extraction accuracy) to run and improve the service. These contain no document content.

6. Digital forensics and automated outputs

Kriyam.ai's forensic features look for signs that a document has been altered, forged or synthetically generated. They examine pixel patterns, fonts, layers, metadata and consistency across documents.

• Outputs are indicators, not decisions. Forensic flags, classifications and confidence scores are aids for a human reviewer. We design Kriyam.ai as assistive technology; we do not make final decisions about any individual, such as rejecting a claim or a loan.
• The enterprise client decides. Any decision based on our outputs is made by the enterprise client, which remains responsible for human review and for giving affected individuals a way to contest it.
• Accuracy. AI outputs can be wrong. Under Section 8(3) of the DPDP Act, a Data Fiduciary using personal data to make a decision affecting an individual must ensure its completeness, accuracy and consistency. We provide confidence scores and audit trails so clients can meet this duty.

7. Data sharing, sub-processors and data location

We do not sell personal data, and we do not share it for advertising. We share it only as described below.

7.1 Sub-processors

We use a limited number of service providers to run Kriyam.ai. Each is bound by a written contract requiring confidentiality, security safeguards at least as strong as ours, processing only on our instructions, no model training on Customer Content, and deletion or return of data when the service ends.

A current list of sub-processors is available on request from privacy@geogo.in. Enterprise clients get at least 30 days' notice of a new sub-processor and may object under their Data Processing Agreement.

7.2 Other disclosures

• Your organisation: If you use an enterprise account, your organisation's administrators can see your activity and the documents you process.
• Legal requirements: We disclose data to courts, regulators or law-enforcement agencies only when Indian law requires it, and only the minimum needed. Where lawful, we notify the affected enterprise client first.
• Corporate transactions: If GEOGO is merged, acquired or restructured, personal data may transfer to the successor entity, which will be bound by this policy or one at least as protective. Section 17(1)(e) of the DPDP Act covers such approved schemes.
• Professional advisers: Auditors, lawyers and insurers under confidentiality duties, only as needed.

7.3 Where your data is stored

Customer Content and account data are stored and processed primarily on servers physically located in India, in the Kolkata and Mumbai cloud regions. Our cloud infrastructure also includes a region in the United States, and some data may be stored or processed there. Backups are kept in the same regions as the data they protect.

We will never transfer personal data to a country the Central Government has restricted under Section 16 of the DPDP Act. Enterprise clients that require India-only processing for regulatory reasons, such as RBI or IRDAI requirements, can enforce this through their contract, and we will then keep their data in our India regions only.

8. How long we keep data and how we delete it

We keep personal data only as long as the purpose needs it, then delete it (Section 8(7), DPDP Act). Default periods are below; enterprise clients can set shorter periods in their contract or admin settings.

8.1 Your controls for immediate deletion

• Delete now: Users and enterprise admins can delete any document and its extracted data from the dashboard or through the API (DELETE endpoint) at any time. Deletion from live systems is immediate.
• Account-wide purge: Enterprise admins can purge all Customer Content for the organisation in one action, or request it at privacy@geogo.in.
• Confirmation: On request, we issue a written deletion certificate within 7 working days.
• Backups: Deleted data drops out of encrypted backups within the 35-day cycle and is not restored except to recover from an incident, after which it is deleted again.
• Inactive accounts: If an individual account is inactive for the period set by the DPDP Rules for the relevant class of entity, or otherwise for 3 years, we will notify you at least 48 hours before erasing your data, so you can log in or object.
• Legal holds: We may keep specific data longer only where a law, court order or ongoing legal claim requires it, and only for that purpose.

9. How we protect your data

We take reasonable security safeguards, as Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules require. GEOGO is certified to ISO/IEC 27001:2022 for information security management.

9.1 Technical measures

• Encryption in transit: TLS 1.2 or higher for all connections, including API calls.
• Encryption at rest: AES-256 for stored documents, extracted data, databases and backups, with keys managed in a cloud key-management service and rotated regularly.
• Access control: Role-based access, least privilege, multi-factor authentication for all staff, and single sign-on (SSO) for enterprise clients. Staff cannot view Customer Content except to resolve a support request the client has authorised, and every such access is logged.
• Masking and minimisation: Automatic masking of Aadhaar numbers and configurable redaction of other identifiers (PAN, account numbers, faces, signatures) in outputs.
• Isolation: Logical separation of each enterprise client's data; dedicated or private deployments available on request.
• Monitoring: Centralised logging, intrusion detection, vulnerability scanning and regular third-party penetration tests.
• Resilience: Encrypted backups and tested disaster-recovery plans to keep data available and intact.

9.2 Organisational measures

• Confidentiality agreements and annual privacy and security training for all employees and contractors.
• Background checks for staff with access to production systems.
• Security and privacy reviews of every new sub-processor.
• Documented incident-response, retention and access-review procedures.

