Privacy Policy

This explains how Grahak handles data when you use the website and the Service. Grahak is a solo project run by me, Shikhar (ceoshikhar.com). I collect as little as I need to run it, and I never sell your data. I use no tracking cookies and no third-party analytics; the only cookie is the essential one that keeps you signed in.

1. Two roles

Grahak handles two kinds of data with two responsibilities:

• Account data: information about you, the customer using the inbox. Here I’m the controller.
• End-user data: the messages and identity of yourcustomers who use the widget inside your product. Here I’m a processor acting on your behalf, under your instructions.

2. What I collect

• Account information: your name, email, and workspace/project details when you sign up.
• End-user identity: the identifier you send in a signed token (an external ID, and optionally a name and email). Only the external ID is required.
• Conversation content: messages, internal notes, and attachments exchanged through the widget and inbox.
• Usage & technical data: basic logs (IP address, timestamps, browser type) needed to run and secure the Service.

3. How I use it

• to provide, maintain, and secure the Service;
• to route conversations to the right inbox and keep them in sync between the widget and your team;
• to reach you about your account, security, and product updates;
• to meet legal obligations.

4. Sharing and subprocessors

I don’t sell personal data. I share it only with the service providers that help me run Grahak, under terms that require them to protect it: cloud hosting and object storage for the app and attachments, and Paddle, my payment provider, which processes checkout and billing details. I may also disclose information if the law requires it, or to protect Grahak and its users.

5. Attachments and retention

• Attachments live in object storage; uploads that never get attached to a message are purged automatically within 24 hours.
• I keep conversation content while your account is active.
• When you delete data or close your account, I delete or anonymize it within a reasonable period, unless the law requires me to keep it.

6. Security

Grahak tokens are exchanged inside an isolated iframe on Grahak’s origin and never touch your page. I use standard measures to protect data in transit and at rest. No system is perfectly secure, so I can’t promise absolute security.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, or to object to some processing. For account data, email me. For end-user data, your request should go to the company whose product you used, and I’ll help them as the processor.

8. Where data is processed

I may process and store data in countries other than yours, using appropriate safeguards where they’re required.

9. Children

Grahak isn’t meant for children under 16, and I don’t knowingly collect their data.

10. Changes

I may update this policy now and then. Significant changes show up in the date above and, where it makes sense, get announced.

11. Contact

Questions or requests? Email hey@ceoshikhar.com.