Privacy Policy

Last updated October 20, 2026

This Privacy Policy explains how HARRELLS BRANDS ("KaamGrid", "we", "us") collects, uses, shares and protects personal data when you visit this website or use the KaamGrid project planning service.

It is one policy for everyone. Sections 1 to 14 apply wherever you are. Section 15 adds the rights and details that apply in your region: India, the European Union and United Kingdom, the United States, Canada, Australia, the United Arab Emirates and Oman. If your local law gives you more protection than this policy, your local law applies.

1. Who we are

For personal data we collect about you directly (for example when you create an account), KaamGrid decides how and why it is used. Data protection laws call this the Data Fiduciary (India) or controller (EU, UK and most other laws).

• Name: HARRELLS BRANDS
• Registered address: KERALA, INDIA
• Email: contact@kaamgrid.com

When an organization uses KaamGrid to plan its work, the information its people put into projects (tasks, comments, files, names of colleagues) is processed on that organization's behalf. For that content, the organization is the Data Fiduciary or controller, and KaamGrid is its Data Processor (or "service provider"). Please contact your organization first about that content; we will help them respond.

2. Personal data we collect

We do not collect sensitive data such as financial account numbers, health or biometric data through the service, and we ask you not to upload it. Card and bank details are entered directly with our payment providers; we never see or store them.

3. Why we use it (purposes)

We process personal data only for these purposes:

1. To create and run your account and your organization's workspace.
2. To provide the features you use: planning, assignments, notifications, email codes and, if your organization uses it, AI plan drafting.
3. To bill your organization for its plan and keep accounting records.
4. To answer support requests and feedback.
5. To keep the service secure: preventing fraud and abuse, detecting and investigating incidents.
6. To meet our legal obligations, for example tax law and lawful requests from authorities.

We do not use your data for advertising, we do not build profiles of you, and we do not make decisions about you by automated means alone.

4. Legal basis

Depending on where you are, we rely on:

• Your consent, which you give when you create an account and accept this policy.
• Contract: we need the data to provide the service your organization signed up for.
• Legal obligation: for example keeping invoices for tax law.
• Legitimate interests or legitimate uses: keeping the service secure and answering your messages, where your rights do not outweigh them. In India these are the legitimate uses in Section 7 of the Digital Personal Data Protection Act, 2023.

Withdrawing consent. You can withdraw consent at any time, as easily as you gave it: delete your account under Settings › Your data, email us, or ask your organization's admin to remove you. Withdrawal does not affect processing done before it. After withdrawal we stop processing and erase your data unless the law requires us to keep it, but we can no longer provide the service to you.

5. Sharing your data

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with:

• Service providers that help us run the service, under their terms with us:

  • hosting, backups and email delivery;
  • Google, if you choose to sign in with Google, and for Google Analytics on our public website (see Section 12);
  • Google Gemini, for the optional AI features, only when someone in your organization uses them: drafting a plan sends the project name, start date and description; a status report sends the project's progress figures, task names and the names of the people who own overdue or critical tasks. On KaamGrid's included AI allowance, Google's terms allow it to use this content to improve its products, and people at Google may review it. Don't put personal or confidential information in AI requests. If your organization adds its own Gemini key under Administration, its requests are covered by its own agreement with Google instead;

• People in your organization, who can see your name, role and the work assigned to you.

• Authorities, when the law requires it.

6. International transfers

We are based in India and our servers are in India. Some of our service providers are elsewhere: Google (sign-in, analytics and AI features) may process data in the United States and other countries, and the United Kingdom.

• We do not transfer personal data to any country or territory that the Government of India restricts under Section 16 of the DPDP Act.
• Where a provider receives personal data from the EU, UK or Switzerland, we rely on its data processing terms, which include the European Commission's Standard Contractual Clauses (and the UK Addendum).
• Wherever your data is processed, it is protected as this policy describes. Authorities in those countries may be able to access it under their laws.

7. How long we keep it

• Account and work content: while your account is active. If you delete your account, your profile, to-do list and sign-in details are erased straight away (and from backups as they rotate out); work you did on projects stays with your organization without your name. If your organization closes its account, we erase its data within 90 days, unless the law requires us to keep it longer.
• Invoices and billing records: for as long as tax and accounting laws require (generally up to 8 years).
• Security logs: at least one year, as India's DPDP Rules require, and then deleted.

Before erasing personal data because the purpose is complete, we will inform you at least 48 hours in advance where the law requires it.

8. How we protect it

We use reasonable security safeguards, including encryption in transit (HTTPS), hashed passwords, optional two-factor authentication, role-based access, access logging and monitoring, regular backups, and a separate, restricted administration site for our staff.

