Privacy Notice
What we collect about you, why, where it goes, and how you get it back or make it disappear. Written for India's Digital Personal Data Protection Act, 2023 (DPDP) and its 2025 Rules.
Applies to klaritiq.in and the KlaritiQ platform
- We collect what you type, what you upload and the email you sign in with. We also research public information about NBFC, manufacturing and diagnostics companies; our company research does not collect individual officers, patients or app reviewers as contacts.
- Your data is stored in the United States (Oregon), except uploaded files, which sit in Cloudflare's Asia-Pacific region. Where it helps, Anthropic's Claude reads it to write your report. It is never used to train anyone's AI.
- Inside the product there are no advertising trackers, no third-party analytics and no selling, and one cookie keeps you signed in. On our public website only, and only if you accept, we keep our own record of which public pages you view; it is not shared with an analytics or advertising provider. You can say no, or change your mind, at any time.
- You can delete your account yourself. It locks at once and is erased 30 days later unless you restore it.
- If your organisation puts its employees' or vendors' details into KlaritiQ, your organisation is the "data fiduciary" for them and we act on its instructions. See Data processing terms.
1. Who we are
KlaritiQ is a compliance and audit management platform for Indian companies, run by its founders from India. The company that will own it is being incorporated; until then "KlaritiQ", "we" and "us" mean the founders operating klaritiq.in, and this notice will be updated with the legal entity's name and address when that is done. For every privacy matter, including complaints, write to hello@getklaritiq.com.
2. Who this notice is for
Four kinds of people meet KlaritiQ, and each brings a different amount of data with them. Find yourself below; each row links to the section that matters most to you.
| You are… | What that means | Read |
|---|---|---|
| A visitor | You read the site, maybe fill the contact form or sign up for our notes. | §3 · door 1 |
| An account holder | You created a login to see reports and use the workspace. | §3 · door 2 |
| Taking an assessment | You are answering questions and uploading documents in the Case Window, signed in or not. | §3 · door 3 |
| Named by your organisation | A colleague put you into KlaritiQ as a member, an initiative owner, a department head, or a vendor contact. | §10 |
3. What we collect, door by door
Think of KlaritiQ as a building with four doors. What we hold about you depends on which doors you have walked through.
Door 1 · Visiting the site
| What | Detail | Where it comes from |
|---|---|---|
| Contact and assurance-pilot forms | Name, work email, role and anything you write in the message; a preferred time if you pick one. | You type it |
| Newsletter opt-in | Your email address and the fact that you ticked the box. | You tick it |
| Usage events | Which screen you reached, how far you got in an assessment, how long you read a post, a 1 to 5 rating and any comment you leave. Tied to a random session id generated in your browser, and to your user id if you are signed in. | Your browser sends it to us; nobody else |
| Page visits, only if you accept the cookie notice | The address of each public page you view (never anything after a question mark), where you came from, and a random identifier for this browser tab. If you then send us a form from the same tab, we connect the two so we can see what you read first. | Your browser sends it to us; nobody else |
| Server logs | Your IP address and browser type, for the short time our hosting provider keeps request logs. | Automatic |
Door 2 · Having an account
| What | Detail | Where it comes from |
|---|---|---|
| Login details | Email address, a hashed password (we never see the password itself) or, if you choose Google sign-in, the name, email and profile picture Google shares with us. | You, or Google |
| Profile | Name, job title, short bio, avatar image, if you fill them in. | You |
| Session | One signed cookie that keeps you signed in for 2 hours of inactivity and at most 7 days, plus a record of each sign-in in your organisation's audit log. | Automatic |
| Emails we send | Sign-in links, password resets, report deliveries and, if you opted in, our occasional notes. Sent through Resend. | Us |
Reacting and commenting on the blog
| What | Detail | Where it comes from |
|---|---|---|
| Reactions | Which of the five reactions (thumbs up, thumbs down, heart, light bulb, target) you chose on which post, tied to your account so that each person has one. The counts are public; who chose what is not shown to anyone. | You, when signed in |
| Comments | The text of your comment, the name shown with it (your account name when you are signed in), when you wrote it and whether you edited it. You can edit or delete your own comment while signed in. Comments are public once published. If your account is erased, your comments are replaced with a removal notice. | You |
| A visitor's email address | If you comment without signing in, the email address you give. It is used only so we can review the comment, is never shown, and is cleared once the comment has been approved or refused. A comment nobody has reviewed within 30 days is refused and the address cleared. | You |
| Reports | If you report a comment, an identifier of your account, or a keyed hash of your network address if you are not signed in (it cannot be turned back into the address without a secret we hold), so that one person counts once. Reports are deleted when the comment has been reviewed, and at the latest after 90 days. | You |
