Privacy Policy

This Privacy Policy explains how Kramaly (a product of VJPSUTRA PRIVATE LIMITED, "we", "us", or "our") collects, uses, discloses, and protects information in connection with our enterprise platform, mobile applications (iOS and Android), and website (https://kramaly.com). Kramaly is an enterprise workforce management and ERP platform used by businesses and their employees. User accounts are created and managed by employer organizations. Public registration is not allowed. By using Kramaly services, you agree to the collection and use of information in accordance with this policy.

We collect several types of information from and about users of our platform: Personal Information: • Name • Work Email Address • Phone Number • Employee ID • Organization / Tenant information • Profile Photo Operational Data: • Attendance punch records • Work logs • Approval workflows • Expense submissions • ERP transaction metadata • Task and project assignments Device & Technical Information: • Device type and model • Operating system version • IP address • App version • Usage logs and analytics • Crash reports Location Data: The application may collect precise GPS location during attendance punch events for geofencing verification and location-based attendance tracking. Location data is collected only when you actively use the attendance punch feature. Camera & Photo Data: The app may use the device camera to capture photo evidence for attendance verification and face validation. Photos are processed for verification purposes and stored as part of attendance records. Biometric Information: The system may use face verification using captured images to validate employee identity during attendance punches. Raw biometric templates are not stored. Face verification is performed by comparing captured images with your registered profile photo. AI Assistant Data: When you interact with AI-powered assistants within the platform, we collect: • Chat messages • User prompts • Interaction logs • Context from your queries These interactions may be processed by third-party AI model providers to generate responses.

We use the collected information for the following purposes: Platform Operations: • Provide and maintain the Kramaly platform • Process attendance records and workforce management • Enable approval workflows and ERP operations • Manage user accounts and authentication • Facilitate communication within organizations Attendance & Verification: • Verify employee identity during attendance punches • Validate location-based attendance requirements • Generate attendance reports and analytics • Prevent fraudulent attendance submissions AI-Powered Assistance: • Provide conversational assistance for HR policies • Answer attendance and workflow inquiries • Assist with operational tasks and navigation • Offer guidance on platform features Service Improvement: • Analyze usage patterns to improve features • Monitor platform performance and reliability • Identify and fix technical issues • Develop new features and enhancements Compliance & Security: • Maintain audit logs for compliance • Detect and prevent security threats • Comply with legal obligations • Enforce terms of service

The Kramaly mobile application may request the following device permissions: Camera: Used to capture photos for attendance verification and face validation. Camera access is requested only when you use the attendance punch feature. Location (Precise): Used to verify your location during attendance punches for geofencing compliance. Location access is requested when you use location-based attendance features. Notifications: Used to send you alerts about approvals, attendance reminders, and important platform updates. Storage (Optional): Used to upload documents, receipts, or other files as part of expense submissions or workflow attachments. Microphone (Optional): May be used for audio-to-text conversion for voice commands or interactions with AI assistants. No audio recordings are stored. You can manage these permissions through your device settings. Denying certain permissions may limit functionality of specific features.

Kramaly may use AI-powered assistants to help users with: • HR policy explanations • Attendance inquiries • Workflow guidance • Operational assistance Third-Party AI Providers: AI responses are generated using third-party AI model providers. When you interact with AI assistants, your prompts and conversation context may be sent to these providers for processing. Data Handling by AI Providers: Third-party AI providers process your queries to generate responses but do not permanently store enterprise data. AI providers are used strictly for conversational assistance and are contractually bound to data protection requirements. AI Response Accuracy: AI-generated responses are informational and may not always be accurate. Always verify critical information with your organization's policies and administrators.

We may share your information with the following parties: Your Employer Organization: All data collected through the platform is accessible to your employer organization (the tenant administrator). Your employer controls access to employee data within their tenant environment. Cloud Hosting Providers: We use secure cloud infrastructure providers to host and operate the Kramaly platform. These providers have access to data only as necessary to provide hosting services. AI Model Providers: When you use AI assistants, your prompts and conversation context may be shared with third-party AI model providers for generating responses. Legal Requirements: We may disclose information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others. No Advertising or Sale: We do not use advertising SDKs. We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We retain your information for as long as necessary to: • Maintain employment records • Fulfill operational requirements • Comply with legal and regulatory obligations • Support audit and compliance purposes • Resolve disputes and enforce agreements Organizational Control: Your employer organization (tenant administrator) controls data retention policies for their tenant environment. Organizations may request data export or deletion according to their internal policies. Account Deletion: When your employment ends or your account is deactivated, your personal data may be retained for compliance and audit purposes as required by applicable laws and your organization's policies. Attendance Records: Attendance punch records, including photos and location data, are retained as part of employment records and may be subject to legal retention requirements.

We implement industry-standard security measures to protect your information: Technical Measures: • Encrypted data transmission (TLS/SSL) • Secure cloud infrastructure • Regular security audits • Intrusion detection systems Organizational Measures: • Tenant isolation (multi-tenant architecture) • Role-based access control (RBAC) • Audit logs for all data access • Employee security training Limitations: While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Depending on your location and applicable laws, you may have certain rights regarding your personal information: Access & Correction: You may request access to your personal information and request corrections through your organization's administrators or the platform's profile settings. Data Portability: Organizations (tenant administrators) may request data export in standard formats. Deletion: Organizations may request deletion of employee data or tenant data removal. Individual employees should contact their organization's administrators for data deletion requests. Objection & Restriction: You may object to certain processing activities or request restriction of processing, subject to legal and contractual obligations. To Exercise Your Rights: Contact your organization's administrator or email us at support@kramaly.com with your request.

Kramaly is an enterprise platform intended for use by employees of organizations. The platform is not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without proper authorization, we will take steps to delete such information.

Kramaly operates in India and may use cloud infrastructure providers located in various jurisdictions. By using our services, you acknowledge that your information may be transferred to, stored, and processed in countries other than your country of residence. We ensure that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable laws.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Notification of Changes: We will notify you of material changes by posting the updated policy on our website and mobile applications with a revised "Last Updated" date. Continued use of Kramaly services after changes are posted constitutes acceptance of the updated policy. Review Regularly: We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: Email: support@kramaly.com Support Email: contact@kramaly.com Company Information: VJPSUTRA PRIVATE LIMITED Greater Noida West, Uttar Pradesh, India Website: https://kramaly.com Company Website: https://vjpsutra.com For data protection inquiries, you may also contact your organization's administrator or data protection officer.