Privacy Policy

1. Who we are and what this policy covers

Sitelytc Digital Media Private Limited (CIN U63121DL2025PTC453508), New Delhi, India (Sitelytc, we) provides Kritvia, a business operating system that stores a business's records and runs AI agents that draft work for the business to approve. This policy explains how we handle personal data in connection with Kritvia, its website app.sitelytc.com, its desktop and installable apps, and our support channels.

We handle personal data in two different roles:

This policy fully governs Account Data. For Customer Data it describes what we do as processor; the business that uses Kritvia is responsible for giving you its own notice and handling your rights. Our Terms of Service set out our processing commitments to businesses.

This policy is published under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the DPDP Act), and under section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 for as long as those continue to apply.

2. What we collect, and why

Account Data (we are the Data Fiduciary). We collect only what we need for the purposes below. Where we rely on consent, you give it when you sign up and can withdraw it at any time (section 6); withdrawing consent needed to run your account means closing it.

We do not keep dictation audio, or the audio of voice notes you send Kritvia from a linked chat (they are turned into text like dictation). We keep the length, language and word count of each dictation; the text is kept only where you save it as a note. The Kritvia desktop app's auto-learn feature, if you switch it on, briefly holds your keystrokes in memory for up to 8 seconds after you paste dictated text, only to learn your corrections; it does not store or send those keystrokes.

Customer Data (we are a Data Processor). Businesses using Kritvia put in or connect data that may include personal data of their own customers and contacts: emails and attachments, WhatsApp and Telegram messages, calendar events, Drive files, uploaded documents (including loan papers and identity documents), meeting recordings and transcripts, leads, proposals, accounting entries, invoices (including customers' GSTINs and addresses) and payments, bookings, review requests, shipment files (buyers', suppliers' and clients' names and contact details, what was shipped, shipping, customs and payment details, and the trade documents attached), enquiries fetched from the business's IndiaMART account (the buyer's name, company, phone, email, city and what they asked for), and phone calls handled by Kritvia on the business's own number (the caller's number, what was said as text, a summary, and whether they asked not to be called). We process this only to provide Kritvia to that business: to store and search it, extract facts, and run the agents it switches on (including the short lessons a skill learns from how a person edits its drafts, and the reports the business's team leads write). We do not use it for our own purposes, sell it, use it for advertising, or use it to train AI models.

3. How AI is used

Kritvia uses AI models to read Customer Data and draft replies, summaries, proposals and extracted fields. Six rules govern this:

1. Sensitive records stay on our servers. A document or message marked sensitive, kept in a role-restricted area, uploaded as a loan document, or in which we detect an Aadhaar, PAN, passport, bank-account or card number, is processed only by AI models running on our own servers in India. Search indexes (embeddings) and text recognition (OCR) always run on our own servers.
2. By default, only models that do not train. Other tasks go to the free hosted AI providers in section 4 whose terms do not let them use the content to train their models (they keep it, if at all, only briefly for abuse monitoring). A business's owner may also switch on free models whose providers may learn from the content they receive (Google Gemini free tier, OpenRouter free models, Mistral free tier). We never use those for sensitive records, or for a business that has connected Google Workspace. The business's privacy notice to its customers then says so.
3. A business may use its own AI provider. If a business adds its own key for a provider such as OpenAI, Anthropic or Google, its ordinary tasks go to that provider under the business's own agreement with it. Sensitive records still stay on our servers.
4. A person approves before anything is sent. Drafts wait for a person's approval before they leave Kritvia, unless the business has expressly allowed a specific agent to act on its own. A person can approve in Kritvia or, if they have linked it, from Telegram, WhatsApp or Slack. A website form filled in by the browser agent, and a phone call Kritvia makes to a customer, always wait for a person's approval.
5. AI on the phone says so. When Kritvia answers a business's phone or calls a customer, it always says it is the business's AI assistant. It does not record calls. Either the business's phone provider (Twilio) turns speech into text and speaks Kritvia's replies, or (on Exotel, and when a business chooses Kritvia's voice on Twilio) the call's audio streams to our servers, which send each turn only to the speech service the business chose and keep none of the audio. Kritvia keeps the text and a summary for the business.
6. No automated decisions about you. Kritvia does not make decisions with legal or similarly significant effects about individuals; the business makes them, and outputs are suggestions only.

Google user data. If a business connects Google, Kritvia accesses Gmail (to send replies the business approves and, where the business grants read access, to read incoming mail), Google Calendar (to create events and, for bookings, to read only the start and end times of events so Kritvia can offer free slots) and Google Drive (only the files the business chooses in Google's file picker or, where it grants wider access, the files it chooses to import). A business can instead forward its mail to its own Kritvia address; Kritvia handles forwarded mail the same way as mail it reads. Kritvia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide the features the business switches on, which are visible in Kritvia;
• we transfer it to others only as needed to provide those features (for example, to an AI provider in section 4 that does not train on it, to draft a reply), for security, or to comply with law, and never to an AI model whose provider may train on it;
• we do not use it for advertising, sell it, or use it to train generalised AI or machine-learning models;
• our staff do not read it unless the business asks for support with specific items, it is needed to investigate security or abuse, or the law requires it.

