Privacy Policy

Last Updated: September 12, 2026

Policy Version: privacy-2026-09-12

1. Introduction and Regulatory Framework

This Privacy Policy explains how Kroply (operated by AgroMantra AI / Kroply Technologies, "we", "us", or "our") collects, uses, stores, processes, discloses, and protects personal data and commercial business information when you access or use our web platform at https://kroply.in, the Kroply mobile applications for Android and iOS devices, APIs, and associated services (collectively, the "Platform").

We have drafted and operationalized this policy in strict compliance with the statutory laws of the Republic of India, including:

2. Roles and Classifications under Data Protection Law

Under the DPDP Act, 2023:

3. Information We Collect

3.1 Account and Identity Data

3.2 Commercial, Inventory, and Billing Data

3.3 Technical, Device, and Mobile Telemetry Data

3.4 Payment Transaction Data

Zero Storage of Sensitive Financial Secrets: Kroply does NOT collect, process, or store credit or debit card numbers, CVVs, expiry dates, net banking passwords, or UPI PINs. All electronic transactions are processed through authorized payment aggregators (such as Razorpay). We receive and store only non-sensitive transaction reference metadata, including Gateway Payment ID, Order ID, transaction date, amount charged, plan purchased, and payment status (Success / Failed / Pending).

3.5 Google Sign-In Data

When you choose to register or log in using Google Sign-In, we receive identity profile information authorized by you via Google OAuth (specifically, your verified email address, full name, and avatar URL). We do not receive access to your Google account password, contacts, or Google Drive files.

4. Mobile Hardware and Device Permissions

To provide native functionality on Android and iOS devices, the Kroply mobile application may request the following explicit system permissions:

5. Lawful Grounds and Purposes of Processing

Under the DPDP Act, 2023, we process personal data strictly under valid lawful grounds, including affirmative consent, performance of our contract with you, and compliance with statutory legal obligations. We use collected data for the following specific purposes:

6. AI Model Providers and OCR Document Processing

When you use our automated invoice extraction feature:

7. Data Sharing and Disclosure

We do NOT sell, rent, monetize, or trade your personal data or business records to third parties.

We disclose data only to trusted service providers who assist us in operating the Platform, subject to strict confidentiality agreements and security standards:

8. Data Storage, Cross-Border Transfers, and Localization

Primary production databases and business data are hosted on secure cloud servers. To the extent that certain third-party service providers (such as AI extraction APIs or communication endpoints) process data outside India, such processing complies with Section 16 of the DPDP Act, 2023 and adheres to cross-border transfer standards and any restrictions notified by the Central Government of India.

9. Reasonable Security Practices and Procedures

In compliance with Section 43A of the Information Technology Act, 2000, the SPDI Rules, 2011, and Section 8(5) of the DPDP Act, 2023, we implement robust technical and organizational security controls:

10. Data Retention and Deletion Lifecycle

11. Your Rights as a Data Principal (DPDP Act, 2023)

Under Chapter III of the Digital Personal Data Protection Act, 2023, you have the following enforceable rights:

Self-service tools: Signed-in web users can go to Settings → Privacy & consent to view the Terms and Privacy Policy versions they accepted and when, turn optional analytics on or off (withdrawing consent at any time), add, change or remove a nominee, and use Download my data to receive a JSON summary of the personal data we hold about them (profile, consents, organization memberships, shops they own and sign-in sessions). Visitors can change their cookie choice at any time using the Cookie preferences option. Withdrawing consent to the Terms and Privacy Policy themselves means closing your account, which you can request as described in Section 12.

To exercise any other right, email your request to team@kroply.in with your registered mobile number and business details. We will verify your identity before processing the request and aim to respond within 7 days, and in any case within the timelines prescribed under the DPDP Rules, 2025 (not exceeding 90 days).

12. In-App Account and Data Deletion (Apple & Google Compliance)

In strict compliance with Apple App Store Review Guideline 5.1.1(v) and Google Play Data Safety requirements, mobile and web users can easily initiate account deletion:

Both business owners and staff members can request deletion of their own account. For a staff member, we erase that person's login and personal details and remove their access to the business; business records they created on behalf of the business remain with the business owner (the Data Fiduciary for that data).

Upon receiving your verified request, our compliance team will initiate the deletion lifecycle described in Section 10, complete it within 7 working days of your confirmed request, and confirm completion via email.

13. Personal Data Breach Notification Protocol

In compliance with Section 8(6) of the DPDP Act, 2023:

In the unlikely event of a confirmed personal data security incident or unauthorized breach affecting your personal data, Kroply has an established Incident Response Team to immediately contain and remediate the vulnerability. We will promptly notify the Data Protection Board of India and affected Data Principals without undue delay, detailing the nature of the breach, affected data categories, remedial actions undertaken, and recommended precautionary steps.

14. Cookies, Local Storage, and Analytics

Necessary cookies and local storage (always on): The Kroply web application uses session cookies and HTML5 local storage that are strictly necessary for:

Optional analytics (only with your consent): If you choose Accept analytics in the cookie banner, we use Google Firebase Analytics (provided by Google) to understand how the web app is used, such as pages viewed and buttons clicked. Analytics is identified only by a pseudonymous account/device identifier, never by your name or email. If you choose Only necessary, or do not make a choice, analytics is not loaded and no analytics cookies are set. You can change your choice at any time from Cookie preferences or, when signed in, from Settings → Privacy & consent; withdrawing stops further collection.

We do not use third-party cross-site advertising cookies or behavioral ad tracking pixels.

15. Children's Privacy

The Platform is strictly a commercial business-to-business (B2B) ERP and invoicing platform designed for commercial merchants aged 18 years and above. We do not knowingly solicit, collect, or process personal data from individuals under 18 years of age. If you suspect that a minor has submitted personal data, please contact us immediately at team@kroply.in for prompt investigation and deletion.

16. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect statutory rules issued by the Government of India under the DPDP Act, mobile operating system guideline updates, or enhancements to Kroply's service architecture.

When material changes occur, we will update the "Last Updated" date and version identifier, display an in-app banner, and request updated affirmative acceptance where required by law.

17. Designated Grievance Officer and Contact Details

If you have questions, feedback, or complaints regarding this Privacy Policy, wish to exercise your Data Principal rights, or seek grievance redressal under Rule 3(2) of the IT Rules 2021 or Section 8(9) of the DPDP Act, 2023, please contact our designated Grievance Officer:

Statutory Redressal Timeline: All privacy grievances will be acknowledged within forty-eight (48) hours of receipt. We aim to respond to and resolve grievances within seven (7) days, and in any case within the period prescribed under the DPDP Rules, 2025, which shall not exceed ninety (90) days.

Right to complain to the Data Protection Board: If you are not satisfied with our response, or we do not respond within the above period, you may file a complaint with the Data Protection Board of India in accordance with Section 13(3) of the DPDP Act, 2023 and the procedures established by the Board. You must first exhaust the grievance redressal mechanism described above before approaching the Board.