Keyda Two different roles, and why it matters
This policy describes two relationships, and it is worth separating them because your rights differ in each:
- You, the business owner. For your own account details we are the controller — we decide what to collect and why. That is what this policy covers.
- Your customers, who chat with your Bot. For those conversations you are the controller and we act only as your processor, on your instructions. Those obligations are in our Data Processing Agreement. If you are a customer of one of our customers and want your chat deleted, ask that business — they control it, not us.
What we collect from you
Account data
Your phone number, or the name and email address your Google account returns when you choose Google sign-in. We use these to identify your account and to reach you about the Service. We do not use your phone number for marketing.
Business data
The business name, category and profile details you enter — opening hours, address, contact number, payment methods, delivery areas, policies — plus the sources you add and the answers you save. This is the knowledge that makes your Bot work.
Conversation data
Messages exchanged between your customers and your Bot, and whether each was answered. We process these on your behalf, as described above.
Operational data
Usage counts for metering (answers per day per business), and standard server logs including IP address, user agent and timestamps — used to run the Service, prevent abuse and diagnose faults.
We do not collect payment card details. Payments are handled by Razorpay; card data goes to them directly and never reaches our servers. We do keep a record of each payment — the plan, the amount, the currency and Razorpay's reference — so we can show you your receipts and answer a billing question.
Why we are allowed to process it
- To perform our contract with you — running your Bot, metering usage, supporting you.
- Our legitimate interests — keeping the Service secure, preventing abuse, and improving reliability.
- Legal obligation — tax, accounting and lawful requests from authorities.
Who it reaches
We share data with the sub-processors listed in our Data Processing Agreement — AI providers who generate answers, our hosting and database providers, and the provider that delivers your sign-in code. Each acts under contract and only to deliver the Service.
We do not sell your data, and we do not share it for advertising.
The AI providers we use do not retain your content to train their models. Answers are generated on demand.
Who at Keyda can see it
Our operations team can read a business's conversations to investigate abuse or when you ask us for help with a specific chat. Every such access is recorded — what was read, which business, when and from where. That log is itself subject to erasure requests.
How long we keep it
- Visitor conversations: 90 days by default. You can shorten this, extend it up to one year, or turn expiry off entirely, per bot, in your dashboard settings.
- Your sources and saved answers: until you delete them.
- Your account and business: until you delete the business.
- Server logs: a short rolling window for security and diagnostics.
Deleting a source removes its content from your assistant immediately. Deleting your business removes its sources, saved answers, conversations and the assistant itself, and is not recoverable.
Where it is processed
Our servers and databases are operated on our behalf by the hosting providers named in the sub-processor list. The AI providers that generate answers process content outside India. Where transfers require safeguards, they are made under the terms of our agreements with those providers.
Security
Access to the dashboard requires a signed token bound to your business account; a token issued for one product cannot be used on the other. Sign-in codes are stored only as a hash, never in readable form, expire quickly and are single-use. Administrative access is separately credentialed and logged. See Limits and security for the operational detail.
Your rights
You can ask us to access, correct, export or delete your account data, and to restrict or object to processing. Most of this is immediate in the dashboard; for anything else write to business@keyda.in and we will respond within 30 days.
If you are unhappy with how we handled a request you may complain to your local data protection authority.
Children
Keyda Business is a tool for businesses and is not directed at children. Do not use your Bot to knowingly collect personal data from children without the consent their law requires.
Changes to this policy
We will update the date at the top when this policy changes, and will tell you by email or in the dashboard when a change materially affects you.
Contact
Privacy questions, or to exercise any right above: business@keyda.in.