Door 3 · Taking an assessment
| What | Detail | Where it comes from |
|---|---|---|
| Consent record | That you ticked the processing-consent box, when, from which IP address and browser, and whether you also ticked the newsletter box. Kept as proof of consent. | You tick it |
| Company name and size band | Entered on the first screen. | You |
| Your answers | Every answer and free-text reply, with a timestamped log of each turn including the IP address it came from. Free text may be read by Claude to map it to our assessment variables. | You |
| Documents you upload | Policies, board minutes, registers and similar. Stored as files in Cloudflare R2 (Asia-Pacific); their text is read by Claude to propose facts, which a human then confirms or rejects. | You |
| Your report | The generated report, scores and roadmap. The prose is written by Claude from your answers; the scores are computed by rules, not by AI. | Us, from your data |
| Ask box | Questions you type into the assessment's ask box are sent to Claude to answer. | You |
Door 4 · Working in the workspace
| What | Detail | Where it comes from |
|---|---|---|
| Governance records | Initiatives, risks, decisions, evidence, policies, tasks, milestones and their owners, stakeholders and departments. | You and your colleagues |
| People your organisation names | Members you invite (email), initiative owners, decision makers, department heads, vendor contacts. | Your organisation |
| Command Center chats | Your questions and the answers, stored per user so your history survives a refresh. Sent to Claude to be answered. | You |
| Integrations, only if you connect them | If you connect HubSpot, Jira Cloud, Confluence Cloud, Microsoft Entra, Google Calendar or Slack, we exchange only the records each one needs, such as task titles, due dates and owners, and keep the account identifiers and encrypted tokens needed to match people and stay connected. We do not read your Slack messages, apart from one an administrator deliberately saves, or your other calendar events. From Microsoft Entra we keep only the names of the groups you pick, their member counts and a hash, never member names or emails. Exactly what each integration sends and keeps is on the Sub-processors page. | Your organisation's systems |
| Audit log | Who changed what and when, written for every state change and never edited. | Automatic |
4. Why we use it, and on what basis
Public company research
Our internal Leads area checks RBI public registers and releases, company homepages, footer links, grievance and privacy pages, and free Google News RSS searches using company names and sector keywords. When source URLs or app IDs are configured, it also reads public rating documents, company careers pages, vendor customer pages, CERT-In pages, exchange filings and Apple app listings/review feeds. Manufacturing and diagnostics research can read configured public NABL medical-laboratory directories, ABDM/NHPR facility exports, CDSCO device lists, state clinical-establishment registers, PMJAY or other public empanelment lists, SEBI offer documents, ministry PLI beneficiary lists, FDA warning letters and published inspection observations, industry programme lists, and corporate portfolio/client/member pages. Public source servers receive the requested URL, our server's network address and a research user-agent; Google receives the search and Apple receives the app ID/country. These requests do not carry your assessment answers, account details or rep-entered contacts. Interactive or unreadable registries remain unavailable until a complete readable public export is configured; we do not bypass access challenges.
We keep company identity, dated observations, source links, short evidence snippets, and review history. Website checks record whether an officer contact section is displayed; they do not save the officer's name or contact details. Raw company pages and register contact columns are not retained. Apple review text is processed transiently into theme counts over a bounded recent sample; only counts and dates are kept, and neither review text nor reviewer identities go to Claude. Before optional extraction of other public business text, emails, phone numbers and recognised personal-contact lines are removed. Claude proposes observations only for active watchlist companies; a person must approve every model proposal before it affects a lead. Contacts are entered separately by a rep with a source note. Google Play collection and paid MCA document purchases are not connected.
Starting or completing an NBFC, manufacturing or diagnostics assessment and submitting a related contact request can create a first-party inbound event for that company. Confirmed assessment answers can become dated observations; public prefilled answers require confirmation or correction. Diagnostics directory records retain laboratory city, reporting disciplines and corporate accreditation identifiers, but no patient records, sample reports or individual clinician details. Approved public events may link corporate partners to firms or identify other laboratories in the same city with overlapping accredited disciplines. Internal assignees receive a weekly digest of company leads, due actions, pending reviews and source failures. Public snapshots are shared through expiring private links. Observations remain as history after their validity window ends, and an expired observation no longer establishes the company's current state. A do-not-contact disposition suppresses the company from further lead surfacing.
