Legal
Privacy policy
Karvark Tech Labs LLP · Last updated: 28 October 2026
Who we are
Karvark Tech Labs LLP ("Karvark", "we", "us") is a Limited Liability Partnership incorporated in India (LLPIN ADA-7106), with its registered office at Awfis, Ground Floor, SP 7A, SIDCO Industrial Estate, Guindy Industrial Estate, Chennai, Tamil Nadu 600032, India.
We decide how personal data collected through karvark.com and our own enquiry channels is used, so we are its data fiduciary under India's Digital Personal Data Protection Act, 2023 and its controller under the UK and EU General Data Protection Regulations.
Questions about your data: P. Bhooviarashan, privacy@karvark.com. A person reads every message.
What we collect
When you visit this website. We count visits with Umami, a cookieless analytics service, through our own address (stats.karvark.com). It records page views, referrers, approximate country and device type in aggregate. It sets no cookie, stores no identifier on your device and does not follow you to other websites. Our hosting provider keeps standard logs that may include your IP address, browser type and the pages requested, for security and troubleshooting, and may set a strictly necessary security cookie to protect the site from automated abuse.
When you send us an enquiry. Through a form or assistant on this site, we collect what you give us: your name, your email address and your message, and, if you choose, your company, your role, your country, your sector, your team size, the tools you use today, what you are looking for, your timeline and how you heard about us. We record your agreement to be contacted and the exact wording you agreed to. We record how your enquiry reached us (campaign tags in the link, device type, browser family, the day and hour), not who you are. We do not store your IP address with your enquiry, and we do not guess your location.
When you email us. We receive what you write and the technical headers your mail carries, which we use to check that a message really came from the address it claims. We do not accept attachments. If you send one, it is not opened or read, and we reply to tell you so.
If you call us. Our phone line may be answered by an AI assistant, and it says so at the start of every call. We receive your phone number and what you say. Calls are transcribed, not recorded: we keep a written transcript of the call, its date, time and length, and how it ended. No audio of your call is stored, by us or by our phone provider. If you ask for a person, or the assistant cannot help, we connect you to a member of our team or arrange a call back.
If you text us, or we text you. If you call and we miss you, we may send one text message to the number you called from, to say we will get back to you. We also reply to messages you send us. We receive your number and your messages. Message frequency varies with your conversation. Message and data rates may apply. Reply STOP to stop all messages, or HELP for help. We never send marketing texts unless you have separately agreed to them.
If you message us on WhatsApp, Instagram or Facebook. We receive your display name, your phone number or profile, and your messages, and use them on the same terms as any other enquiry. If you comment a keyword on one of our posts (for example "CHECK"), Meta may send you an automatic message from us, and a person continues the conversation.
If you book a call. Our booking page is a Google Calendar appointment page. It collects your name, your email address, the time you choose and anything you add, and sends you a Google Meet link.
Advertising, only if you agree. If we advertise on Meta or LinkedIn, their cookies are placed on this site only if you accept advertising cookies when asked. Decline, and no advertising code is loaded at all. You can change your mind at any time with Cookie settings in our footer.
If you came to us from an ad. Only if you accepted advertising cookies, we may later tell that platform (Meta, LinkedIn or Google) whether your enquiry turned into a call or a booking, so our ads reach people like you and we stop paying for ads that don't work. We send this from our own system, and your email address or phone number only in a scrambled (hashed) form the platform can match but not read. We never do this if you declined, opted out, or your browser sends a Global Privacy Control signal.
We do not ask for payment card details, government identifiers, health data or other sensitive personal data. Please do not include them. If a message contains them anyway, our system flags it, keeps it out of what our AI assistant reads and deletes it sooner than other correspondence.
How we reply
Our first reply, by message or on a call, may come from an AI assistant, and it always says so. It answers questions and asks what we need in order to help you. It does not quote prices, agree terms or make any decision about you. No decision with legal or similarly significant effects on you is made by automated means alone. A person reads every enquiry, and you can ask for a person at any time and get one.
If someone else replies to a message we sent you, for example a colleague you forwarded it to, we treat them as a separate person with their own record and rights. Our assistant does not reply to them or repeat what they wrote. A person handles it.
Why we use it, and on what basis
| Purpose | India (DPDP) | UK and EU (GDPR) |
|---|---|---|
| Responding to your enquiry and following up about it | Your consent, given when you contact us; or a legitimate use you started by contacting us | Steps you asked us to take before a contract; our legitimate interest in answering people who contact us |
| Arranging and holding a call you book | Your consent | Steps before a contract |
| Measuring visits in aggregate (cookieless) | Not personal data in this form | Legitimate interest in understanding how the site is used |
| Advertising cookies and telling ad platforms about outcomes | Your consent | Your consent |
| Security, fraud prevention and keeping records of processing | Legal obligation and legitimate uses under the Act | Legal obligation; legitimate interest in keeping our systems safe |
| Meeting legal, tax and regulatory obligations | Legal obligation | Legal obligation |
We do not sell personal data, and we do not share it for cross-context behavioural advertising without your consent.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Cookies and tracking
By default this site sets no advertising or analytics cookies. Our analytics is cookieless. A strictly necessary security cookie may be set by our host to protect the site.
