Privacy Policy

Last updated: 16 August 2026

bananaleaf.ai is operated by Krishav Technologies Private Limited (“bananaleaf.ai”, “we”, “us”, “our”), a company incorporated in India. This policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it. It is written to comply with India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it.

We have tried to keep this in plain English. If anything is unclear, write to us at contact@bananaleaf.ai and we will explain.

1. Who this policy covers

This policy applies to:

• Visitors to this website (bananaleaf.ai);
• People who sign up for and use the bananaleaf.ai product (“customers”); and
• People whose details a customer uploads into bananaleaf.ai — for example, a customer’s contact list (“end contacts”). Section 3 explains how this case is different.

2. What we collect and why

Under the DPDP Act, “personal data” means any data about an individual who is identifiable by or in relation to that data. Here is what we collect, and the purpose for each:

• Account data — your name, email address, and profile picture, received from Google when you sign in with your Google account. Purpose: creating and securing your account and workspace.
• Workspace content — landing pages, product catalogues, message templates, and business information you add to your workspace. Purpose: providing the service you signed up for.
• Uploaded contact data — names, phone numbers, email addresses, and purchase or interaction history that you (a customer) upload or connect. Purpose: running your follow-up campaigns, on your instructions.
• Usage data — pages visited, features used, and approximate location derived from your IP address, collected through our analytics tool (PostHog). Purpose: understanding what works and improving the product.
• Device and log data — browser type, device type, IP address, and error logs. Purpose: security, debugging, and preventing abuse.
• Communication records — messages sent and delivery/read status returned by messaging providers. Purpose: showing you campaign results and preventing duplicate sends.
• Call recordings and transcripts — where a customer uses our call centre channel, calls to and from that business line are recorded by our telephony partner. We store the recording, generate a written transcript, and analyse it to produce a call summary and a suggested follow-up message for the business to review. Purpose: giving the business a record of the call and drafting a reply for a human to approve. No message is sent from a call without a person approving it, and the mobile and web apps only ever play these recordings back — neither app records audio from your device or asks for microphone access.
• Support requests — the name, email address and message you send us through our support form. Purpose: replying to you and fixing the problem. We do not use support requests for marketing.

We do not collect personal data we do not need, and we never sell personal data to anyone.

3. Our two roles: Data Fiduciary and Data Processor

The DPDP Act distinguishes between two roles, and we play both, for different data:

• For your account and usage data, we are the Data Fiduciary — the entity that decides why and how personal data is processed. We are directly responsible to you under the DPDP Act for this data.
• For end-contact data uploaded by a customer, the customer is the Data Fiduciary and we are a Data Processor— we process that data only on the customer’s instructions, under a contract, to run their campaigns. If you are an end contact and want your data corrected or erased, the fastest route is to contact the business that messaged you; you can also write to us and we will pass the request to them and assist.

4. Consent, and how to withdraw it

Where we process your personal data on the basis of consent, we ask for it with a clear notice — in English or, on request, in any language listed in the Eighth Schedule of the Indian Constitution — describing the data and the purpose. You can withdraw consent at any time, and withdrawing is as easy as giving it: email contact@bananaleaf.ai or use the controls in your account settings. Withdrawal does not affect processing already done, and we may retain data we are legally required to keep.

For some processing we rely on “legitimate uses” recognised by Section 7 of the DPDP Act — for example, when you voluntarily give us your details for a stated purpose, to comply with law, or to respond to a medical or safety emergency.

5. Who we share data with

We share personal data only with service providers (Data Processors) who help us run bananaleaf.ai, under contracts that restrict what they can do with it:

• Cloud hosting and storage — Google Cloud Platform;
• Database — MongoDB Atlas;
• Sign-in — Google Firebase Authentication;
• Product analytics — PostHog;
• Messaging delivery — channel providers such as Meta (for WhatsApp) and SMS/email providers, to the extent needed to deliver messages you or your business send.

We may also disclose data where the law requires it — for example, to a court or a government agency with lawful authority.

6. Where data is stored (cross-border transfers)

Our infrastructure is hosted on cloud regions in India and may involve processing in other countries. We do not transfer personal data to any country restricted by the Central Government under Section 16 of the DPDP Act, and we apply the same safeguards wherever the data is processed.

7. How long we keep data

We keep personal data only while it serves the purpose it was collected for: account data for as long as your account is active, and uploaded contact data for as long as the customer keeps it in their workspace. When you delete data, close your account, or withdraw consent — or when the purpose is served and retention is no longer required by law — we erase the data and instruct our processors to do the same.

Call recordings, transcripts and the summaries generated from them are kept while the workspace they belong to is active, and are erased when the workspace or the account is deleted.

Deleting your account. You can delete your account, and everything it owns, from inside the mobile app: More → Account → Delete account. This permanently erases your login, the organisations you own, their branches, and all data under them — contacts, conversations, campaigns, templates, call recordings, transcripts and insights. It cannot be undone. If you only hold a seat in someone else’s organisation, deleting your account removes your access; their data is unaffected. You can also write to us at the address in section 12 and we will do it for you.

8. How we protect data

We use reasonable security safeguards as required by the DPDP Act: encryption in transit, access controls and tenant isolation (every record is scoped to the workspace it belongs to), least-privilege access for our team, and logging. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected person in the form and timelines prescribed under the DPDP Rules.

9. Your rights under the DPDP Act

As a Data Principal (the person the data is about), you have the right to:

• Access — request a summary of the personal data we hold about you and the processing activities performed on it;
• Correction and erasure — have inaccurate data corrected, incomplete data completed, and data erased when it is no longer needed;
• Grievance redressal — have your complaint heard and resolved (see Section 12 below);
• Nominate — appoint another person to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email contact@bananaleaf.ai from the address linked to your account (or with enough detail for us to verify it is you). We respond within the timelines prescribed under the DPDP Rules.

10. Children’s data

bananaleaf.ai is a business tool and is not directed at children. We do not knowingly process the personal data of anyone under 18 without the verifiable consent of a parent or lawful guardian, and we do not carry out tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a child’s data has been uploaded to our systems, write to us and we will remove it.

11. Cookies and analytics

This website and the product use a small number of cookies and similar technologies: strictly necessary cookies for sign-in sessions, and analytics (PostHog) to understand product usage. We do not use third-party advertising cookies.

12. Grievance Officer and complaints

If you have a question, request, or complaint about your personal data, contact our Grievance Officer:

• Grievance Officer, Krishav Technologies Private Limited — contact@bananaleaf.ai

We acknowledge complaints promptly and aim to resolve them within the period prescribed under the DPDP Rules. If you are not satisfied with our response, you have the right to escalate your complaint to the Data Protection Board of India.

13. Changes to this policy

We may update this policy as the product or the law changes. We will post the new version here with an updated date, and for material changes we will notify you by email or in the product before they take effect.