Privacy Policy for Kshetra

1.Who can use Kshetra

Accounts are created by invitation from an administrator of your organisation and are limited to email addresses on approved company domains. The app is intended for people aged 18 and over. We do not knowingly collect data from children.

2.What we collect

Account information. Your name, work email address, an internal user ID, and — if you choose to add them — a profile picture, job title and location.

Content you create. Messages, replies, emoji reactions, pinned and starred items, voice notes, photos, documents and other files you send; meetings you schedule and the people you invite; personal reminders you set.

Voice note transcripts. Voice notes are transcribed automatically so they can be read as text. Transcription runs on our own servers using a locally hosted speech-recognition model. Your audio is not sent to any external transcription service.

Activity needed to make chat work. Online/away/busy status, typing indicators, delivery and read receipts, when you were last active, and which channels you belong to.

Device information for notifications. A push notification token issued to your device by Google Firebase Cloud Messaging, and the platform (Android, iOS or web) it belongs to.

Server logs. Standard technical logs, including IP address, timestamps and requested endpoints, kept for security and troubleshooting.

3.Why we use it

To operate the service — deliver your messages, connect your calls, sync your meetings, notify you, and show your colleagues who is available. To secure the service — detect abuse, investigate incidents and keep audit records. To support you — respond to requests you send us. We do not use your data for advertising, we do not build advertising profiles, and we do not sell your data to anyone.

4.Who else sees your data

Other people in your organisation. Anyone in a conversation sees what you send to it. Your name, profile picture, title, location and availability are visible in the organisation directory. Administrators can see the list of accounts, invite and remove people, and delete accounts.

Google (Firebase Cloud Messaging). To deliver push notifications, the notification — which may include the sender's name and a preview of the message — passes through Google's Firebase Cloud Messaging service, together with your device's push token.

Google Calendar or Microsoft Outlook. Only if you connect a calendar. Once connected, meetings you organise in Kshetra are created on that calendar, including the title, description, time, duration and the email addresses of attendees. You can disconnect at any time in the app.

GitHub. Only if you connect a GitHub account. We store an access token and use it to read your repositories, pull requests and issues so we can show them in the app. We do not write to your GitHub account. You can disconnect at any time.

Sonu AI. The in-app assistant runs on a language model hosted on VIH Research Labs' own infrastructure. Your conversations with Sonu, and the data Sonu reads to answer you, are not sent to any third-party AI provider such as OpenAI, Anthropic or Google.

Service providers and legal requirements. Our hosting and email providers process data on our behalf under contract. We may disclose data where we are legally required to.

5.How your data is protected

All traffic between the app and our servers is encrypted in transit using HTTPS/WSS. Data is stored on servers operated for VIH Research Labs, and access is limited to authorised personnel.

6.How long we keep it

Messages, files and meetings are kept until you or your organisation delete them, or until your account is deleted. Push tokens are removed or deactivated when you sign out or the token stops working. Server logs are kept for TO DECIDE: log retention. Backups may retain deleted data for up to TO DECIDE: backup retention before being overwritten.

7.Your choices and rights

• Access and correction. Edit your profile in the app; contact us for anything else.
• Deleting your account. Request deletion at kshetra.vihresearchlabs.ai/delete-account or by emailing support@vihresearchlabs.ai. We delete your account, profile, push tokens and personal reminders. Messages you sent to a group may remain visible to that group's other members as part of their own conversation history, unless your organisation instructs us to remove them.
• Notifications. Turn them off per chat in the app, or entirely in Android settings.
• Camera and microphone. Requested only when you start a call or record a voice note, and may be denied — the rest of the app keeps working.
• Integrations. Connect and disconnect Google Calendar, Outlook and GitHub at any time in the app.
• Statutory rights. Depending on where you live, you may have rights to access, correct, export, restrict or object to the processing of your data. Contact us to exercise them. Because Kshetra is provided through your employer, your organisation may be the controller for some of this data and we may refer your request to them.

8.International transfers

Our infrastructure is located in India (AWS Asia Pacific — Mumbai). If you use Kshetra from elsewhere, your data is transferred there. Push notifications are processed by Google, and calendar data by Google or Microsoft, in the regions those providers operate.

9.Changes to this policy

We will update this page and change the "Last updated" date. Material changes will also be announced in the app.

10.Contact