Privacy Policy
This policy explains how Khyontek AI Private Limited (“we”, “us”), as the Data Fiduciary under Indian law, collects, uses, shares and protects your personal data when you use the Krevoh mobile app and krevoh.com. We process personal data strictly under the Digital Personal Data Protection Act, 2023 (DPDP Act), the DPDP Rules, 2025, and the Information Technology Act, 2000. At sign-up we also present an itemised consent notice that summarises these processing activities.
1. Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account | Mobile number, name, age confirmation or date of birth, profile photo, gender (optional) | Provided by you |
| Location | Approximate or precise location (used for nearby discovery & in-venue verification), only if permitted | Your device sensor / GPS |
| Activity | Venues viewed, searches, saved places, offers redeemed, Vibe Coins earned and spent, games played, events booked, ads clicked | Your interaction with Krevoh |
| Content | Reviews, vibe ratings, tags, photos, videos, support communications | Provided by you |
| Transactions | Ticket, booking and order details, delivery address, payment status. Card and UPI details are handled securely by our licensed payment partner and never stored by us | You and payment gateway |
| Device & Technical | Device model, OS version, app version, device identifiers, IP address, crash telemetry, cookies on krevoh.com | Your device |
| Merchants & Sellers | Business entity name, representative contact, GSTIN, PAN, FSSAI or trade licence, verified bank details for payouts | Merchant partner |
Note: We do not collect sensitive personal data such as biometric data, health records, caste, or religious information.
2. Why We Process Your Data
- To create and secure your account (OTP login, identity verification, anti-fraud and anti-abuse safeguards).
- To display accurate nearby cafés, restaurants, rooftop venues, offers and local events.
- To operate the Vibe Coins reward ledger, mini-games, and in-venue discount redemptions, including anti-cheat and daily caps.
- To process event ticket bookings, occasion reservations, marketplace deliveries and verified refunds.
- To personalise recommendations and local discoveries based on your taste profile and activity.
- To provide verified venue partners and advertisers with aggregated, de-identified footfall analytics and ad delivery reports.
- To troubleshoot technical glitches, prevent cyber threats, and improve app stability.
- To transmit mandatory transactional alerts (booking receipts, OTPs) and, only with consent, promotional recommendations.
- To comply with statutory tax, audit, corporate, and law-enforcement obligations under Indian law.
3. Legal Basis and Consent
- We process data based on your affirmative, granular consent provided during onboarding and feature-specific prompts.
- We also process data for statutory legitimate uses permitted under Section 7 of the DPDP Act, including legal compliance, preventing fraud, and fulfilling transactions voluntarily requested by you (such as booking a venue).
- You may withdraw consent at any time as easily as you gave it via Your Data Rights. Withdrawal does not invalidate processing prior to withdrawal, but features requiring that data will cease functioning.
4. Profiling and Personalisation
We use your app activity to personalise what we recommend: the vibe checks you answer, the places you save, review and open, what you search for and how long you look at a place. While you are signed in, we link your searches and the places you open to your account and keep them for up to 12 months, then they are deleted automatically. We do not use profiling to make decisions with legal or similarly significant effects on you. You can switch personalised recommendations off at any time in Settings, or by emailing support@krevoh.com from the address registered on your account: we then stop linking new searches and views to you and delete what we have kept, and you will receive generalized results. Anonymous statistics that cannot be traced to you, such as how many people opened a place, are not affected.
How we use the photos you add to reviews. Photos you add to a review are shown on Krevoh and are also used to improve and develop the application (for example how places are searched, recommended and shown), including through automated analysis of the images. We check each photo automatically; photos that show people are not shown in the public gallery and are not used for this purpose, and clear photos of the place with nobody in them earn Vibes. Location information is removed from photos when we process them. You can ask us to stop using your photos for improvement at any time by emailing support@krevoh.com; we will stop from then on, Vibes already earned stay in your account, and improvements already made from the photos cannot be undone.
5. Data Sharing and Third Parties
We never sell your personal data. We share data only in the following controlled scenarios:
- Venues, Organisers & Sellers: Only what is strictly necessary to honour a confirmed booking or order (e.g. your first name, booking reference, or delivery address).
- Merchants & Advertisers: Aggregated, anonymised footfall trends only. Advertisers never receive your phone number, name, or identity.
- Data Processors: Cloud infrastructure (Google Cloud India), SMS/OTP gateways, and licensed payment gateways under strict Data Processing Agreements enforcing DPDP security standards.
- Law Enforcement & Authorities: When required by binding court orders, warrants, or lawful governmental directives.
6. Storage, Transfers and Security
- All primary production databases and user files are hosted on enterprise Google Cloud servers located physically in India.
- Data is encrypted in transit using TLS 1.3 and encrypted at rest using AES-256.
- Access controls, audit trails, and strict role-based authorization are maintained. Logs are retained for a minimum of one year.
- In the event of a confirmed personal data breach affecting your information, we will notify you without undue delay and report the incident to the Data Protection Board of India (DPBI) as prescribed by law.
7. Retention and Deletion
- Personal data is retained while your user account remains active.
- Upon account deletion, personal identifiers are permanently scrubbed within 60 days, except records strictly required for tax, accounting, and fraud prevention under Indian statutory mandates (up to 8 years).
- Dormancy Policy: If an account is inactive for 3 consecutive years, we may delete the account after providing at least 48 hours notice to the registered mobile number.
8. Cookies and Telemetry
krevoh.com uses essential session cookies for authentication and CSRF security, and optional privacy-friendly analytics cookies to analyze site traffic. You can configure non-essential cookies at any time via our Cookie Preferences banner.
9. Age Gate
Krevoh is designed strictly for adults aged 18 and older. We verify age during registration. We do not knowingly collect or process data from minors. If we discover an account belongs to a minor, we immediately terminate it and purge associated data.
10. Your Data Rights
Under the DPDP Act, you have rights to access summaries, correct inaccurate data, erase data, withdraw consent, and nominate a representative. Read detailed instructions on exercising these rights on our Your Data Rights page.
11. Language Accessibility
This policy is published in English. Users may request a translated copy in Assamese, Bengali, Bodo, Hindi, or any other language specified in the Eighth Schedule to the Constitution of India by writing to support@krevoh.com.
12. Contact & Grievances
For privacy inquiries or grievances, contact our Data Protection desk at support@krevoh.com or see our Grievance Redressal page.