Privacy Policy

Last updated: 3 October 2026

Karinda AI ("Karinda", "we", "us") provides an AI chat assistant that businesses ("Customers") add to their websites. This policy explains what personal data we process, why, and the choices you have. It covers two groups of people:

• Customers — businesses and their staff who create a Karinda account.
• Website visitors — people who chat with a Karinda assistant on a Customer's website.

1. Our role

For Customer account data we are the controller. For conversations and leads collected through a Customer's assistant, the Customer is the controller and Karinda acts as a processor on the Customer's behalf, under our Data Processing Addendum. If you chatted with an assistant on a business's website, that business is your first point of contact for privacy requests.

2. Data we process

• Account data: business name, email address, password (stored only as a salted hash), settings, and the website content you ask us to index.
• Conversation data: messages a visitor sends to an assistant and the assistant's replies.
• Lead data: name, phone number, email address and message, only when a visitor chooses to submit the contact form.
• Technical data: IP address, browser user-agent and timestamps, used for security, abuse prevention and rate limiting.
• Usage statistics: on websites where an assistant is installed, we count page views and chat activity by page path, country (derived from the IP address), referring site and device type, so the Customer can see how their assistant performs. We use no cookies or device storage for this. Unique visitors are counted with a one-way hash of the IP address and user-agent combined with a secret that changes every day; the hash is deleted after two days and cannot be linked across days. Browsers that send Do Not Track or Global Privacy Control are not counted.

The assistant is not designed to collect sensitive data (such as health, financial or government ID information). Customers must not configure it to request such data.

3. How we use data

• To provide the service: answer visitor questions, deliver leads to the Customer, and send account emails.
• To keep the service secure: detect abuse, enforce rate limits and investigate incidents (audit logs).
• To give Customers aggregated usage statistics and a record of their assistant's conversations.
• To support Customers and improve reliability.

We do not sell personal data, and we do not use conversation or lead data to train AI models.

4. Legal bases (UK/EU GDPR)

Performance of a contract (providing the service to Customers), legitimate interests (security, fraud prevention, product improvement), and consent where required (for example, a visitor choosing to submit the contact form).

5. Sharing

We share data only with the Customer whose assistant you used (and, if that Customer connects one, the webhook or analytics tool they choose to receive their leads and events), and with the sub-processors below, under contracts that require them to protect it:

6. International transfers

Our providers operate globally. Where data leaves the UK, EEA or another country with transfer rules, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. Retention

• Leads and conversation transcripts are deleted automatically after the retention period the Customer chooses (12 months by default).
• Aggregated daily usage counts contain no personal data and are kept for up to about 26 months.
• Expired login sessions and verification codes are deleted automatically; security logs are kept for about 13 months.
• When a Customer deletes their account, their account data, leads, conversations, usage statistics and indexed website content are permanently deleted.

8. Security

Encryption in transit (HTTPS/TLS), salted password hashing, revocable sessions, per-website access controls, rate limiting and audit logging, and optional two-factor authentication for Customer accounts. Karinda staff sign in with mandatory two-factor authentication, and only open a Customer's conversations to provide support; every such access is recorded in an audit log. See our Security page.

9. Your rights

Depending on where you live (for example under the UK/EU GDPR, California's CCPA/CPRA, Singapore's PDPA or India's DPDP Act), you may have the right to access, correct, delete or port your data, and to object to or restrict certain processing. Customers can export or delete their data at any time from Dashboard → Security & Privacy. Website visitors should contact the business they chatted with; we will help that business respond. You can also email privacy@karinda.in. You may complain to your local data protection authority.

10. Children

Karinda is not directed at children under 16, and we do not knowingly collect their data.

11. Changes

We will post updates here and notify Customers of material changes by email.

12. Contact

Karinda AI — privacy@karinda.in