Privacy Policy

This Privacy Policy relates to Karyalo (“Karyalo”, “we”, “us”, or “our”), a contract management platform for law firms, in-house legal teams and business teams, covering drafting, review, sharing, electronic signature, and the obligations that follow.

Karyalo’s operating legal entity is being established in India. Once it is registered, we will update this policy with that company’s name and registered office, and this policy will take effect before we begin collecting personal data or processing payments through the product.

For the personal data described in this policy, Karyalo acts as the data controller for our website and our own business records, and as a data processor for the content our customers put into the product (see “Customer content”).

This policy applies to our public website, to the process of requesting access and onboarding, and to your use of the Karyalo product. It explains what we collect, why, how long we keep it, who we share it with, and the rights you have.

It does not change the terms of any separate agreement between your organisation and Karyalo. Where a signed order form or Data Processing Agreement (DPA) applies, that agreement governs the handling of your organisation’s content.

We collect the following categories of information:

• Information you give us - your name, work email, organisation name, role, and anything you include when you book a demo, request access, or contact us.
• Account and workspace data - the accounts, roles, channels, and settings created when your organisation is provisioned on the product.
• Customer content - the matters, tasks, documents, contracts, messages, and files you and your organisation put into the product. We process this on your instructions to provide the service.
• Usage and device data - log data such as IP address, browser and device type, pages viewed, and timestamps, used to run, secure, and improve the service.
• Communications - records of your correspondence with us for support, sales, and account management.

We use personal data to:

• Provide, operate, maintain, and secure the website and the product.
• Set up and onboard your organisation, and administer accounts, roles, and seats.
• Respond to enquiries, provide support, and communicate about your account and service changes.
• Prepare and process billing and invoices, and keep required financial records.
• Detect, prevent, and investigate security incidents, fraud, and misuse.
• Comply with legal obligations and enforce our agreements.

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on: performance of a contract (to provide the service you request); our legitimate interests (to secure, operate, and improve the service, and for business administration); your consent (where we ask for it, for example certain communications); and compliance with a legal obligation.

Where India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies, we process personal data for the lawful purposes described in this policy, including on the basis of your consent or as otherwise permitted for legitimate uses under that Act.

Your organisation’s content in the product belongs to your organisation. Karyalo processes that content only to provide and support the service, on your documented instructions, and does not use it for our own purposes.

Your organisation is responsible, as controller, for the personal data it puts into the product and for having a lawful basis to do so. Requests from individuals whose data appears inside an organisation’s workspace should be directed to that organisation.

Karyalo’s AI features help you draft and review documents using your organisation’s own material as the source: your drafting workflows, the reference documents you attach to them, your clause library, and your playbook positions.

Language-model processing runs on an enterprise AI service under a commercial agreement. Your content is not used to train the provider’s models and is not shared between customers, and it is never sent to consumer AI services.

To be precise about what leaves the product: when you run a draft, insert a section, generate an outline, use the chat panel, extract obligations, or run a playbook review, the relevant contract text is sent to that provider for the purpose of answering that request. Nothing is sent when you are only reading, editing, filing, or sharing a contract. An organisation that would rather not use these features can have them disabled.

Playbook review findings quote the clause they relate to, so a lawyer can verify each one against the document. Drafting, insertion, outline and chat output are drafting aids and must be reviewed by a lawyer before use.

Our website offers a free contract review tool that anyone can use without an account. The document you paste or upload there is held in memory only for as long as the review takes. It is sent to an enterprise AI service under a commercial agreement so that the review can be produced, it is not used to train any model, and it is not shared with anyone else.

Nothing about the document is kept. We do not write the text, an extract of it, or the findings to storage of any kind, and we do not retain a copy once the review has been returned to your browser. Our logs record that a review ran and how long it took, never what was in it.

The tool asks for no email address and creates no account. To keep it available and to limit automated abuse, we count reviews against an identifier your browser generates and stores locally, together with your IP address, and we use a bot-protection check provided by a third party on that page only.

Karyalo runs as a single hosted service. Customer content, including documents and application data, is stored and processed in Indian data centres.

Each customer has its own data encryption key. Files, including uploaded contract versions and executed signed PDFs, are encrypted with that key using AES-256 before they are written to storage, and the key itself is held encrypted by a managed key service. Keys are generated and managed by us; we do not currently offer customer-held or customer-revocable keys.

Content held in the database, such as contract text, comments and client records, is protected by the platform’s at-rest encryption and by our access controls rather than by a second layer of application encryption. Karyalo is therefore not a zero-knowledge service: our systems decrypt documents in order to serve downloads, generate PDFs, and run the AI features you ask for.

A dedicated single-tenant instance or an on-premise deployment is available to discuss for enterprise engagements. Neither is offered as a standard deployment option today, and this policy describes the hosted service.

We do not sell personal data. We share it only with service providers (subprocessors) who help us run the service, each under contractual confidentiality and data-protection obligations.

The categories of subprocessor that may handle customer content are: cloud infrastructure, for hosting, encrypted file storage and key management; a database and authentication service; an enterprise AI service, for the features described above; and a transactional email service, for invitations, review and signature links, reminders, and executed contracts sent as attachments. We name each provider in our contractual documentation and in a current list available on request.

We may also disclose information where required by law, to protect our rights or safety, or in connection with a corporate transaction, subject to appropriate safeguards.

Customer content is stored in India. If personal data is transferred across borders, we put appropriate safeguards in place, such as EU Standard Contractual Clauses or equivalent mechanisms.

Our website uses a minimal set of cookies needed to function, and privacy-friendly analytics to understand aggregate usage. Our analytics is cookieless and does not build advertising profiles, and it runs on this website only: the product interface carries no third-party analytics at all. You can control cookies through your browser settings.

We keep personal data only for as long as needed for the purposes described here, to provide the service to your organisation, and to meet legal, accounting, or reporting requirements. When your organisation’s subscription ends, we will assist you in retrieving your content for a limited period and then delete it in line with our agreement and applicable law. Deleting a contract or a workspace removes the associated records and the encrypted files behind them from storage.

We apply administrative and technical safeguards appropriate to the risk. These include encryption in transit; per-customer AES-256 encryption of stored files under a managed key service; role-based access control enforced both at the request boundary and again in the underlying logic; workspace scoping so that no request can reach another customer’s data; documents served only to an authenticated session, with no public links to customer files; an audit trail that the application only ever appends to; and application logs written to carry identifiers rather than document or message content. The product interface loads no third-party analytics or advertising scripts.

Access is scoped to a workspace: a workspace belongs to the organisation that created it, carries a seat limit, and every additional member joins by invitation from an administrator inside that organisation. Reviewers and signers outside the organisation reach a single contract through a link you create, and hold no account with us.

We do not currently offer multi-factor authentication or SSO / SAML sign-in, and we do not hold SOC 2 or ISO 27001 certification. A small number of our personnel hold administrative access to production systems in order to operate and support the service; such access is limited to those who need it. We describe our security posture in more detail, including its limits, on our Security page.

Subject to applicable law, you may have the right to access, correct, update, or delete your personal data, to object to or restrict certain processing, to data portability, and to withdraw consent where processing is based on consent.

Under the GDPR you may also lodge a complaint with your local supervisory authority. Under India’s DPDP Act you may exercise your rights and raise grievances with us. To make a request, email us at [email protected]; we will respond within the timeframes required by applicable law.

The website and the product are intended for professional use by legal and business teams and are not directed to children. We do not knowingly collect personal data from children.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the website or product after an update means you accept the revised policy.

If you have questions about this policy or how we handle your data, contact Karyalo at [email protected].