Privacy Policy

1. Data we collect

Account and profile information

Authorised administrators create team accounts. We collect the team member’s name, Indian mobile number and assigned role. A user may optionally provide an email address, date of birth and postal address through the Profile page.

Authentication and security information

To provide SMS OTP login and protect accounts, we process the registered mobile number, hashed one-time login codes, OTP request and expiry information, failed login attempts, IP address, session information and browser user-agent information. If “Remember this device” is selected, we store a randomly generated, hashed remembered-login token and its expiry and last-used time. We do not store the plain remembered-login validator.

Work and business information

Depending on a user’s role, the app stores tasks and descriptions, status changes, priorities, assignments, project details, reports and activity records. Authorised users may also enter business and prospect information such as contact name, mobile number, business name, location, industry, source, services required, remarks, call outcomes and follow-up schedules.

Notifications

If a user enables device notifications, we store the browser-generated push endpoint and encryption keys needed to send work reminders. Notification permission can be declined or withdrawn in the device or browser settings.

Information we do not access from the device

KT Workspace does not read the device’s contacts, SMS inbox, call history, precise location, photos, files, camera, microphone, advertising ID, IMEI or similar persistent device identifiers. Tapping a Call or WhatsApp button asks the device to open the selected external calling or messaging app; KT Workspace does not read the resulting call or message.

2. How we use data

We use the information described above to:

• authenticate authorised team members and remember approved devices;
• provide role-based access to tasks, leads, projects, reports and profiles;
• coordinate work, record activity and schedule business follow-ups;
• send requested OTP messages and enabled work notifications;
• prevent abuse, investigate errors and maintain the security and reliability of the app;
• comply with applicable legal obligations and protect our rights and users.

We do not use KT Workspace information for third-party advertising or behavioural profiling.

3. When data is shared

Information is visible only to authorised Khurana Technologies team members according to their assigned roles and the app’s work-management functions. We may disclose limited information to the following service providers solely to operate the app:

• 2Factor.in: the registered mobile number and generated OTP are transmitted to deliver the requested login SMS.
• Hosting and database providers: application and database information is processed on infrastructure used to host and secure KT Workspace.
• Browser and operating-system push services: when notifications are enabled, the push endpoint and encrypted notification delivery information are processed to deliver notifications.
• User-selected calling or messaging apps: a mobile number is handed to the external app only when the user taps Call or WhatsApp.

We may also disclose information when required by applicable law, a valid legal process, or to protect users, Khurana Technologies or the public. We do not sell or rent personal data.

4. Data security

We use reasonable technical and organisational safeguards, including HTTPS encryption in transit, role-based access controls, secure session cookies, CSRF protection, login rate limiting, hashed OTPs and hashed remembered-login tokens. Access is limited to authorised personnel who require it for their work. No electronic system is completely secure, but we review and improve safeguards appropriate to the nature of the data.

5. Data retention

Profile and account information is retained while the account is active and as needed to administer the employment or working relationship. Tasks, leads, projects and related activity may be retained as internal business records for as long as reasonably necessary for operational, security, dispute-resolution or legal purposes.

Expired authentication records and revoked remembered-login tokens are retained only as long as reasonably needed for security and audit purposes. Push subscription information is removed when a device is unsubscribed, an account is deleted, or it is no longer needed. Where deletion is requested, we delete or irreversibly anonymise associated personal data unless limited retention is required by law, security, fraud prevention or the protection of legal rights. Residual copies may remain temporarily in restricted backups until those backups are rotated.

6. Your choices and account deletion

Users can review and update available personal details from the Profile page. Notification permission can be changed in the device or browser settings, and logging out revokes the remembered login for the current device.

7. Children’s privacy

KT Workspace is an internal business application intended for authorised workers and is not directed to children. We do not knowingly create accounts for or collect personal data from children.

8. Changes to this policy

We may update this Privacy Policy when the app, our data practices or applicable requirements change. The effective date at the top will be revised, and material changes will be communicated through an appropriate in-app or organisational notice.

9. Developer and privacy contact