Privacy Policy
Kriyah, operated by Krisattva Private Limited.
Last updated
1. About this policy
This policy explains how Krisattva Private Limited ("Kriyah", "we", "us") collects, uses and protects personal information.
It covers the kriyah.ai website, the Kriyah platform, Creator Portal links and any Kriyah connector you add to an AI assistant. The Hey! Creators mobile app is covered by its own privacy policy.
If you have questions about anything here, contact us at contact@kriyah.ai.
2. Information we collect
| Category | What it includes | How we get it |
|---|---|---|
| Account data | Name, email address, phone number, company name, password (stored only as a one-way hash) | You provide it when you register or contact us |
| Website forms | Name, work email, company and role, and your choice about product updates, when you request a sample report; for a demo, also your phone number, company website, how many creators you have worked with and your message | You provide it on kriyah.ai |
| Usage data | Features used, time spent and actions taken in the product | Collected automatically |
| Technical data | IP address, browser type and version, device information | Collected automatically |
| Campaign data | Creator lists, briefs, campaign details, agreements, drafts and performance records you create or upload | You provide it while using the platform |
| Creator Portal data | Quotes, callback requests, signed agreements, drafts, live post links and payment details a creator shares through a portal link | Creators provide it through the portal |
| Payment data | Billing details and transaction records | Collected through our third-party payment processor. We do not store full card numbers |
| Connector data | Authentication tokens, credit balance and a record of each request you make | Generated when you use a Kriyah connector |
We also process publicly available social media profile and performance information about creators to deliver our analytics, and data that creators choose to share from their own accounts, which we show as verified metrics.
3. How we use information
| Purpose | Basis |
|---|---|
| Providing and operating the platform, Creator Portal and connectors | Performance of our contract with you |
| Generating the analytics, reports and insights you request | Performance of our contract with you |
| Processing payments and managing credit balances | Performance of our contract with you |
| Responding to sample report, demo and trial requests | Your request, and our legitimate interest in following up |
| Security, fraud prevention, abuse detection and usage limits | Our legitimate interest in protecting the service |
| Product improvement and troubleshooting | Our legitimate interest, using aggregated or de-identified data wherever possible |
| Service updates and administrative messages | Performance of our contract with you |
| Marketing communications | Your consent, which you can withdraw at any time |
Every marketing message includes an unsubscribe option, and unsubscribing does not affect the service messages you need to receive.
We do not sell personal data, and we do not share it with third parties for their own marketing.
4. Creators' information and rights
Kriyah helps brands and agencies find and work with creators. Creator profiles are built from publicly available information and, where a creator connects their account, from data they choose to share.
- We show estimated figures, such as reach and fair price, as estimates.
- A creator can ask us to access, correct or remove the profile information we hold about them by emailing contact@kriyah.ai.
- Information a creator shares through a Creator Portal link is visible to the brand or agency running that collaboration and to us, and is used only to run that collaboration.
5. AI features
Kriyah uses AI to draft campaigns, suggest creators and budgets, write outreach and explain reports. These features process the data you provide or select to produce the output you ask for.
- AI-drafted content stays labelled until someone reviews or edits it, and nothing launches without your review.
- AI outputs can be inaccurate. Check them before relying on them.
- We do not use your campaign data or creator lists to train third-party AI models.
6. Kriyah connectors for AI assistants
If you connect Kriyah to an AI assistant such as Claude, operated by Anthropic, this section applies.
- Signing in
- Connecting uses OAuth 2.1. You sign in directly with Kriyah; your password is never shared with the assistant.
- What the assistant can access
- Only the permissions shown when you connect, such as engagement rate lookups and the related credit deduction. It cannot change your account settings, read your campaign data, or send messages.
- Tokens
- Access tokens are valid for one hour and refresh tokens for 30 days. Refresh tokens and authorisation codes are stored only as one-way hashes and rotate on each use.
- Activity records
- Each request is recorded against your account, with a timestamp and the credits used, for usage visibility, credit reconciliation and abuse prevention.
- Data shared with the assistant's provider
- Your requests and our results pass through the assistant to reach you, and are governed by that provider's privacy policy. We share nothing else and do not receive your conversations.
- Disconnecting
- Remove the connector in the assistant's settings. To revoke access immediately, email contact@kriyah.ai and we will invalidate the tokens.
8. Storage, security and transfers
Our infrastructure is hosted in India, and personal data is stored there by default. We transfer it outside India only where needed to deliver a feature you choose to use, such as a connector to an assistant operated outside India.
Our security measures include encryption in transit, passwords hashed with bcrypt, tokens and authorisation codes stored only as hashes, scoped and time-limited credentials, rate limiting, and access controls that limit staff access to what each role needs.
If a personal data breach is likely to affect you, we will notify you and the Data Protection Board of India within 72 hours of becoming aware of it, explaining what happened, what information was involved and what you can do.
9. How long we keep information
| Data | Retention |
|---|---|
| Account data | For as long as your account is active |
| Data after a deletion request | Deleted within 7 days |
| Website form submissions | Until you ask us to delete them, or 24 months after our last contact |
| Connector activity and access records | 12 months |
| Payment and transaction records | As required by Indian tax and accounting law |
| Authentication tokens | Access tokens 1 hour; refresh tokens 30 days |
10. Your rights
You can ask us to:
- Access the personal information we hold about you
- Correct anything inaccurate or incomplete
- Delete your information, subject to legal retention requirements
- Withdraw consent for marketing at any time
- Nominate someone to exercise these rights for you if you are unable to
Email contact@kriyah.ai to make a request. We respond within 7 days.
If you are outside India, you may have further rights under the laws where you live, such as the EU and UK GDPR, Singapore's Personal Data Protection Act or the Philippines' Data Privacy Act, including the right to object to processing, to data portability and to complain to your local data protection authority. We will honour these rights where they apply.
Grievance Officer. If you are not satisfied with how we handled your information or your request, contact Aravindha Bollineni, Chief Technology Officer, Krisattva Private Limited, at aravindha@kriyah.ai. If your concern remains unresolved, you may complain to the Data Protection Board of India.
11. Children
Kriyah is a business tool for people aged 18 and over. We do not knowingly allow anyone under 18 to create an account, and we do not knowingly collect personal information from children.
If you believe we hold information about someone under 18, contact us at contact@kriyah.ai and we will remove it promptly.
12. Google API data
Kriyah complies with the Google API Services User Data Policy, including its Limited Use requirements.
If you connect your Google account to manage email in the platform, we request the gmail.modify, gmail.compose and gmail.send scopes, the minimum needed for these features. This data is used only to manage, compose and send email at your direction. We do not keep it longer than needed to provide the service, do not share it with third parties and do not use it to train any AI or machine-learning model.
To revoke access or ask us to delete Google data, email contact@kriyah.ai.
14. Changes and contact
We may update this policy from time to time. When we make material changes, we will update the date at the top and tell you through the product or by email.
Krisattva Private Limited, Gowra FountainHead, HUDA Techno Enclave, Hitec City, Hyderabad 500081, India. Email contact@kriyah.ai.
Questions about this policy?
Email the Kriyah team at contact@kriyah.ai.