Privacy Policy

Last updated: 16 October 2026 · Effective date: 16 October 2026

This Privacy Policy explains how OpenKit AI ("OpenKit AI", "we", "us"), the provider of the OpenKit AI company directory at openkitai.com, the OpenKit AI app and the business panels reached through it (the "Service"), collects, uses, shares and protects personal data.

1. Who we are

• Company: OpenKit AI, Bhopal, Madhya Pradesh, India
• Contact: contact form
• Grievance Officer (India) / privacy contact: Jitendra Wadhwani, via the contact form
• EU/UK representative: Not appointed at this time. If the law requires one for your region, use the contact form and we will confirm the position.

2. Our two roles

Businesses that appear in the OpenKit AI directory (resellers) run their own branded panel on a *.openkitai.com address. For the people they serve, each reseller decides why and how customer data is used; we process that data on their behalf as their service provider. Every AI-generated reply in a panel has a Report button: reported replies are stored and reviewed by our team.

• As controller / Data Fiduciary: for the personal data of our account holders (business owners, resellers and their staff) and website visitors.
• As processor / Data Processor: for personal data that our customers upload or collect through the Service about their own customers (for example leads, chat visitors, contacts, appointment, order and invoice recipients, and review requesters). Our customer is the controller / Data Fiduciary for that data and is responsible for giving notice and obtaining consent. See our Terms and GDPR and DPDP notice. A Data Processing Addendum may be provided on request.

3. Data we collect

Account data: name, email, mobile number, password (stored only as a secure hash), role (customer/reseller), referral source, and two-factor authentication settings. Locale data: country, currency, language and time zone. These are detected from network and browser signals, such as a country header from our network provider, browser time zone and browser language, when you sign up. Business data: your business profile, services, products, prices, FAQs, logo and branding, website content, and reseller branding (brand name, logo, colour, domain, support email). Wallet and transaction data: balance, top-ups, charges and refunds, invoice and payment references. Card or bank details are handled by our payment gateways (for example Razorpay, PayPal or Stripe, including a reseller's own gateway when configured), not stored by us as full card numbers. Communications data: chat messages and transcripts, AI-generated summaries, WhatsApp messages sent and received through your linked number, campaign recipients and delivery status, reminders, review ratings and comments, missed-call logs, and Project Agent project messages and attachments. In chats, users can Report (flag) AI replies and Block contacts. End-customer data (processed for our customers): names, phone numbers, emails, addresses, order and appointment details, and messages. Technical data: IP address, device and browser information, logs, and security events such as failed logins and rate-limit events. Developer data: API keys (stored securely), webhook URLs and delivery logs. Cookies: essential cookies for sign-in, security (CSRF) and preferences. We do not currently use separate analytics or marketing cookies on the Service; if that changes we will update this policy and, where required, show a cookie notice.

4. How we use data and our legal bases

5. AI processing

Chat messages, business data and Project Agent conversations may be sent to third-party AI model providers (configured by the platform, for example providers compatible with Gemini, OpenAI, Groq or similar) to generate replies and summaries. We configure providers under their API terms; you should assume messages leave our servers to the active provider. AI output can be inaccurate. In chats you can Report (flag) an AI reply that you consider inappropriate. We do not use AI to make decisions that have legal or similarly significant effects on you solely by automated means.

6. Sharing and sub-processors

We share personal data only with service providers that help us run the Service, under contracts, for example:

• Hosting, network and storage: GoDaddy VPS (Singapore region), Cloudflare (DNS/CDN/security); uploaded files stored on our own VPS local disk (no third-party object storage).
• AI model providers: as configured in the platform (may include Google Gemini, OpenAI, Groq or others enabled by the operator)
• Email delivery: transactional email via the configured mail provider (for example SMTP such as Brevo or Amazon SES)
• SMS and voice (when enabled): providers such as MSG91, Twilio, Plivo or Exotel if activated
• Payments: Razorpay, PayPal and/or Stripe (platform or reseller gateway)
• Social networks: only when you connect them and schedule posts
• WhatsApp: messages pass through WhatsApp/Meta when you link your number

We also share data with your reseller if you signed up through one, with authorities when required by law, and with a successor in a merger or acquisition. We do not sell personal data. If you joined through a reseller, that reseller can see your account details (name, email, phone and wallet information). A current sub-processor list can be requested at the contact form until a public page is published.

7. International transfers

We are based in India, and our providers may process data in other countries. For transfers from the EU/UK we rely on appropriate safeguards such as the EU Standard Contractual Clauses / UK IDTA where applicable. For transfers from India, we follow any restrictions notified by the Government of India under the DPDP Act.

8. Retention

We keep data while your account is active and for as long as needed for the purposes above, then delete or anonymise it, as follows:

• Deleted accounts: erased or anonymised 30 days after deletion.
• Unconfirmed deletion requests: expire after 7 days if not confirmed.
• OTPs: kept for 24 hours.
• Error logs: 30 days.
• AI provider logs: 90 days.
• Read admin alerts: 180 days.
• Wallet and transaction records: kept in anonymised form for accounting / tax purposes as required.
• Backups: kept for 14 days.
• Chat transcripts, leads and other account data: retained while the account is active; after account deletion they follow the deleted-account timeline above (erased or anonymised within 30 days), subject to the wallet/accounting rule.

9. Security

Our safeguards include OTP sign-in, optional 2FA, hashed passwords, encryption of stored provider credentials, rate limiting, signed webhooks, access controls and a wallet ledger that cannot be edited. No system is 100% secure. If a personal data breach occurs, we will notify affected users and authorities as the law requires, including the Data Protection Board of India and, where applicable, the EU/UK supervisory authority.

10. Your rights

Depending on where you live, you may have the right to access, correct, update, erase, restrict or object to processing, to data portability, to withdraw consent, to nominate a person to exercise your rights (DPDP), and to raise a grievance or complaint. See our GDPR and DPDP notice. To exercise these rights, email the contact form (Grievance Officer: Jitendra Wadhwani). We will verify your identity and respond within the time the law requires. If you are an end customer of a business using OpenKit AI, please contact that business first. We will help them respond. You can delete your account in the app at Settings → Delete account, or via the public page https://openkitai.com/delete-account. You may also email the contact form (Grievance Officer: Jitendra Wadhwani). In chats you can Report (flag) an AI reply and Block a contact.

11. Children

The Service is meant for businesses and is not directed at children. You must be at least 18 years old (or the age of majority where you live) to create an account. We do not knowingly process children's data without verifiable parental consent, as the DPDP Act requires.

12. California residents (CCPA/CPRA)

We do not sell or "share" (for cross-context behavioural advertising) personal information and do not use sensitive personal information for purposes requiring a right to limit. California residents may request to know, access, correct and delete personal information and will not be discriminated against for exercising these rights. Requests: the contact form. Where we process data for a business customer, we act as its service provider.

13. Your responsibilities as a business customer

If you use the Service to contact your own customers, you are responsible for giving them notice, obtaining opt-in consent, honouring opt-outs and DND/NCPR preferences, and complying with TRAI and WhatsApp rules, as set out in our Terms. We are not responsible for your processing choices.

14. Changes

We may update this policy. We will post the new version here and notify you of material changes by email or in the app.

15. Contact and complaints

Use the contact form · Grievance Officer: Jitendra Wadhwani (via the contact form). You may also complain to the Data Protection Board of India or to your local data protection authority. We acknowledge grievances within 24 hours and resolve them within 15 days, as required by the IT (Intermediary Guidelines) Rules, 2021.

If this policy is translated, the English version prevails.