9. Personal data breaches

If a personal data breach is likely to affect you, we will tell you without delay, in plain language, what happened, the likely consequences, what we are doing about it, and what you can do to protect yourself. We will also report it to the regulators that the law requires, within the time it requires: for example the Data Protection Board of India (a detailed report within 72 hours) and, for EU or UK users, the relevant supervisory authority within 72 hours.

10. Your rights

Wherever you are, you can:

• Get a copy of your personal data: Settings › Your data › Download my data gives you a file you can keep or move to another service.
• Correct or update it: most details are under Settings › Profile.
• Delete your account: Settings › Your data › Delete my account. If you are your organization's only admin, make someone else an admin first, or email us to close the whole organization.
• Withdraw consent, object to or restrict processing, and complain to us and to your regulator (see Section 15).

For anything you can't do in Settings, email contact@kaamgrid.com from the address on your account, or use the contact page. We may need to verify your identity. We answer within the time your local law allows (see Section 15), and never later than 90 days. Using your rights is free and we will not treat you differently for using them.

11. Children

KaamGrid is a workplace tool and is not meant for anyone under 18. We do not knowingly process children's personal data, and we do not track, behaviourally monitor or target advertising at children. If a child's data reaches us without verifiable consent from a parent or lawful guardian, we will delete it. Contact us if you believe this has happened.

12. Cookies

We use essential cookies, which the service needs to work. On our public website, and only if you accept, we also use Google Analytics cookies to understand how visitors use it; they are never used inside the app after you sign in. See our Cookie Policy.

13. Grievance Officer and privacy contact

If you have a question or complaint about your personal data, contact our Grievance Officer, who is also our privacy contact for every region:

• Name: KaamGrid grievance
• Email: contact@kaamgrid.com
• Address: KERALA, INDIA

14. Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will tell account holders by email or in the app before it takes effect.

15. Your region

India

This policy is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 and the Information Technology Act, 2000 and its rules. As a Data Principal you have the rights to access information (Section 11), correction and erasure (Section 12), grievance redressal (Section 13) and to nominate someone to use your rights if you die or become unable to (Section 14). You also have duties under Section 15, such as not giving false information and not filing frivolous complaints. We resolve grievances within 90 days. If you are not satisfied, you may complain to the Data Protection Board of India. You can ask for this notice in English or in any language in the Eighth Schedule to the Constitution of India by writing to the Grievance Officer.

European Union, European Economic Area and United Kingdom

The General Data Protection Regulation (GDPR) and the UK GDPR apply. Our legal bases are in Section 4, and transfers are covered in Section 6. You have the rights of access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests) and to withdraw consent. We answer within one month, which we may extend by two months for complex requests, and we will tell you if we do. You can complain to the data protection authority where you live or work (in the UK, the Information Commissioner's Office).

United States

Residents of California (under the CCPA, as amended by the CPRA) and of other states with consumer privacy laws (such as Virginia, Colorado, Connecticut, Utah and Texas) have the right to know what personal information we collect and why, to access, correct and delete it, and not to be discriminated against for using these rights. The categories we collect are in Section 2, the purposes in Section 3, and who we share it with in Section 5. We do not sell or share personal information (as those laws define "sell" and "share"), and we do not use sensitive personal information to infer characteristics about you. We honour Global Privacy Control signals. An authorized agent may make a request for you with your written permission. We answer within 45 days, extendable once by 45 days. If we deny your request, you may appeal by replying to our answer, and then contact your state Attorney General.

Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector (Law 25) apply. You may access and correct your personal information and withdraw consent, and we answer within 30 days. Our Grievance Officer (Section 13) is the person responsible for protecting personal information. Your information may be processed outside Canada (Section 6), where the authorities of those countries may be able to access it under their laws. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Australia

We handle personal information under the Privacy Act 1988 and the Australian Privacy Principles. You may access and correct your personal information, and we answer within 30 days. You can use a pseudonym when contacting us where that is practical. Your information is stored in India and may be processed by our providers in the other countries named in Section 6. We follow the Notifiable Data Breaches scheme. If you are not satisfied with our answer to a complaint, you can contact the Office of the Australian Information Commissioner (OAIC).

United Arab Emirates

The Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies (or, for organizations in the DIFC or ADGM, their own data protection laws). You have the rights to information, access, data portability, correction, erasure, restriction, and to object to processing, including decisions made by automated means alone (we do not make such decisions). Your data is stored in India and may be processed in the other countries named in Section 6. You can complain to the UAE Data Office (or the DIFC or ADGM Commissioner).

Oman

The Personal Data Protection Law (Royal Decree No. 6/2022) and its Executive Regulations apply. We process your data with your explicit consent, which you can withdraw at any time. You have the rights to access, correct, transfer and erase your data, and to be told about a breach that affects you. Your data is stored in India and may be processed in the other countries named in Section 6. You can complain to the Ministry of Transport, Communications and Information Technology.