Privacy policy

Who we are

Kimira is operated by Goodwill Impex Limited, G-1 95/96 Sitapura Industrial Area, Jaipur 302022, Rajasthan, India (“we”, “us”). We are the Data Fiduciary for the personal data processed through Kimira under India's Digital Personal Data Protection Act, 2023. You can reach us at abhimanyu.shah@goodwillimpex.com.

What this covers

This policy covers everyone whose data passes through Kimira: the owners and managers of the businesses that use it, the team members they add, and anyone who writes to Kimira on WhatsApp.

This website itself sets no cookies and runs no analytics or advertising trackers. If you email us, we use your message only to reply to you.

What we hold, and why

Only what task delegation over WhatsApp needs:

• People. Name, WhatsApp number, role in the team, department if the business adds one, and whether and when they agreed to receive Kimira's messages.
• Work. Tasks: what, for whom, when due, whether done, and any reason or remark the person gave.
• Messages. WhatsApp messages to and from Kimira, and whether each was delivered.
• Sign-in and audit. Records of who signed in to the web view, and who changed what.
• How messages were read. For each task message an owner or manager sends, a record of how Kimira read it and whether they then corrected it, used to check and improve how well Kimira understands messages.

We use this data only to hand out, track and report on work for the business that added you. We do not use it for marketing, we never sell it, and we do not use it to train AI models.

Consent

Nobody receives tasks from Kimira until they reply YES to a single invitation, and we record when they did. You can withdraw at any time by replying STOP (or, for example, “बंद करो”). Kimira then stops messaging that number permanently, for every business that uses Kimira. Withdrawing does not affect anything done before you withdrew.

Who else handles it

These providers process data for us, only to run Kimira, under contract:

• Meta Platforms carries the WhatsApp messages, through the WhatsApp Business Platform.
• Amazon Web Services (Amazon Bedrock) reads the task messages owners and managers send to Kimira, using Anthropic's Claude model, to turn them into tasks. If the business's setup uses Anthropic's own API instead, Anthropic does this in the same way. What is sent: that message's text; the names, nicknames, roles and departments of the business's team; and the numbers and first 80 characters of the sender's open tasks (at most 30). What is never sent: phone numbers, and anything team members write back. It is used to read that one message and for no other purpose.
• Amazon Web Services hosts Kimira and stores its data.
• Error monitoring, if enabled, receives technical error reports that contain no message text and no phone numbers.

We do not sell personal data, and we do not share it with anyone for their own purposes.

Where it is stored

Kimira's servers and database are in India, on Amazon Web Services in the Mumbai region (ap-south-1), and that is where your data is stored. The one exception is reading a task message: from Mumbai, the AI model is available only through Amazon Bedrock's global cross-Region inference, so the text sent for reading (listed above) can be processed in Amazon Web Services regions outside India. It is used to read that one message and is not stored there by Kimira. WhatsApp messages are carried by Meta under its own terms.

How long we keep it

• For as long as the business uses Kimira.
• When a business cancels, it can export everything for 90 days. After that, its data is deleted.
• Technical logs of incoming messages are kept for 30 days.
• Records of how Kimira read a message are kept for 90 days.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask us:

• for a summary of the personal data we hold about you and how it is used;
• to correct, complete or update it;
• to erase it;
• to nominate someone to exercise these rights for you if you die or cannot act.

Write to abhimanyu.shah@goodwillimpex.com. Erasure removes your name, number and messages; task records the business still needs stay, attributed to “Removed person”. You can also ask the business that added you, which can remove you from its team at any time.

Security

Each business's data is separated from every other's in the database itself, not only in the application. There are no passwords: the web view opens with a one-time link sent on WhatsApp, valid for 10 minutes. Sign-in links and sessions are stored only as one-way hashes. Secrets are kept out of the code, and access is logged. If a breach affects your data, we will tell the affected businesses and the Data Protection Board of India as the law requires.

Children

Kimira is a tool for work. It is not meant for anyone under 18, and we do not knowingly process children's data.

Questions and complaints

Write to us first at abhimanyu.shah@goodwillimpex.com, or by post to Goodwill Impex Limited, G-1 95/96 Sitapura Industrial Area, Jaipur 302022, Rajasthan, India. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Changes

If we change this policy, we will update the date at the top of this page, and tell the businesses using Kimira about any change that affects them.