Privacy Policy

1. Our Role — Controller & Processor

For personal data that an organization uploads or manages through its workspaces, the organization (our Customer) is the data controller / business and the Company acts as a data processor / service provider, processing personal data only on the Customer's documented instructions. For account, billing and Platform-operation data, the Company acts as a controller. Where the Company processes data on your behalf, an enterprise Data Processing Addendum (DPA) governs that processing and is available where required.

People who are named in a document in a workspace (for example a counterparty’s signatory) are not our customers. Their information in that document is controlled by the Customer who uploaded it. If you are such a person and want to exercise a right, we will help you reach the right Customer and, where we can, act on your request.

2. Information We Collect

• •Account and identity data: name, email, phone, organization, role.
• •Business and workspace content: documents, clauses, comments, approvals, attachments and related metadata you submit.
• •Signing evidence: for each electronic signature, your name, the time, your IP address and device, your consent and a fingerprint of the exact text signed.
• •Communications: messages, notifications and customer-support requests.
• •Usage and device data: log data, IP address, browser and device information, and the two hosting cookies described in Section 13.
• •Authentication data used to secure access, including password hashes and emailed verification codes.
• •Billing data: subscription and transaction information, processed by our payment provider; we do not store card numbers.
• •Information received from third parties, for example authentication or integration providers.
• •AI-processing data: content you choose to submit to AI features.

3. How We Use Data & Purposes of Processing

We process personal data to: provide, operate, secure and improve the Platform; authenticate users and manage access and permissions; enable collaboration, approvals and audit trails; provide AI-assisted features at your request; provide customer support; process payments and issue tax invoices; comply with legal obligations; and detect, prevent and respond to fraud, abuse or security incidents. We do not use personal data for advertising and we do not sell personal data.

4. AI Features & Data

When you use AI features, relevant content you choose to process may be sent to AI service providers, reached through our hosting provider, to generate summaries, suggestions, translations or analyses. The Platform is designed to send only content that the asking user is permitted to see. AI outputs are assistive only and may be inaccurate, and must be independently reviewed before reliance.

We do not use your Content to train AI models. Our hosting provider has confirmed in writing that, under its data processing agreement, it does not use customer personal data to train AI models and that its AI sub-processors are contractually prohibited from doing so. The AI Processing Disclosure lists the providers and what is sent.

5. Legal Bases for Processing

Where the GDPR or similar laws apply, we rely on one or more of these legal bases: performance of a contract, legitimate interests (operating and securing the Platform), compliance with legal obligations, and consent (where required). You may withdraw consent at any time without affecting prior lawful processing.

Under India’s Digital Personal Data Protection Act, 2023, we process personal data for a lawful purpose, either with your consent or for a permitted legitimate use such as performing something you have asked for, complying with law, or responding to a security incident, and we limit processing to what is needed for that purpose.

6. Disclosure, Subprocessors & Third Parties

We share personal data with: sub-processors that host and operate the Platform (hosting and database, AI providers, optional web search, payments and email) under contractual safeguards, as listed on our Sub-processors page; participants you invite into a workspace (subject to the Platform’s confidentiality and data-wall controls); and authorities where required by law or valid legal process. We do not use third-party analytics or advertising tools. The Company does not sell personal data.

7. International Data Transfers

Your data is stored in the United States. Our application runs on Amazon Web Services (US West, Oregon) and our database runs on MongoDB Atlas, hosted on Google Cloud (US Central, Iowa), through our hosting provider. Our hosting provider has told us that it offers only the United States and Europe as hosting regions, and that logs and backups stay in the United States. AI providers may process requests in other countries.

Where personal data is transferred from the EU, UK or Switzerland to a country without an adequacy decision, we use the Standard Contractual Clauses and the UK Addendum, and we have considered the transfer. You can ask for a copy of the safeguards at support@kpiandsla.com. See the Data Transfer Notice.

8. Security

We implement commercially reasonable administrative, technical and organizational measures to protect personal data, including encryption in transit; encryption of the database and its backups at rest by our hosting provider using provider-managed keys; access controls and role-based permissions; organization isolation; emailed verification codes (with an optional 30-day trusted-device setting); rate limits and account lockout; a limit of one active session per account; a 15-minute access token and automatic sign-out after 30 minutes of inactivity; and an audit trail of important actions. Staff can see workspace content only after the workspace owner approves a read-only support session, which is limited to 2 hours and logged.