9.3 If a breach happens

If we become aware of a personal data breach:

• As Data Fiduciary: We will inform affected individuals and the Data Protection Board without delay, and send the Board a detailed report within 72 hours, as Rule 7 of the DPDP Rules requires. We will tell you what happened, the likely consequences, what we are doing, and steps you can take to protect yourself.
• As Data Processor: We will notify the affected enterprise client without undue delay, and within the time agreed in its contract, so it can meet its own reporting duties.
• Cybersecurity reporting: We will report qualifying cyber incidents to CERT-In within 6 hours of noticing them, as the CERT-In Directions of April 2022 require.

10. Your rights as a Data Principal

You have the following rights under Chapter III of the DPDP Act. Exercising them is free.

10.1 How to exercise your rights

• Individual users: Use the privacy controls in your account settings, or email privacy@geogo.in with the subject "Data Principal Request".
• Individuals whose data appears in a client's documents: Contact the enterprise client (for example, your bank or insurer), which is the Data Fiduciary. If you contact us, we will forward your request to that client within 5 working days and tell you we have done so.
• Verification: We may ask you to verify your identity before acting, using the minimum information needed. We do not ask for full Aadhaar numbers for this.
• Timeline: We aim to respond within 30 days and in every case within 90 days, as Rule 14 of the DPDP Rules allows.

10.2 Your duties

Section 15 of the DPDP Act asks Data Principals to comply with applicable laws, not impersonate others, not suppress material information, not file false or frivolous complaints, and give only verifiably authentic information when seeking correction.

11. Children and persons with disabilities

Kriyam.ai is a business service and is not meant for anyone under 18. We do not knowingly accept account sign-ups from children, and we do not track, behaviourally monitor or target advertising at children (Section 9).

Enterprise clients sometimes upload documents that contain a child's details, such as a birth certificate in an insurance claim. In that case, the client is the Data Fiduciary and must obtain verifiable consent from the parent or lawful guardian under Section 9 and Rule 10, unless an exemption applies. The same applies to persons with disabilities who have a lawful guardian.

If you believe we hold a child's data as Data Fiduciary without proper consent, email privacy@geogo.in and we will delete it.

12. How to raise a complaint

We acknowledge every grievance within 2 working days and resolve it within 30 days, never later than the 90-day limit in Rule 14(3) of the DPDP Rules.

• Write to the Grievance Officer. Email Suvajit Sengupta at privacy@geogo.in with the subject "Privacy Grievance", or send a letter to 208 Jai Sai Sankalp, 5th Main, Malleshpalya, Bangalore 560075. Include your name, contact details, the account or document reference if any, and what went wrong.
• Acknowledgement (within 2 working days). You receive a reference number and the name of the person handling your case.
• Verification (within 5 working days). If we need to confirm your identity or need more details, we ask once, for the minimum needed. The clock pauses until you reply.
• Investigation. We review logs, records and, where relevant, the enterprise client's instructions. If the enterprise client is the Data Fiduciary, we forward the matter to it within 5 working days, tell you, and help it respond.
• Resolution (within 30 days of acknowledgement). We send a written reply explaining our findings and any action taken, such as correction, deletion or a process change. For a complex case we may extend this once, with reasons, but never beyond 90 days from receipt.
• Escalation inside GEOGO. If you are not satisfied, reply within 15 days asking for review. A director of GEOGO not involved in the original decision reviews it within 15 days.
• Complaint to the Data Protection Board of India. If the matter is still unresolved, or we have not replied within 90 days, you can file a complaint with the Board through its online platform under Section 13(3) and Section 27 of the DPDP Act. You must use our grievance process before approaching the Board.

Raising a complaint will never affect your access to the service.

13. Other important terms

13.1 Cookies

Our website and app use strictly necessary cookies for login and security. We use analytics cookies only with your consent through our cookie banner, and you can change your choice at any time. We do not use advertising or cross-site tracking cookies.

13.2 Sector-specific rules

Many of our clients are regulated by the RBI, IRDAI or SEBI. Where their sectoral rules impose stricter duties (such as data localisation, outsourcing controls, audit rights or longer retention), we support those duties under our contract with the client. Where this policy and a stricter applicable law differ, the stricter law applies.

13.3 Changes to this policy

We will post any update on this page and change the effective date. For material changes, such as a new purpose or a new country of processing, we will email account holders at least 30 days before the change takes effect and, where required, ask for fresh consent.

13.4 Governing law and jurisdiction

This policy is governed by the laws of India, including the DPDP Act, 2023, the DPDP Rules, 2025 and the Information Technology Act, 2000. Subject to the powers of the Data Protection Board, courts in Bengaluru, Karnataka have exclusive jurisdiction.

13.5 Contact us

GEOGO Techsolutions Pvt Ltd · Attn: Suvajit Sengupta, Data Protection Officer and Grievance Officer · 208 Jai Sai Sankalp, 5th Main, Malleshpalya, Bangalore 560075, India · privacy@geogo.in