Privacy Policy

This Privacy Policy explains how Knight21 Digi Hub Pvt Ltd (“Knight21”, “we”, “us”) collects, uses, shares and protects personal data in Knight21 Business OS (the “Service”) at https://crm.knight21.in. It is written to meet the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.

1. Who this covers and our role

• Our customers and their team members — businesses that subscribe to the Service and the people they add (owners, admins, managers, telecallers, employees, HR). For their account data we decide why and how it is used (we are the data fiduciary).
• Our customers’ own customers and leads — people whose details a business stores in its workspace (for example someone who filled a business’s Facebook lead form). For this data the business decides why it is collected and is the data fiduciary; we process it only on the business’s behalf and on its instructions (we are a data processor).

2. What we collect

Account and workspace

• Name, email address, phone number, password (stored only as a secure hash — nobody at Knight21 or the business can see it), role and team.
• Business details the owner enters: business name, GSTIN, PAN, address, logo, support contacts.
• Two-factor sign-in settings, sign-in history (time, IP address, browser) and an audit log of changes.

Business records

• Leads, contacts, companies, deals, tasks, notes, call outcomes, follow-ups, quotations, invoices, payments, expenses, vendor bills, projects and work reports that a business adds.
• Consent choices for each contact (WhatsApp, SMS, email, calls) and where they came from.

People & HR (only when the business uses it)

• Employee records, attendance, leave, payslips, documents (such as ID proofs), training results and appraisals.
• Location: when attendance is switched on, the device’s location is read only at the moment of check-in and check-out to confirm the person is at the office. It is never tracked in between. Accuracy and IP address are stored with each check-in.

Payments

• Plan payments are processed by Razorpay (or by UPI / bank transfer). We receive the payment reference and status; we never receive or store card numbers, UPI PINs or bank passwords.

Technical data

• IP address, browser and device type, pages used and error logs, kept for security and to keep the Service working. We use only essential cookies (to keep you signed in and remember your workspace); we do not use advertising cookies.

3. Data from Facebook and Instagram (Meta)

A business can connect its Facebook Page to the Service so that leads from its Facebook and Instagram lead ads arrive in its workspace automatically. When a business does this:

• With the permission given through Facebook Login, we receive the list of Pages the person manages, an access token for the Page they choose, and the answers people submit in that Page’s lead forms (for example name, phone number, email and the form’s questions), together with the form, ad and campaign the lead came from.
• We use this data only to create and update leads in that business’s own workspace, so its team can contact the people who asked to be contacted.
• We do not sell this data, do not use it for advertising, do not share it with other businesses using the Service, and do not use it to build profiles of people across businesses.
• Page access tokens are stored encrypted (AES-256) and are used only to fetch that Page’s leads.
• The business can disconnect its Page at any time (Settings → Integrations), or remove the app in Facebook (Settings & privacy → Settings → Business integrations). We then stop receiving data and delete the stored token. See Data deletion for how to have the data itself deleted.

Our use of information received from Meta follows the Meta Platform Terms and Developer Policies.

4. Why we use personal data

• To provide the Service: accounts, workspaces, lead management, reminders, attendance, payroll and the other features a business turns on.
• To send service messages: verification and password emails, reminders, invoices, renewal notices and support replies.
• To keep the Service secure: sign-in protection, fraud and abuse prevention, audit logs.
• To take payment for plans and meet tax and accounting law.
• To provide support, including (only with a logged reason and time limit) Knight21 staff opening a workspace to help.
• To improve the Service using aggregated, non-identifying usage figures.

We process account data because it is needed to provide the Service you signed up for, to meet legal obligations, and on the basis of your consent where the law requires it. Businesses are responsible for having consent or another lawful basis for the data they put into their workspace about their own customers and employees.

5. Who we share data with

We do not sell personal data. We share it only with service providers who help us run the Service, under contracts that require them to protect it:

• Cloud hosting and database servers (where the Service and its backups run).
• Email delivery providers (for service emails).
• Razorpay (for plan payments).
• Meta (only when a business connects its Facebook Page, as described above).
• Optional providers a business or Knight21 switches on, such as file storage (S3-compatible) or OpenAI for the “Draft with AI” email feature — only the text being drafted is sent, never customer records.

We may disclose data if required by law, a court order or a government authority, or to protect the rights and safety of our users.

6. Where data is stored

Data is stored on servers we control. Some providers listed above may process data outside India; where that happens we rely on the safeguards the law permits.

7. How long we keep data

• Workspace data is kept while the subscription is active. Reaching a plan limit or an expired plan never deletes data; an expired workspace becomes read-only.
• When a workspace is deleted, its data is removed from the live system and from backups as they roll over (within 90 days).
• Records the law requires us to keep (such as invoices and payment records) are kept for the period the law requires. Security access logs are kept for 5 years.

8. Security

Data is sent over HTTPS. Passwords are hashed; integration secrets and tokens are encrypted. Every workspace’s data is kept separate and every request is checked for the right workspace and permission. Knight21 staff access to a business’s data is limited by role, logged before the data is shown, and visible to the business owner. We take regular backups. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

9. Your rights

Subject to the law, you can ask to access, correct, update or erase your personal data, withdraw consent, and nominate someone to exercise your rights. Workspace owners can export their data at any time and request deletion from Settings → Data & privacy.

If you are a customer of a business that uses the Service (for example you filled its lead form), please contact that business first — it controls your data. You can also write to us and we will pass your request to the business and help it respond. See Data deletion.

10. Children

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect children’s data for our own purposes.

11. Changes

We may update this policy. We will change the “Last updated” date and, for significant changes, tell workspace owners by email or in the app.

12. Contact and grievance officer

Grievance Officer, Knight21 Digi Hub Pvt Ltd
State Bank Colony , ramanyapeta,Kakinada, AP, kakinada, Andhra Pradesh, 533003
Email: info@knight21.in · Phone: 8019831475

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.