Starting a Data Protection case for an identified NBFC can also create a company inbound event. Its Data Protection answers, uploaded evidence and case access token are not copied into the NBFC lead record.
| Purpose | What it covers | Basis under DPDP |
|---|---|---|
| Run the assessment and workspace you asked for | Scoring, report writing, storing your records, showing them to your organisation's members. | Your consent, given at the start of each assessment and when you create an account |
| Keep the service secure and reliable | Session cookies, audit log, rate limits, IP addresses in logs. | Necessary to provide what you asked for |
| Talk to you about your own account | Sign-in links, report emails, deletion notices, security notices. | Necessary to provide what you asked for |
| Send you our notes | Occasional writing on AI governance and assurance. | Separate, optional consent; unsubscribe link in every email |
| Improve the product | Usage events and ratings, in aggregate. | Your consent (the same box); we do not profile individuals |
| See what a lead read before they contacted us | The public pages you viewed and where you came from, tied to a form you sent from the same browser tab. | Your consent, given by accepting the cookie notice |
| Peer benchmarks | How your organisation ranks against others in the same domain and size band. | Aggregate statistics only, never another organisation's rows, with a minimum group size so nobody can be singled out |
We will not use your data for a new purpose without asking you first. We do not sell it, rent it, or trade it, and we do not show advertising.
5. Where your data lives, and who else touches it
KlaritiQ runs on rented infrastructure. The full, maintained list with what each provider receives is on the Sub-processors page. The headline:
| Provider | Role | Location |
|---|---|---|
| Render | Runs the application and the database that holds everything above. | United States (Oregon) |
| Anthropic (Claude) | Reads assessment answers, uploaded document text and chat questions to write prose, propose extractions and answer questions. Also proposes public business observations from filtered public company text for human review. Contractually does not train on this data. | United States |
| Cloudflare (R2) | Holds the files you upload as evidence. | Asia-Pacific region |
| Resend | Delivers our emails. | United States |
| Sign-in if you choose it; your own calendar if you connect Google Calendar; company-name queries for public Google News RSS research. | Global | |
| HubSpot | Only if your organisation connects it. | United States / EU |
| Atlassian (Jira Cloud) | Only if your organisation connects it: task and risk text goes to your Jira site, and Jira issue text comes back. | Where your Jira site is hosted |
| Atlassian (Confluence Cloud) | Only if your organisation connects it: we read the Confluence pages it labels and links, and write nothing to Confluence. If it disconnects, the names of page authors are erased from our records after 3 days. | Where your Confluence site is hosted |
| Microsoft (Entra ID, Graph) | Only if your organisation connects it: we read the groups it picks and their members only to count and fingerprint them, keep no member names or emails, and write nothing to Entra. | Where your Microsoft Entra tenant is hosted |
| Slack | Only if your organisation connects it: the titles of its own alerts, and a link back, are sent to its people and to one channel. | Where your Slack workspace is hosted |
6. Artificial intelligence
Claude writes words; it never decides scores. The full picture of every place AI is involved, what it sees, and what a human checks is on How AI is used. Two promises that belong here: your data is not used to train Claude or any other model, and every AI-drafted regulatory mapping is approved by a person before it can affect your organisation.
There is one more way AI can touch your data, and it is entirely your choice: if an owner of your organisation turns on AI assistants, a person can connect their own assistant (Claude, ChatGPT, Copilot or similar) with their own sign-in. The assistant then reads, as that person and read only, what they can already see, and what it reads is sent to that assistant's provider under your own agreement with them, not to a KlaritiQ sub-processor. It is off by default. We keep a record of each request (who, which tool, how many rows, how it ended) and never the answer. An owner can stop it at any time.
7. Cookies and tracking
Inside the product there is one cookie: the signed session cookie that keeps you logged in. It is set only after you sign in and is deleted when you sign out or the session expires. There are no advertising cookies, no Google Analytics, no heat-mapping and no social-media pixels. The usage events described in door 1 are sent to our own server.