You can remove Kritvia's access at any time at myaccount.google.com/permissions (opens in a new tab) or in Kritvia's settings.

4. Who we share data with

We share personal data only with the service providers below, who process it on our instructions under contracts that require them to protect it, and only to the extent each needs. We do not sell personal data.

Services a business connects. When a business connects Google Workspace, the WhatsApp Business Platform (Meta) or its own Telegram bot, Kritvia reads from and sends through the business's own account with that provider. When a business connects Slack, Kritvia posts short notices to the channel it chose: who needs attention and a link back to Kritvia, never what a customer wrote. If a person links their own Telegram or Slack account for approvals, Kritvia sends that person, privately, a card with a preview of each draft (who it goes to and up to 700 characters of what it says) so they can approve or reject it there; drafts marked sensitive are never previewed and are reviewed only in Kritvia. Scheduled reports a business sets up are delivered to the email address, Telegram chat or Slack channel it chooses. When a business connects its own Razorpay account, Kritvia creates payment links for its invoices in that account and receives Razorpay's notice when one is paid; the money goes straight to the business, and Kritvia never holds it. When a business connects its IndiaMART Lead Manager key, Kritvia fetches the business's new enquiries from IndiaMART every few minutes and adds them as leads. When a business connects its own Exotel or Twilio number, calls to that number are answered by Kritvia through the business's account with that provider, which carries the call, and Kritvia can call the business's customers through that account after a person approves each call. With Twilio's own speech, Twilio turns the caller's speech into text and speaks Kritvia's replies, and Kritvia receives only text. On Exotel, or with Kritvia's voice on Twilio, the call's audio streams to our servers, which pass each turn of speech to the speech service the business chose (Kritvia's own, on our machines or Groq, or a provider it connects with its own key) and keep only the text. When a business uses the browser agent, Kritvia's own browser on our servers opens public websites for the job: those websites see a visit from our servers marked as Kritvia's agent, it never signs in or keeps cookies, and a form is sent to a website only with the values a person approved. When a business connects another app through its MCP server, the Kritvia assistant sends that app only what a task needs, and anything that changes the app waits for a person's approval. When a business sets up single sign-on, its people sign in on the business's own identity provider, which sends Kritvia their name and email address; Kritvia keeps the provider's address and the app's client ID, the client secret encrypted, and when SSO was last used. To check that the business owns its email domain, Kritvia looks up one public DNS record through Cloudflare's or Google's public DNS service, which receives only the domain name. Each provider handles the data under its agreement with the business.

Payment pages. A business can share a payment page for an invoice through a private link. Anyone with the link can see that one invoice (the business's and the customer's names, items, amounts and tax details) and pay it; the page shows nothing else. The business chooses whom to send it to, and the link is long and random so it cannot be guessed.

Other disclosures. We may disclose personal data (a) where the law, a court order or a government agency with lawful authority requires it, after checking the request is valid and disclosing no more than required; (b) to protect the security of Kritvia, our customers or the public; or (c) to a buyer or successor if our business is reorganised or sold, who must honour this policy.

Transfers outside India. Data is stored in India. The AI providers and push services above may process the text of individual tasks outside India, as shown. The DPDP Act permits this except to countries the Government of India restricts; we will stop any transfer to a restricted country. We will update this list, and notify business customers at least 15 days ahead, before adding a provider.

5. How long we keep data, and how we protect it

We keep personal data only as long as the purpose needs it or the law requires, then delete it or make it anonymous.

Security. We protect personal data with reasonable security safeguards, including:

• encryption of all traffic in transit, and AES-256 encryption at rest of documents, messages, recordings, drafts and connection tokens, with a separate key for each business;
• database-level isolation so that one organisation can never read another's data;
• passwords stored only as Argon2 hashes; short-lived sessions, revoked when you change your password; limits on repeated sign-in attempts;
• role-based access within each organisation, and a tamper-evident audit log;
• nightly backups encrypted with a key kept offline, tested by restoring them;
• monitoring every five minutes with alerts to our team; and
• access by our staff only where needed, under confidentiality duties.

More detail is on our Security page. No system is perfectly secure, and you help by keeping your sign-in details private.

If there is a breach. If a personal data breach affects you, we will tell you without delay through your account or email: what happened, the likely consequences for you, what we are doing about it, the steps you can take, and whom to contact. We will report it to the Data Protection Board of India, with a full report within 72 hours of becoming aware of it, and to CERT-In within 6 hours where the law requires. Where the breach affects Customer Data, we will tell the business within 24 hours so it can inform you.

