Privacy Policy

1. Introduction

Almure Pressery Private Limited (CIN U10509UP2025PTC222727), which operates KiteOS, is the “Data Fiduciary” for personal data collected via the Service. This Privacy Policy explains what data we collect, why, how we protect it, and your rights under the Digital Personal Data Protection Act 2023 (“DPDP Act”) and related regulations.

2. Personal Data We Collect and Why

Account data

Name, email, and organization details — for account creation and management.

Payment data

Processed by Razorpay; we do not store card details ourselves; we retain transaction records for tax and audit purposes.

Uploaded Content

Videos, project data, and comments — for providing the collaboration Service.

Usage data

Logs, analytics, and device information — for service reliability, security, and product improvement.

Communications

Support tickets and emails — for support delivery and quality assurance.

3. Legal Basis for Processing

We process personal data primarily on the basis of your consent, obtained through account signup and specific in-product actions. Certain limited processing may occur under the “certain legitimate uses” grounds specified in Section 7 of the DPDP Act — for example, as required by law, pursuant to a court order, or for a medical emergency, the last of which is unlikely to apply to KiteOS.

4. Consent

Consent is obtained through affirmative action — a checkbox at signup, or an in-product opt-in. You may withdraw consent at any time by contacting support@zfood.co.in. Withdrawing consent may limit or terminate your ability to use the Service.

5. Purpose Limitation

Personal data is used only for the purposes stated in Section 2. Any new purpose requires a fresh notice and, where applicable, fresh consent.

6. Sharing and Disclosure

We share personal data with:

• Razorpay Software Private Limited (payment processing) — an Indian entity;
• Cloudflare, Inc. (file storage and content delivery) — outside India;
• Resend and other transactional email providers — outside India;
• Google LLC — only if you connect Google Calendar — outside India; and
• Law enforcement authorities, only pursuant to a valid legal order.

We do not sell personal data to any third party.

7. Google User Data

KiteOS integrates with Google services (Sign-In, Calendar, Meet, and optionally Drive) at your explicit request via OAuth. When you connect your Google account:

Sign-In

We receive your name, email, and profile picture from Google. This is used to create your KiteOS account.

Calendar

With your permission, we read your calendar events to display them alongside KiteOS shoots and meetings, and we create events on your calendar for shoots and meetings scheduled in KiteOS. We only access calendars you explicitly select.

Meet

With your permission, we create Meet links for meetings scheduled in KiteOS. If enabled and available (requires Google Workspace Business Standard or higher), we may access Meet transcripts after your meetings end to import them as meeting notes.

Drive

With your permission (drive.file scope only), we access folders you explicitly link to KiteOS projects, and files within those folders. We never access other files in your Drive.

Data usage limitations:

• Google user data is used only to provide the features you’ve enabled. We do not use it for advertising, analytics unrelated to the feature, or training machine learning models.
• We do not sell Google user data to any third party.
• We do not transfer Google user data to third parties, except as necessary to operate the Service (e.g., cloud infrastructure providers), and only under strict confidentiality obligations.

You may revoke KiteOS’s access to your Google account at any time via myaccount.google.com/permissions or via Settings > Integrations in KiteOS.

We comply with the Google API Services User Data Policy including the Limited Use requirements.

8. Cross-Border Transfer

Some of our processors are located outside India. We comply with the DPDP Act’s cross-border transfer provisions, including monitoring the Central Government’s list of restricted countries as may be notified from time to time. Where a country is restricted, we will cease transfers to processors in that country and migrate data accordingly.

9. Data Retention

• Account data: for the duration of your subscription, plus a 90-day grace period for reactivation;
• Billing and tax records: 8 years, per Indian tax law (Income Tax Act, GST law);
• Uploaded Content: for the duration of your subscription; deleted 30 days after account termination unless you export it first; and
• Usage logs: 90 days, after which they are aggregated or anonymized.

10. Data Security

We implement reasonable security practices consistent with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 and the DPDP Act, including:

• Encryption of data in transit (TLS 1.3);
• Access controls and role-based permissions;
• Audit logging of platform-admin actions;
• Regular security reviews; and
• Incident response procedures.

11. Your Rights as a Data Principal

Under Chapter III of the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you;
• Correct or complete your personal data;
• Erase your personal data, subject to our legal retention requirements;
• Withdraw consent;
• Nominate another person to exercise your rights in case of your death or incapacity; and
• Grievance redressal (see Section 13).

To exercise any of these rights, email support@zfood.co.in. We will respond within the timelines prescribed by law.

12. Data Breach Notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals without undue delay, in accordance with the DPDP Act and any rules made thereunder.

13. Grievance Redressal

Grievance Officer

[GRIEVANCE OFFICER NAME]

Designation

Grievance Officer, Almure Pressery Private Limited

Email

support@zfood.co.in

Address

C/O Shosing Sahani, Tulsi Ram Prasauli, Parasauli, Budhana, Muzaffarnagar 247775, Uttar Pradesh

We acknowledge grievances within 24 hours and aim to resolve them within 15 days, per the IT Rules 2021. If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India, once operational under the DPDP Act.

14. Children

KiteOS is a business tool intended for professional use. We do not knowingly collect personal data from anyone under 18 years of age. If we become aware that we have collected data from a person under 18, we will delete it promptly.

15. Cookies

See our Cookie Policy for details on the cookies we use and how to control them.

16. Changes to this Policy

We will notify you of material changes to this Policy at least 30 days in advance, by email and via an in-app notification.

17. Contact

Data Fiduciary: Almure Pressery Private Limited
CIN: U10509UP2025PTC222727
Registered Office: C/O Shosing Sahani, Tulsi Ram Prasauli, Parasauli, Budhana, Muzaffarnagar 247775, Uttar Pradesh, India
Grievance Officer: [GRIEVANCE OFFICER NAME]
Email: support@zfood.co.in
Phone: +91 9211471906 (India only)

Version 1.1 · August 15, 2026