One optional record, on our public website only. If you accept the notice shown on our public pages (home, platform, pricing, about, compare, the NBFC page, methodology, FAQ, learn more, the product pages and the legal pages (privacy, terms, data processing, security, how AI is used, retention and sub-processors)), we keep our own record of the public pages you view, where you came from (the site or campaign link) and a random identifier for this browser tab, so we can see which pages interest visitors and what someone read before they contacted us. It is stored in our own database and is not shared with an analytics or advertising provider. The record does not include your IP address, and never anything after a question mark in a page address. It never starts in the signed-in product, on sign-in or sign-up, on assessments or reports, or on pages where you enter your details (contact, demo, sign-up and question forms), and it does not run while you are signed in. If you then send us a form from the same tab, we connect the two; that link goes when we erase the form you sent, and the record itself is deleted after 180 days. It stays off unless you say yes. A browser privacy signal (Global Privacy Control or Do Not Track) counts as no, and then you are not asked. You can say no, or change your mind, here at any time:
8. How long we keep it
As long as you are using the service, and then not much longer. The exact schedule per type of data, including what happens to backups, is on Retention & deletion. The rules that matter most:
| Data | Kept until |
|---|---|
| Your account, assessments, chats | 30 days after you delete your account (locked immediately) |
| An organisation and everything in it | 30 days after its owner deletes it (hidden immediately) |
| A single assessment you delete | Erased at once: answers, email and IP address are wiped from the record |
| Uploaded evidence files | Off by default. If your organisation turns file retention on, files expire after the number of days it sets (365 unless changed); the confirmed facts extracted from them stay. |
| Consent records | Kept as proof that consent was given, with the IP address and browser removed once the account is erased |
| Usage events | Detached from your user id when the account is erased |
| Page visits (only if you accepted the cookie notice) | Deleted automatically after 180 days; erasing the form you sent removes the link to you at once |
9. Your rights, and the button that exercises each one
DPDP gives you these rights. We built most of them into the product so you do not have to write to us, but writing to us always works too.
| Right | How to use it | Time |
|---|---|---|
| See what we hold | Your profile page shows your account data and every assessment. Organisation owners can export all of an organisation's records from Settings. For anything else, email us. | Immediate / within 30 days by email |
| Correct it | Edit your profile and your organisation's records directly. Assessment answers can be re-run in a new assessment. | Immediate |
| Erase it | Profile → Delete my account. The account locks at once, we email you a restore link, and 30 days later everything is erased. Owners delete organisations from Settings on the same 30-day clock. Individual assessments have their own delete button and are erased at once. | Locked now, erased in 30 days |
| Withdraw consent | Same as erasing, because we only hold your data to do what you consented to. For the newsletter alone, use the unsubscribe link in any email. For our record of the public pages you view, choose No under Your choice in section 7, which stops it at once. | Immediate |
| Nominate someone | Email us the name and contact of a person who may exercise these rights for you if you die or are incapacitated. | Recorded on receipt |
| Complain | Write to the grievance contact below. If you are not satisfied with our answer, you may approach the Data Protection Board of India. | Acknowledged within 7 days, resolved within 30 |
10. When your organisation put you here
If a colleague named you as an initiative owner, invited you as a member, or entered your details as a vendor contact, your organisation decided to collect that data and is the data fiduciary for it under DPDP. KlaritiQ processes it only to run the workspace for them. Ask your organisation to correct or remove it; if they ask us to, we do. The commitments we make to organisations in that role are on Data processing terms.
11. Children
KlaritiQ is a tool for companies and is not intended for anyone under 18. We do not knowingly collect a child's data; if you believe we have, email us and we will erase it.
12. If something goes wrong
If a breach affects your personal data we will tell you what happened, what it means for you and what we are doing, without unreasonable delay, and we will notify the Data Protection Board of India as the DPDP Rules require. How we protect against that in the first place is on Security.
13. Grievance contact
Until incorporation the founders act as grievance officer. Write to hello@getklaritiq.com with "Privacy" in the subject line. We acknowledge within 7 days and resolve within 30. A named Grievance Officer with a postal address will be published here when the company is registered.
14. Changes to this notice
The date at the top changes whenever the text does. If a change affects what we do with data you already gave us, account holders get an email before it takes effect, and where DPDP requires fresh consent we will ask for it rather than assume it.
Questions about anything on this page: hello@getklaritiq.com. We write these pages ourselves, in plain language, to match what the product actually does; they are not a substitute for legal advice to you.
Questions about this page?
Write to the KlaritiQ team about anything on it, including privacy requests and complaints.
Email the support team