6. Your rights

Under the DPDP Act you have the right to:

• access a summary of the personal data we process about you and how, and the providers we share it with;
• correct, complete or update it;
• erase it, unless the law requires us to keep it;
• withdraw consent at any time, as easily as you gave it (this does not affect processing already done);
• nominate someone to exercise your rights if you die or become unable to; and
• have a grievance resolved, and then complain to the Data Protection Board of India if you are not satisfied.

How to use them. In Kritvia, go to Your account to download your data or delete your account. For anything else, including if you can't sign in or you are a customer of a business that uses Kritvia, use our privacy request form or email [email protected] (opens in a new tab) with "Privacy" in the subject. You get a reference number straight away. We confirm your identity by replying to the email address you give; we never ask for identity documents through the form. We acknowledge requests within 2 business days and respond within 30 days, and in any case within the 90 days the law allows. Using your rights is free, and we will not treat you differently for using them.

If a business holds your data in Kritvia (for example you are its customer or a loan applicant), please contact that business: it decides how your data is used. If you write to us, we will pass your request to the business and help it respond.

Grievance officer. Mayank Thakur, Grievance Officer, Sitelytc Digital Media Private Limited, New Delhi, India. Email: [email protected] (opens in a new tab) with "Grievance" in the subject. If you are not satisfied with our answer, you may complain to the Data Protection Board of India through the digital platform the Board provides.

7. Children

Kritvia is a tool for businesses and is only for people aged 18 or over. Everyone confirms they are 18 or older when they create an account or accept these terms, and we record that confirmation; we do not ask for your date of birth. If we learn that someone under 18 has an account, we close it and delete their Account Data. Kritvia is not directed at children under 13, and we do not knowingly collect personal data from them (as the US Children's Online Privacy Protection Act requires).

A business that puts children's personal data into Kritvia (for example a parent's loan file that lists a child) must obtain verifiable consent from the child's parent or lawful guardian as the DPDP Act requires, and must not use Kritvia to track or monitor children's behaviour or to target advertising at them. If you are a parent and think your child's data is in Kritvia, contact the business, or use our privacy request form and we will help.

8. Cookies and similar technology

We use only cookies and browser storage that Kritvia needs to work: to keep you signed in, protect sign-in, and remember your theme, your language and the business you last used. We use no advertising or analytics cookies and no third-party trackers, so we do not ask for cookie consent. Our Cookie Policy lists every cookie and storage key. We honour the Global Privacy Control signal from your browser.

9. If you are in the European Economic Area, the United Kingdom or Switzerland

Kritvia is offered to businesses in India. If the EU or UK General Data Protection Regulation (GDPR) applies to our processing of your data, the following also applies.

• Our role. We are the controller of Account Data and a processor of Customer Data for the business that uses Kritvia.
• Legal bases. We process Account Data to perform our contract with you or your business (GDPR art. 6(1)(b)); for our legitimate interests in keeping Kritvia secure, preventing misuse and fixing faults (art. 6(1)(f)); to meet legal duties such as tax records (art. 6(1)(c)); and with your consent for voice dictation and browser notifications (art. 6(1)(a)), which you can withdraw at any time.
• Your rights. Besides the rights in section 6, you can ask us to restrict processing, receive your Account Data in a portable format (Your account → Download my data gives you a machine-readable file), and object to processing based on legitimate interests. We do not make decisions about you based solely on automated processing. We respond within one month, which we may extend by two months for complex requests, telling you why.
• Transfers. Your data is stored in India, which does not have an EU or UK adequacy decision. Where GDPR requires, we will sign the European Commission's Standard Contractual Clauses (and the UK Addendum) with a business customer on request.
• Representative. We have not appointed a representative in the EU or UK because we do not offer Kritvia there. If that changes, we will appoint one and name them here.
• Complaints. You can complain to the data protection authority where you live or work.

10. If you are a California resident

We may not meet the thresholds that make the California Consumer Privacy Act (as amended by the CPRA) apply to us, but we follow these commitments anyway.

• No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the last 12 months. Because we do neither, there is nothing to opt out of; we still treat a Global Privacy Control signal as an opt-out request.
• What we collect. In the last 12 months we collected the categories in section 2: identifiers (name, email, IP address), commercial information (plan and billing records), internet activity (sign-in and usage records), audio (dictation, which we do not keep) and professional information (your organisation and role). We collected them from the sources, for the purposes, and keep them for the periods in sections 2 and 5, and disclose them only to the service providers in section 4.
• Sensitive information. We use account sign-in details only to provide and secure Kritvia, and never to infer characteristics about you.
• Your rights. You can ask to know what we collect, use and disclose; to delete it; and to correct it, through section 6. An authorised agent can ask for you with your signed permission. We verify requests by email, and we will not discriminate against you for using these rights.

11. Changes to this policy

This policy is written in English, and the English text is the binding version. Kritvia can show its interface in Hindi, but that translation does not cover this policy.

We will update this policy when our practices or the law change, and change the date at the top. For a material change we will tell you by email or in the app at least 15 days before it takes effect. Where a change needs your consent, we will ask for it.