Privacy Policy

This policy explains what personal data AMPLIFOLD AI PRIVATE LIMITED collects when you use Kryttle, why we collect it, how long we keep it, and the rights you can exercise over it.

Effective 11 September 2026.

Who we are

Kryttle is operated by AMPLIFOLD AI PRIVATE LIMITED, a company incorporated in India with its registered office at A1301, Purva Westend, Service Road, Kudlu Gate, Bommanahalli, Bangalore, Karnataka, 560068, India. For personal data you provide to us directly, we are the Data Fiduciary. For personal data your organisation loads into its Kryttle workspace, your organisation is the Data Fiduciary and we act as its Data Processor under the agreement between us.

What we collect

  • Account data. Name, work email address, organisation name, and role, supplied when an account is created or a teammate is invited.
  • Workspace content. The documents, records, connections, agents, reports and apps you and your teammates create or upload into your workspace.
  • Connected system data. Where you connect a third-party system, the data that connection is scoped to read, plus the credentials or tokens needed to maintain it.
  • Usage and diagnostic data. Log records of requests to the service, including IP address, browser and device type, timestamps, and error traces.
  • Enquiry data. Anything you send us by email or through a form on this website.

Why we process it

  • To provide, operate and secure the service.
  • To authenticate users and enforce workspace permissions.
  • To run the agents, reports, workflows and apps you configure, including sending your content to the model providers those features depend on.
  • To investigate faults, abuse and security incidents.
  • To respond to your enquiries and send service notices. Marketing email is sent only with consent, and every message carries an unsubscribe link.
  • To meet our legal, tax and accounting obligations.

Model providers and workspace content

Kryttle sends workspace content to third-party model providers in order to run the features you invoke. We send content only to providers who are contractually barred from training on it.

We do not train models on your workspace content. If that ever changes we will notify account administrators in advance and give you a way to opt out. Data you connect from Google Workspace is excluded from this altogether and is never used for model development, as set out below. We do not sell personal data.

Google user data

Where you connect a Google Workspace account, Kryttle accesses your Google data through Google's APIs using the permissions you grant on the Google consent screen. This section describes how we handle that data. It applies in addition to the rest of this policy, and where the two differ, this section governs.

What we access. With your permission, Kryttle reads and writes your Gmail messages and their attachments, the files in your Google Drive, the events on your Google Calendar, and your Google Forms and the responses to them. It also reads your name, email address and profile picture so that we can show you which account is connected. The exact scopes we request, the feature each one supports, and why a narrower scope will not do, are listed in our security documentation.

Limited Use. Kryttle's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Model providers. Content retrieved from Google Workspace is sent to our model providers solely to execute the feature you invoked. Providers are contractually barred from training on it.

No model training. We do not use Google Workspace data to develop, improve or train generalised AI or ML models.

Human access. No Kryttle employee reads Google Workspace content except with your explicit agreement, or where required for security, legal compliance or abuse investigation.

How long we keep it. Google Workspace data is retained while your connection is active and your organisation's account is open. We do not keep permanent copies, and we retain no more than the features you use require.

Deleting it. You can ask us to delete the Google data we hold at any time, and we will do so within 30 days. That covers Workspace content, the tokens for the connection, and anything derived from that content, including search indexes and embeddings. We may keep data longer only where the law requires it. Residual copies can remain in secure backups until those expire on their normal rotation; backups are never used to serve the product, and if we ever restore one, deletions are reapplied before it goes back into use.

Disconnecting is not the same as deleting. Disconnecting the integration, or revoking our access at Google, stops us reading anything further from your account straight away. It does not by itself erase what we already hold. Ask us to delete as well if that is what you want, and see deleting your data for how to do both.

Revoking access. You may revoke Kryttle's access to your Google account at any time at myaccount.google.com/permissions, or by removing the connection inside Kryttle. Revoking access stops all further processing of your Google data.

Sub-processors

We use a limited set of vendors to host and run the service: infrastructure and hosting providers, model providers, and email delivery. Each is bound by contract to confidentiality and security obligations no weaker than those in this policy. Write to privacy@kryttle.com for the current list.

International transfers

Some of our sub-processors operate outside India. Where personal data is transferred abroad, we transfer only to jurisdictions permitted under the DPDP Act and require contractual safeguards equivalent to those we apply ourselves.

How long we keep it

Workspace content is retained for as long as your organisation's account is active. On termination, content is deleted within 30 days unless we are required to retain it by law. Log and diagnostic data is retained for up to 12 months. Enquiry correspondence is retained for up to 24 months.

Security

Data is encrypted in transit with TLS 1.2 or above, and at rest with AES-256. Access to production systems is restricted to named personnel, requires multi-factor authentication, and is logged. Workspace data is isolated per organisation. We will notify you and the Data Protection Board of India of a personal data breach as required by the DPDP Act. See our security documentation for more.

Your rights

Under the DPDP Act, 2023 you may:

  • Ask for a summary of the personal data we hold about you.
  • Ask us to correct, complete or update inaccurate data.
  • Ask us to erase your data, where we are not required to keep it.
  • Withdraw a consent you previously gave, at any time.
  • Nominate another person to exercise these rights for you.
  • Raise a grievance, and escalate it to the Data Protection Board of India.

Where your organisation controls the workspace, we will route your request to them and assist them in answering it.

Children

Kryttle is a business product and is not offered to children. We do not knowingly process the personal data of anyone under 18.

Changes to this policy

We will post any revision on this page and update the effective date above. Material changes will also be notified by email to account administrators.

Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made under it, and with the DPDP Act, 2023:

  • Akash Nagar, Grievance Officer
  • grievance@kryttle.com
  • AMPLIFOLD AI PRIVATE LIMITED, A1301, Purva Westend, Service Road, Kudlu Gate, Bommanahalli, Bangalore, Karnataka, 560068, India

We acknowledge grievances within 24 hours and resolve them within 15 days of receipt.

Contact

Privacy questions: privacy@kryttle.com. Everything else: hello@kryttle.com, or the contact page.