Privacy Policy

When a business signs up, it becomes the controller of the data it puts into KronixOS — its own customers, leads, invoices, stock, employee records and WhatsApp conversations. We act as its processor: we store and process that data to run the software, on that business’s instructions, and we do not use it for our own purposes.

For account-level information — who signed up, what plan is active, how a bill was paid — KronixOS is the controller, described in the sections below.

Account and business information. When a business signs up: the business’s name, GSTIN (if provided), address, the admin’s name, email and phone number, and the plan selected.

Records the business creates in KronixOS. Customers and leads, quotations and invoices, stock and purchase records, HR and payroll entries, projects and documents — whatever the business’s own team enters to run the ten apps. This belongs to the business; we process it only to display it back and run the features described in each app.

WhatsApp messages and contacts. If a business connects its own WhatsApp Business Platform (Meta Cloud API) number, we process the messages sent and received through that number, the templates and campaigns the business creates, and the contact list it messages. See Section 3 below — this is the part specific to WhatsApp.

Usage and device information. Login times, IP address and browser/device information, kept for security and to keep the product working (for example, showing who last edited a record).

Payment information. Subscription payments are processed by Razorpay. We do not receive or store card, UPI or net-banking credentials — Razorpay handles those directly and shares back only the confirmation we need to activate a plan.

A business connects its own WhatsApp Business Account and phone number to KronixOS’s WhatsApp app. Once connected, we use the WhatsApp Business Platform (Meta’s Cloud API) on that business’s behalf, and only on that business’s behalf, to:

• show the business’s own team a shared inbox for the conversations on that number
• send the message templates and campaigns the business itself writes and schedules
• run the automations and triggers the business itself configures (for example, a reminder tied to an overdue invoice)
• record consent and opt-outs, so the business doesn’t message someone who has asked to stop

A message sent through one business’s number is never visible to, or mixed with data from, another business. Every WhatsApp conversation, template and contact is scoped to the account that owns the connected number, the same tenant isolation every other app in the product relies on. We do not sell WhatsApp data, and we do not use it to advertise to the business’s contacts on our own behalf.

Opt-outs are honoured automatically. A contact who replies with a stop-style message (in English or in the Hindi/Gujarati/Marathi phrases people actually type — “band karo”, “nahi chahiye”, and others) is recorded as opted out immediately, and the business’s own campaigns and automations stop reaching that number. Only a further message from that contact, or a deliberate action by the business recording consent obtained elsewhere, puts them back on the list.

A number shared with the WhatsApp Business app. A business may connect the number it already uses in the WhatsApp Business app on its phone, and keep using that app. With the business’s permission, given in Meta’s own sign-up screen, we then also receive: the messages the business sends from the phone app, so its team sees the whole conversation; up to six months of past chats from the app, if the business chooses to share them; and the names of contacts saved in the app, used only to put a name on a conversation that has none. Contacts from the phone app are never messaged by us and are never treated as having agreed to receive messages.

A business may connect more than one WhatsApp number. Each number’s conversations stay inside that business, and the business decides which of its own team can see each number.

Access to a business’s WhatsApp inbox, templates and campaigns is controlled by that business’s own per-person permissions inside KronixOS — connecting a number does not make its conversations visible to everyone with a login.

KronixOS includes an assistant (voice and text) that answers questions about a business’s own money, stock and sales, and can look up records by name. To generate a response, the relevant question and the business’s own data needed to answer it are sent to our AI providers — OpenAI, Sarvam AI or Google (Gemini), whichever the business picks in its settings, for the assistant’s thinking, listening and speaking — solely to produce that answer. This is not used to train those providers’ general models, and is not retained by us beyond what’s needed to answer the question and keep a short history of the conversation for the person who asked it.

The assistant never writes to a customer record, sends a WhatsApp message, or creates a sales order on its own — it proposes, and a person in the business has to confirm the action before anything is saved or sent.

KronixOS uses a session cookie (via Supabase Auth) to keep a signed-in user logged in, and no third-party advertising or tracking cookies. The cookie identifies a session, not a person’s activity elsewhere on the web.

We don’t sell any business’s data. We share it only with the service providers that make KronixOS work (each processing data only as needed to provide their service to us, under their own terms), or when required by law:

• Supabase — authentication, and file storage for attachments
• Razorpay — payment processing for paid plans
• Meta / WhatsApp Business Platform — delivering the messages a business sends and receives through its own connected number, and posting to the Facebook and Instagram accounts a business connects
• OpenAI, Sarvam AI and Google (Gemini) — generating the AI assistant’s text and voice responses, and reading a document a person chooses to scan
• Google — only if a business signs in with Google to connect its Gmail mailbox, YouTube channel or Google Meet calendar
• IndiaMART — only if a business connects its own IndiaMART account to import leads
• our hosting provider — running the servers and database KronixOS runs on

Each business’s data lives in its own database, isolated from every other business on the platform (see our tenancy design) — one business’s records are not just access-controlled from another’s, they are architecturally unreachable from it. WhatsApp and other third-party credentials are stored encrypted, never in plain text. Our production infrastructure is hosted in Mumbai, India.

We keep a business’s data for as long as its account is active. If an account is closed, we delete or anonymise its data within a reasonable period, except where we’re required to keep it longer — for example, invoicing and GST-related records, which Indian tax law requires businesses (and, in turn, their software) to retain for a set number of years.

A business can access, correct, export or request deletion of the data in its own account at any time — most of this is available directly inside the product, and anything that isn’t can be requested through the account admin or by contacting us (Section 14).

Anyone messaged on WhatsApp by a business using KronixOS can opt out at any time by replying with a stop-style message to that number — see Section 3.

A business can ask for its whole account to be deleted — every record, file and WhatsApp conversation — by writing to us (Section 14) from the account owner’s email address. We confirm the request, and delete or anonymise the data within 30 days, except records Indian tax law requires to be kept (Section 8).

Disconnecting WhatsApp (WhatsApp → Settings → Numbers → Disconnect) stops all access to that number at once. The business can also remove KronixOS from its Meta Business settings → Business integrations, which revokes our access on Meta’s side.

A person who messaged a business on WhatsApp and wants their messages removed should ask that business first — it controls its own records. They can also write to us (Section 14) with the business’s name and their number, and we will pass the request on and confirm when it is done.

KronixOS is a business tool, not directed at individuals under 18, and we do not knowingly collect personal information from children.

Some of the service providers listed in Section 6 (Meta, OpenAI, Sarvam AI, Google) may process data outside India as part of delivering their service to us. Where that happens, it is governed by that provider’s own data-handling terms with us.

If we make a material change to this policy, we’ll update the effective date above and, for a change that meaningfully affects how a business’s or its customers’ data is handled, tell account admins directly.

Questions about this policy, or a request about your account’s data, can be sent through our Book a demo page.