Privacy Policy

Krivollo is operated by [Krivollo legal entity name] (ABN [ABN to be confirmed]) (“Krivollo”, “we”, “us”). Krivollo is a multi-tenant business platform: each customer organisation has its own isolated workspace, which its administrators control.

This policy covers personal information about:

• Visitors to our website and the people who contact us;
• Users — people who sign in to a Krivollo workspace (customers’ staff, contractors and invited guests);
• End contacts — people whose information our customers put into Krivollo (for example their leads, clients, call participants, meeting attendees, signers and referral partners).

For website visitors and users’ account details, we decide how the information is used (we are the “controller”). For end-contact information and other content a customer stores in its workspace (“Customer Data”), the customer decides, and we process it on the customer’s behalf under our Terms of Service (we are the “processor” or service provider). If you are an end contact, please direct requests about your information to the business you dealt with — we will help them respond.

Sensitive information. Krivollo is not designed to hold sensitive information (such as health information, racial or ethnic origin, or criminal records) or government identifiers (such as tax file numbers or passport numbers), and our customers agree not to store them unless it is lawful and necessary, and the person has consented. See our Data Handling Policy.

Children. Krivollo is a business service and is not directed at anyone under 18. We do not knowingly collect children’s information.

We use personal information only to:

• provide, operate and support Krivollo, including the features a customer turns on;
• authenticate users, keep accounts and workspaces secure, and prevent misuse and fraud;
• process payments and manage subscriptions;
• send service messages — sign-in links, notifications you have set up, security and billing notices;
• fix problems and improve the reliability and usability of Krivollo, using usage and error information;
• respond to enquiries and requests; and
• comply with the law and enforce our terms.

We process Customer Data only to provide the service to the customer and as the customer instructs. We do not combine Customer Data across workspaces, we do not sell it, and we do not use it for our own marketing.

Marketing. We do not currently send marketing email. If we do in future, we will only do so with your consent or as the Spam Act 2003 (Cth) otherwise permits, and every message will include a working unsubscribe.

Legal bases (EU/UK). Where the GDPR applies, we rely on performance of our contract with you or your organisation, our legitimate interests in running and securing a business service (balanced against your rights), compliance with legal obligations, and — where we ask for it — your consent.

Krivollo includes AI features — drafting messages, summarising and transcribing calls, classifying leads, answering questions about a workspace, and the assistant on our website. To provide them, the relevant text, audio or data is sent to an AI provider listed on our Sub-processors page, which processes it to return a result.

• No training. We do not use Customer Data to train AI models. We use providers whose business terms do not permit them to train on it, and switch off any model-improvement option a provider offers.
• Customer control. Workspace administrators decide which AI features are on. Some AI actions (such as sending a drafted message) require a person to approve them unless the customer chooses otherwise.
• Location. AI processing currently takes place with Anthropic in the United States, unless a workspace uses an Australian data-residency option or its own AI provider key.
• Accuracy. AI output can be wrong. Krivollo shows people what the AI produced so they can check it before relying on it.

Our website assistant is an AI. Please do not type sensitive personal information into it. Its conversations are processed to answer you and are not stored in our database.

Customers can record and transcribe calls and video meetings. Recording is controlled by the customer, who is responsible for giving the notice and obtaining the consent that the law requires where the call or meeting takes place. Krivollo supports this with configurable recording-disclosure scripts, consent capture and an on-screen recording indicator. See our Consent Policy.

If you were recorded by a business using Krivollo and want to access the recording or have it deleted, contact that business. If you cannot reach them, contact us and we will pass your request on.

If you connect a Google account to Krivollo:

• Google sign-in gives us your name, email address and profile picture so you can sign in.
• Google Sheets uses the drive.file scope, which grants access only to the specific spreadsheet you select in Google’s own file picker — never to your wider Drive, Gmail or other files. We read the rows of that sheet to import them as lead records into your workspace, on the schedule you set.
• Google Calendar, where a workspace connects it, is used to place appointments booked in Krivollo on that calendar and to keep moves and cancellations in step.