The only optional cookies this site can place are advertising cookies from Meta and LinkedIn, and only after you accept them. We ask once, with declining as easy as accepting and no pre-ticked boxes. If you decline or ignore the notice, no advertising code is loaded. To change your choice, use Cookie settings in the footer of any page. We treat a Global Privacy Control signal from your browser as a decline.
Who else sees it
We use these service providers, which process data on our instructions only:
| Provider | What it does for us |
|---|---|
| Cloudflare | Hosts and delivers this website; protects it from bots |
| Hetzner | Runs our enquiry system and its backups, on servers in Finland (European Union) |
| Umami | Cookieless website analytics |
| Anthropic | The AI model that reads your message or call transcript so our assistant can reply |
| Twilio | Our phone line and text messages; connects calls to our team |
| Meta Platforms | WhatsApp, Instagram and Facebook messages, if you contact us there |
| Our booking page, calendar and Meet links, and our company email | |
| Our email delivery provider | Sends and receives our enquiry emails |
| Pushover and Telegram | Alert our team that something needs attention. These alerts carry a reference number and a category only, never your name, contact details or message |
If you accept advertising cookies, Meta Platforms and LinkedIn also receive data about your visit as independent controllers under their own privacy policies.
We may disclose data where required by law or by a valid order of a competent authority.
How long we keep it
- Enquiries, emails, messages and call transcripts: 24 months from the last contact, unless they become part of a client engagement, in which case we keep them for that engagement and for the period Indian tax and company law requires afterwards.
- Content our system flags as sensitive: 90 days.
- A message that never resolves to a person, such as a delivery failure report: 30 days.
- Call audio: never kept.
- Records of processing (logs of what our systems did, without the content of your messages) are kept for at least one year, as Indian law requires, and used only for security and legal purposes.
- Records of how enquiries reach us contain no personal data and are kept in aggregate.
These periods are enforced by software that runs on a schedule and records what it did. If that software stops running, our systems stop accepting new enquiries until it is fixed.
How we delete
Your personal details are encrypted with a key that belongs to you alone. When we erase your data we destroy that key, so everything encrypted with it becomes unreadable, and we delete the records themselves wherever deletion can reach them.
What remains is the fact that an enquiry existed and how it was handled: counts, timings, outcomes and our record that the erasure happened. None of that identifies you.
One limit, stated plainly: we recognise you by the address or number you contacted us from. If you also contacted us from a different address or number, that is a separate record, and you will need to tell us about it.
How we protect it
Your personal details are encrypted, access is limited to the people who need it and protected by two-step sign-in, and our systems keep a tamper-evident record of what was done. If a breach affects your data, we will tell you without delay, in plain language, with what happened, what it may mean for you and what you can do, and we will inform the Data Protection Board of India and any other authority the law requires.
Where it is processed
Our enquiry system and its backups run on servers in Finland, in the European Union. This website is served by Cloudflare's global network. Our AI model provider, phone and messaging providers, booking provider and analytics provider may process data in the United States and other countries. Our team works from India. Where data leaves the UK or the European Economic Area, we rely on our providers' standard contractual safeguards. We publish the current list of providers on request.
Your rights
Everyone, wherever you live, gets the same rights from us:
- to know what we hold about you and get a copy;
- to correct it or complete it;
- to have it erased;
- to withdraw consent at any time, as easily as you gave it (this does not affect what we did before);
- to object to our use of it, and to opt out of advertising use at any time;
- to nominate another person to exercise these rights for you if you cannot.
Under India's Digital Personal Data Protection Act, 2023, these are your rights as a data principal. Under the UK and EU GDPR you also have the rights to restrict our use and to data portability. Residents of US states with privacy laws can use these rights too, and we will not treat you differently for using them.
To stop hearing from us, reply STOP to any text, or write to privacy@karvark.com. We will not contact you again, and we keep only the minimum record needed to be sure of that.
To use any right, write to privacy@karvark.com. We will ask enough to be satisfied that the request is yours, and we aim to respond within 30 days, and always within the period the law sets.
Complaints
Write to us first: P. Bhooviarashan, privacy@karvark.com, Karvark Tech Labs LLP, Chennai, Tamil Nadu, India. If you are not satisfied, you may complain to the Data Protection Board of India, or, if you are in the UK, to the Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live.
Children
This site and our services are for businesses. They are not directed at anyone under 18, and we do not knowingly collect their personal data. If you believe a child has sent us their data, write to privacy@karvark.com and we will delete it.
Client systems we build
Where we build or operate systems for a client, that client decides how data in their system is used, and we process it on their instructions under a written agreement. This policy covers karvark.com and our own enquiry channels only.
Changes
We will update this page when our practices change, and revise the date above. If a change affects how we use data you already gave us, we will tell you before it applies.