No system can be guaranteed completely secure, and you acknowledge the inherent risks of transmitting and storing electronic information. Uploaded files are accepted without malware scanning and are labelled accordingly until scanning is introduced. If we become aware of a personal data breach affecting your Content, we will notify you without undue delay, and within the period the law requires where one applies, and we will report to authorities where the law requires.

We do not claim any specific certification (for example SOC 2 or ISO 27001) and we have not undergone a certification audit. The Security and Responsible Disclosure Policy explains how to report a vulnerability.

9. Data Retention & Deletion

We retain personal data for as long as necessary to provide the Platform, comply with legal and regulatory obligations, resolve disputes, preserve financial and security records, and enforce agreements.

When you ask us to delete a workspace or your account, it is removed from your view and held for 30 days so you can restore it; after that it can be permanently deleted from our live systems by an authorised administrator; this is a manual step and we aim to do it within a reasonable time. Customers can export their Content before deletion.

Copies in our hosting provider’s backups are not removed early. They expire automatically on the provider’s schedule, and a copy can remain for up to about one year. We do not restore deleted customer data from backups except to recover from a failure.

Records we must keep: invoices and tax records for the period tax and company law require (currently applied as 8 years); Executed Documents, signature records and the audit chain for up to 7 years after full signature; security logs for up to 180 days; support records for up to 2 years. A legal hold can pause deletion. The Retention and Deletion Policy gives the full table.

10. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict or object to processing, port your data, and withdraw consent. Under the CCPA/CPRA you may have rights to know, delete, correct and opt out of “sale”/“sharing” (we do not sell data). Under India's DPDP Act, 2023 you may access, correct and erase your data and nominate a representative. To exercise rights, contact us or your organization's workspace administrator; requests concerning workspace content are typically routed to the relevant Customer (controller).

To make a request, email support@kpiandsla.com with the subject “Privacy request”. We aim to acknowledge it within 3 working days and to answer within 30 days, or within the period the law requires; for a complex request we may extend this and will tell you why. We may refuse or limit a request where the law allows, for example where it would reveal another person’s information, or where a record must be kept by law (such as invoices and Executed Documents). You may also complain to the Data Protection Board of India or your local supervisory authority. The Data Subject Request and Grievance Procedure sets this out in full.

11. Applicable Privacy Frameworks

This Policy is designed to support compliance with, among others, the EU/UK GDPR, the California Consumer Privacy Act as amended by the CPRA, India's Digital Personal Data Protection Act, 2023 (DPDP Act), PIPEDA (Canada), LGPD (Brazil), POPIA (South Africa) and PDPA (Singapore). Where local law grants additional mandatory rights, those rights prevail to the extent required. Where we describe the Platform as “SOC-ready” or similar, that describes design intent and is not a claim of certification.

12. Children's Privacy

The Platform is intended for business and adult use and is not directed to children. We do not knowingly collect personal data from children below the age of majority in their jurisdiction. If you believe a child has provided us data, contact us so we can delete it.

13. Cookies & Similar Technologies

We set no cookies of our own for analytics or advertising. The cookies our Platform needs to work are strictly necessary (for sign-in and security).

Our hosting provider sets two cookies on every visit, before sign-in: __emg_vid (12 months) and __emg_sid (30 minutes). It uses them to count visitors and sessions for our hosting dashboard. We do not set them and cannot switch them off; they are set before our pages load, so a banner on our page cannot control them. You can block them in your browser; the Platform works without them. The Cookie Policy lists every cookie.

14. Changes to this Policy

We may update this Policy from time to time. We will communicate material changes through the Platform or by email before they apply, normally at least 30 days before. Continued use after the effective date constitutes acceptance of the updated Policy.

15. Contact & Data Protection

Millennia Technologies — KPI & SLA™ (kpiandsla.com). Runal Gateway, Ravet, Pune 412101, India. GSTIN 27AAWPW4891K1ZF; PAN AAWPW4891K. For privacy enquiries, to exercise your rights, or to raise a grievance, write to support@kpiandsla.com. Our grievance contact is Nitesh Walekar. We aim to acknowledge within 3 working days and respond within the periods set out in Section 10. We do not currently target customers established in the EU or UK and have not appointed a representative there; we will review this before we market to those regions in a way that requires it.