We use Google user data only to provide the feature you turned on. We do not use it for advertising, we do not sell it, and we do not allow people to read it except with your consent, where necessary for security or to comply with the law, or in aggregated form for operations. The access tokens we hold for these features are encrypted and scoped to your workspace. You can disconnect at any time in Krivollo or at myaccount.google.com/permissions.

Krivollo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We disclose personal information only:

• to service providers who process it on our behalf to run Krivollo (hosting, database, email, payments, AI, transcription and the like), under contracts that limit their use to providing their service and require them to protect it — the current list is on our Sub-processors page;
• to integrations a customer connects (for example their CRM, phone system or calendar) — data flows to those services because, and only as far as, the customer chose to connect them;
• within a workspace, to the people that workspace’s administrators have given access;
• where required or authorised by law, or to protect the rights, safety or property of anyone; and
• to a buyer or successor if our business is sold or restructured, subject to this policy.

We do not sell or rent personal information, and we do not share it for advertising.

Krivollo’s application servers and primary database are located in Australia (Sydney). Some of our service providers store or process information outside Australia — principally in the United States, and for some providers in the European Union or other countries where they or their data centres operate. The location of each provider is listed on our Sub-processors page.

Before disclosing information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including contractual protections. For transfers of EU or UK personal data we rely on adequacy decisions or the European Commission’s standard contractual clauses (and the UK addendum). Enterprise customers can ask about Australian data-residency options for AI and transcription.

We keep account information while your account is active. Customer Data is kept for as long as the customer keeps it in its workspace — customers can delete records, and can set a retention period for recordings. When a workspace is closed, we delete or de-identify its Customer Data within 90 days, except where the law requires us to keep something (for example tax and billing records, generally seven years) and except for backups, which expire on their normal cycle. Details are in our Data Handling Policy.

Measures we use include:

• encryption in transit (HTTPS/TLS) for all traffic, and encryption at rest provided by our hosting and database providers;
• additional application-level encryption (AES-256-GCM) for integration credentials and secrets;
• strict separation between workspaces, enforced in code so one workspace’s data cannot be queried from another;
• passwordless sign-in, single sign-on support, automatic sign-out after inactivity, and role-based access within each workspace, including masking of fields a customer marks as sensitive;
• API keys stored only as one-way hashes; and
• audit logs of significant actions, including any action taken by an administrator while acting on another user’s behalf.

No system is perfectly secure. If a data breach is likely to result in serious harm, we will notify affected customers and individuals, and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

You can ask to access the personal information we hold about you and to correct it. Depending on where you live, you may also have rights to delete it, to receive a copy in a portable format, to restrict or object to certain processing, and to withdraw consent.

• Users can update most account details in Krivollo, or ask their workspace administrator.
• For information a business holds about you in its workspace, contact that business first; we will assist them.
• For anything else, email privacy@krivollo.com.

We will respond within 30 days. We may need to verify your identity, and we may decline a request where the law allows (for example where giving access would unreasonably affect someone else’s privacy) — if so, we will tell you why. We do not charge for making a request.

You can deal with us anonymously or under a pseudonym where that is practical (for example when asking a general question), but we cannot provide an account that way.

We use only cookies and browser storage needed to sign you in, keep Krivollo secure and remember your display preferences. We do not use analytics, advertising or cross-site tracking cookies. See our Cookie Policy.

If you have a concern about how we have handled your personal information, please email privacy@krivollo.com with the details. We will acknowledge it within 5 business days and aim to resolve it within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. If you are in the EU or UK, you can also contact your local data protection authority.

We will update this policy when our practices change. The effective date at the top shows when it last changed. If a change is material, we will tell workspace administrators by email or in Krivollo before it takes effect.

Privacy questions and requests: privacy@krivollo.com, or write to [Krivollo legal entity name], [Registered business address, Victoria, Australia].