Privacy policy

1. Who we are

Kippo Technologies is operated by Kippo, which is the "Data Fiduciary" for the personal data described in this policy.

2. Data we collect

Information you give us

• Contact details: name, phone number, email address and any details you share when you message us.
• Account details: the information in your client area account, including your password (stored in encrypted form).
• Billing details: billing address, company name and GSTIN (if provided).
• Project material: the text, images, logos and other content you send us for a design project.
• Access details: logins you share with us so we can work on your website, such as hosting, domain or content management system logins.
• Support communications: messages, tickets and any information you share with us.

Information collected automatically

• IP address, browser type, device information and pages visited on our website and client area.
• Login times and account activity, for security and fraud prevention.
• Cookies, as described in section 9.

Payment information

Payments are processed by third-party payment gateways. We receive confirmation of payment and limited details such as the transaction ID. We do not store your full card, UPI or net-banking credentials.

3. Data on websites we design for you

A website we design for you may collect personal data from your own visitors and customers, for example through contact forms or orders. For that data, you decide what is collected and why, and you are responsible for complying with applicable data protection law. We only access it where needed to design, test or support your website at your request, or where required by law.

4. Why we use your data

We process your personal data on the basis of your consent or for legitimate uses permitted by the DPDP Act, to:

• reply to your enquiries and prepare quotes;
• design, launch and maintain your website;
• create and manage your account;
• process orders and payments, and issue invoices, including GST invoices;
• provide customer support;
• send service messages such as invoices, project updates and security alerts;
• detect and prevent fraud, abuse and security incidents;
• comply with legal, tax and accounting obligations and lawful requests from authorities.

We will only send you promotional messages if you have agreed to receive them. You can unsubscribe at any time.

5. Who we share data with

We do not sell your personal data. We share it only as needed with:

• Data-centre and infrastructure providers: who host the servers our services run on.
• Payment gateways: to process your payments.
• Service providers: messaging, email delivery, billing software and security providers who process data on our behalf under confidentiality obligations. If you contact us on WhatsApp, your messages are also handled by WhatsApp under its own privacy policy.
• Government and law enforcement authorities: where required by law or a valid legal order, including directions issued by CERT-In.

6. Transfers outside India

Some of our infrastructure and service providers are located outside India. Your data may be transferred to and processed in other countries, in accordance with the DPDP Act and any restrictions notified by the Government of India.

7. How long we keep data

We keep your personal data only as long as needed for the purposes above. Account data is kept while your account is active. Project material and access details are kept while we work on or maintain your website, and you can ask us to delete them once the work is finished. Invoices and billing records are kept for the period required under tax and accounting laws (generally at least 8 years), and logs are kept as required under applicable CERT-In directions. After that, data is deleted or anonymised.

8. How we protect data

We use reasonable security practices and procedures, as required by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These include encrypted connections (HTTPS), encrypted password storage, firewalls and access controls. No system is completely secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach as required by law.

9. Cookies

We use essential cookies to keep you logged in and to secure the client area. We may also use analytics cookies to understand how our website is used. You can control cookies in your browser settings; blocking essential cookies may stop the client area from working.

10. Your rights

Under the DPDP Act, you have the right to:

• get a summary of the personal data we process about you and how we process it;
• ask us to correct, complete or update your personal data;
• ask us to erase your personal data, unless we must keep it by law;
• withdraw consent at any time (this will not affect processing already done);
• nominate another person to exercise your rights in case of death or incapacity;
• have your grievances addressed by us, and then by the Data Protection Board of India.

To exercise these rights, email us at …. Withdrawing consent or erasing data needed to provide a service may mean we can no longer provide that service.

11. Children

Our services are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "last updated" date and notify you of significant changes by email or in the client area.

13. Questions and complaints

If you have any questions or complaints about how we handle your personal data, email us at … or raise a ticket in the client area. We will acknowledge your complaint within 48 hours and aim to resolve it within one month. See also our Terms of service.